Marichi 13 kupita ku gulu la RIPE lolimbana ndi nkhanza lingalirani kubera kwa BGP (hjjack) ngati kuphwanya malamulo a RIPE. Ngati pempholi litavomerezedwa, wothandizira pa intaneti yemwe adagwidwa ndi kutsekeredwa kwa magalimoto angakhale ndi mwayi wotumiza pempho lapadera kuti aulule wowukirayo. Ngati gulu lowunika litapeza umboni wokwanira wochirikiza, LIR yomwe inali gwero la kulandidwa kwa BGP ingatengedwe ngati wolowerera ndipo ikhoza kulandidwa udindo wake wa LIR. Panalinso mikangano ina zosintha.
M'bukuli tikufuna kusonyeza chitsanzo cha kuukira kumene osati woukira weniweni yekha, komanso mndandanda wonse wa prefixes okhudzidwa. Komanso, kuukira koteroko kumadzutsanso mafunso okhudza zolinga zamtsogolo zamtundu wamtunduwu.
Pazaka zingapo zapitazi, mikangano yokha ngati MOAS (Multiple Origin Autonomous System) idasindikizidwa m'manyuzipepala ngati BGP. MOAS ndi chochitika chapadera pomwe machitidwe awiri odziyimira pawokha amatsatsa mawu oyambira otsutsana ndi ma ASN ofanana mu AS_PATH (ASN yoyamba mu AS_PATH, pambuyo pake imatchedwa ASN). Komabe, tingatchule osachepera kusokoneza magalimoto, kulola wowukirayo kusokoneza AS_PATH pazifukwa zosiyanasiyana, kuphatikizapo kudutsa njira zamakono zosefera ndi kuyang'anira. Mtundu wodziwika bwino - mtundu wotsiriza wa kutsekereza koteroko, koma osati nkofunikira. N’kutheka kuti zimenezi n’zofanana ndendende ndi zimene taona m’masabata apitawa. Chochitika choterocho chimakhala ndi chikhalidwe chomveka komanso zotsatira zake zoopsa.
Amene akufunafuna mtundu wa TL; DR akhoza kupita kumutu wa "Perfect Attack".
Netiweki maziko
(kuti zikuthandizeni kumvetsetsa bwino zomwe zikuchitika muzochitika izi)
Ngati mukufuna kutumiza paketi ndipo muli ndi ma prefixes angapo patebulo lolowera lomwe lili ndi adilesi ya IP, ndiye kuti mudzagwiritsa ntchito njira yachiyambi chokhala ndi utali wautali kwambiri. Ngati pali njira zingapo zopangira choyambira chimodzi patebulo lolowera, mudzasankha yabwino kwambiri (malinga ndi njira yabwino yosankhira njira).
Njira zosefera zomwe zilipo komanso zowunikira zimayesa kusanthula njira ndikupanga zisankho posanthula za AS_PATH. Router imatha kusintha izi kukhala mtengo uliwonse pakutsatsa. Kungowonjezera ASN ya eni ake koyambirira kwa AS_PATH (monga chiyambi ASN) kungakhale kokwanira kudutsa njira zowunikira zomwe zikuchitika. Komanso, ngati pali njira yochokera ku ASN kupita kwa inu, ndizotheka kuchotsa ndikugwiritsa ntchito AS_PATH yanjirayi pazotsatsa zanu zina. Chotsimikizira chilichonse cha AS_PATH-chokha pazolengeza zanu zomwe mwapanga chidzadutsa.
Palinso malire ochepa oyenera kutchulidwa. Choyamba, ngati kusefa kwa prefix ndi wopereka kumtunda, njira yanu ikhoza kusefedwa (ngakhale ndi AS_PATH yolondola) ngati choyambirira sichili cha kasitomala wanu chokhazikitsidwa kumtunda. Chachiwiri, njira yolondola ya AS_PATH ikhoza kukhala yosavomerezeka ngati njira yomwe idapangidwayo ikulengezedwera molakwika, motero, ikuphwanya malamulo oyendetsera. Pomaliza, njira iliyonse yokhala ndi mawu oyamba omwe amaphwanya kutalika kwa ROA ikhoza kuonedwa kuti ndi yolakwika.
Chochitika
Masabata angapo apitawo tidalandira dandaulo kuchokera kwa m'modzi mwa ogwiritsa ntchito athu. Tidawona mayendedwe okhala ndi chiyambi chake ASN ndi /25 prefixes, pomwe wosuta adati sanawalengeze.
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.0/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.7.128/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.0/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.18.128/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.0/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.163.226.128/25|265466 262761 263444 22356 3491 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.0/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
TABLE_DUMP2|1554076803|B|xxx|265466|78.164.7.128/25|265466 262761 263444 6762 2914 9121|INCOMPLETE|xxx|0|0||NAG||
Zitsanzo za zilengezo zoyambira pa Epulo 2019
NTT panjira ya /25 prefix imapangitsa kuti izikhala zokayikitsa kwambiri. LG NTT sinadziwe za njirayi panthawiyi. Chifukwa chake inde, wogwiritsa ntchito wina amapanga AS_PATH yonse pazoyambira izi! Kuyang'ana pa ma routers kumawonetsa ASN imodzi: AS263444. Titayang'ana njira zina zokhala ndi dongosolo lodziyimira pawokha, tidakumana ndi izi:
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.0/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.23.143.128/25|265466 262761 263444 22356 6762 9498 9730 45528|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.24.0.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.24.128.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.26.0.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.26.128.0/17|265466 262761 263444 6762 4837|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.64.96.0/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.64.112.0/20|265466 262761 263444 6762 3491 4760|IGP|xxx|0|0||NAG||
Yesani kulingalira chomwe chalakwika apa
Zikuwoneka kuti wina adatenga mawu oyambira panjirayo, nagawa magawo awiri, ndikulengeza njirayo ndi AS_PATH paziyambi ziwirizo.
TABLE_DUMP2|1554076800|B|xxx|263444|1.6.36.0/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|263444|1.6.38.0/23|263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|61775|1.6.36.0/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|61775|1.6.38.0/23|61775 262761 263444 52320 9583|IGP|xxx|0|0|32:12595 52320:21311 65444:20000|NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.36.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|265466|1.6.38.0/23|265466 262761 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|28172|1.6.36.0/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||
TABLE_DUMP2|1554076800|B|xxx|28172|1.6.38.0/23|28172 52531 263444 52320 9583|IGP|xxx|0|0||NAG||
Njira zofananira m'modzi mwa awiriawiri apachiyambi
Mafunso angapo amabuka nthawi imodzi. Kodi alipo wina amene anayesapo kutsekereza kwa mtundu umenewu? Kodi pali wina amene watengapo njirazi? Ndi mawu oyamba otani omwe adakhudzidwa?
Apa ndipamene zolephera zathu zambiri zimayambira komanso kukhumudwa kwina ndi momwe thanzi la intaneti lilili.
Njira yakulephera
Zinthu zoyamba poyamba. Kodi tingadziwe bwanji kuti ndi ma router ati omwe amavomereza njira zoduliridwa ngati izi komanso ndi magalimoto ati omwe angatumizidwenso masiku ano? Tidaganiza kuti tiyamba ndi /25 prefixes chifukwa "sangathe kugawa padziko lonse lapansi." Monga momwe mungaganizire, tinali olakwa kwambiri. Metric iyi idakhala yaphokoso kwambiri ndipo njira zokhala ndi zoyambira zotere zitha kuwoneka ngakhale kuchokera kwa ogwiritsa ntchito a Tier-1. Mwachitsanzo, NTT ili ndi ma prefixes pafupifupi 50, omwe amagawira makasitomala ake. Kumbali ina, metric iyi ndiyabwino chifukwa ma prefixes otere amatha kusefedwa ngati wogwiritsa ntchito agwiritsa ntchito , mbali zonse. Choncho, njirayi si yoyenera kupeza onse ogwira ntchito omwe magalimoto awo adasinthidwa chifukwa cha zochitika zoterezi.
Lingaliro lina labwino lomwe tidaganiza linali kuyang'ana . Makamaka pamayendedwe omwe akuphwanya lamulo la maxLength la ROA yofananira. Mwanjira iyi titha kupeza kuchuluka kwa ma ASN osiyanasiyana omwe ali ndi mawonekedwe Osavomerezeka omwe amawonekera kwa AS yoperekedwa. Komabe, pali vuto "laling'ono". Avereji (yapakatikati ndi mawonekedwe) a nambala iyi (chiwerengero cha ma ASN oyambira osiyanasiyana) ndi pafupifupi 150 ndipo, ngakhale titasefa timachubu ting'onoting'ono, timakhala pamwamba pa 70. Mkhalidwe uwu wa zinthu uli ndi kufotokozera kosavuta: pali kokha ogwiritsira ntchito ochepa omwe amagwiritsa ntchito kale zosefera za ROA ndi ndondomeko ya "kubwezeretsani njira Zosavomerezeka" pamalo olowera, kotero kuti kulikonse kumene njira yomwe ili ndi vuto la ROA ikuwonekera padziko lenileni, ikhoza kufalikira mbali zonse.
Njira ziwiri zomaliza zimatipatsa mwayi wopeza ogwiritsa ntchito omwe adawona zomwe zidachitika (popeza zinali zazikulu), koma sizigwira ntchito. Chabwino, koma kodi tingamupeze wolowererayo? Kodi zosintha za AS_PATH ndi zotani? Pali malingaliro angapo oyambira:
- Mawu oyamba anali asanaonepo paliponse;
- Origin ASN (chikumbutso: choyamba ASN mu AS_PATH) ndichovomerezeka;
- ASN yomaliza mu AS_PATH ndi ASN ya wowukira (ngati woyandikana naye angayang'ane ASN ya woyandikana nawo panjira zonse zomwe zikubwera);
- Kuwukiraku kumachokera kwa wothandizira m'modzi.
Ngati malingaliro onse ali olondola, ndiye kuti njira zonse zolakwika zidzapereka ASN (kupatulapo chiyambi cha ASN) ndipo, motero, iyi ndi mfundo "yovuta". Mwa obera owona anali AS263444, ngakhale panali ena. Ngakhale titataya njira zomwe zachitika poganizira. Chifukwa chiyani? Mfundo yofunika ikhoza kukhala yovuta ngakhale panjira zolondola. Zitha kukhala chifukwa cha kusalumikizana bwino m'dera kapena kuchepa kwa mawonekedwe athu.
Chotsatira chake, pali njira yodziwira wowukira, koma pokhapokha ngati zonse zomwe zili pamwambazi zakwaniritsidwa ndipo pokhapokha pamene kutsekera kuli kwakukulu kokwanira kuti adutse zowunikira. Ngati zina mwa zinthuzi sizinakwaniritsidwe, kodi tingadziŵe mayambiriro amene anakhudzidwa ndi kutsekeredwa koteroko? Kwa ena ogwira ntchito - inde.
Wowukira akapanga njira yodziwika bwino, chilembo chotere sichimalengezedwera ndi eni ake enieni. Ngati muli ndi mndandanda wosinthika wa ma prefixes ake onse, ndiye kuti zimakhala zotheka kufananitsa ndikupeza njira zopotoka. Timasonkhanitsa mndandanda wa prefixes pogwiritsa ntchito magawo athu a BGP, chifukwa sitingopatsidwa mndandanda wathunthu wa njira zomwe zikuwonekera kwa woyendetsa pakali pano, komanso mndandanda wa ma prefixes onse omwe akufuna kulengeza kudziko lapansi. Tsoka ilo, pali ogwiritsa ntchito angapo a Radar omwe samamaliza gawo lomaliza molondola. Tidzawadziwitsa posachedwa ndikuyesera kuthetsa vutoli. Wina aliyense atha kujowina dongosolo lathu lowunika pompano.
Ngati tibwerera ku chochitika choyambirira, onse owukirawo ndi malo ogawa adadziwika ndi ife pofufuza mfundo zovuta. Chodabwitsa, AS263444 sinatumize njira zopeka kwa makasitomala ake onse. Ngakhale pali mphindi yachilendo.
BGP4MP|1554905421|A|xxx|263444|178.248.236.0/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||
BGP4MP|1554905421|A|xxx|263444|178.248.237.0/24|263444 6762 197068|IGP|xxx|0|0|13106:12832 22356:6453 65444:20000|NAG||
Chitsanzo chaposachedwa cha kuyesa kusokoneza malo athu adilesi
Pamene zina zachindunji zidapangidwa pazoyambira zathu, AS_PATH yopangidwa mwapadera idagwiritsidwa ntchito. Komabe, AS_PATH sikanatengedwa kuchokera mumayendedwe athu am'mbuyomu. Tilibe ngakhale kulumikizana ndi AS6762. Kuyang'ana njira zina zomwe zinachitika, ena mwa iwo anali ndi AS_PATH yeniyeni yomwe idagwiritsidwa ntchito kale, pamene ena sanatero, ngakhale akuwoneka ngati enieni. Kusintha AS_PATH sikuthandizanso, chifukwa magalimoto adzatumizidwa kwa wowukirayo, koma njira zomwe zili ndi "zoyipa" AS_PATH zitha kusefedwa ndi ASPA kapena njira ina iliyonse yowunikira. Apa tikuganiza za chilimbikitso cha wobera. Pakali pano tilibe chidziwitso chokwanira chotsimikizira kuti chochitikachi chinali chiwembu chokonzekera. Komabe, n’zotheka. Tiyeni tiyese kulingalira, ngakhale tikadali ongopeka, koma mwina zenizeni, mkhalidwe.
Wangwiro Attack
Kodi tili ndi chiyani? Tiyerekeze kuti ndinu opereka njira zoulutsira makasitomala anu. Ngati makasitomala anu ali ndi kupezeka kochulukirapo (multihome), ndiye kuti mungolandira gawo limodzi la magalimoto awo. Koma kuchuluka kwa magalimoto m'pamenenso mumapeza ndalama zambiri. Chifukwa chake ngati muyamba kutsatsa ma prefixes a subnet amayendedwe omwewo ndi AS_PATH, mulandila ena onse. Zotsatira zake, ndalama zotsalazo.
Kodi ROA ithandiza apa? Mwina inde, ngati mwaganiza zosiya kuzigwiritsa ntchito . Kuphatikiza apo, sizofunika kwambiri kukhala ndi zolemba za ROA zokhala ndi ma prefixes ophatikizika. Kwa ena ogwira ntchito, zoletsa zoterezi ndizosavomerezeka.
Poganizira njira zina zachitetezo, ASPA sithandizanso pankhaniyi (chifukwa imagwiritsa ntchito AS_PATH kuchokera panjira yoyenera). BGPSec sinali njira yabwino kwambiri chifukwa cha kutsika kwa ana otengera komanso mwayi wotsalira wa kuwukira.
Chifukwa chake tili ndi phindu lomveka bwino kwa wowukirayo komanso kusowa kwachitetezo. Kusakaniza kwakukulu!
Kodi tiyenera kuchita chiyani?
Chodziwikiratu komanso chovuta kwambiri ndikuwunikanso ndondomeko yanu yamakono. Dulani malo anu aadiresi muzigawo zing'onozing'ono (zopanda kuphatikizika) zomwe mukufuna kutsatsa. Lowani ROA pazokha, osagwiritsa ntchito maxLength parameter. Pamenepa, POV yanu yamakono ikhoza kukupulumutsani ku chiwonongeko choterocho. Komabe, kachiwiri, kwa ena ogwira ntchito njira iyi si yoyenera chifukwa chogwiritsa ntchito njira zodziwika bwino. Mavuto onse omwe ali ndi ROA ndi njira zamakono zidzafotokozedwa mu chimodzi mwazinthu zathu zamtsogolo.
Kuphatikiza apo, mutha kuyesa kuyang'anira zosokoneza zotere. Kuti tichite izi, tifunika zambiri zodalirika za ma prefixes anu. Chifukwa chake, ngati mungakhazikitse gawo la BGP ndi wotolera ndikutipatsa chidziwitso chokhudza mawonekedwe anu pa intaneti, titha kupeza kuchuluka kwa zochitika zina. Kwa iwo omwe sanalumikizidwebe ndi dongosolo lathu loyang'anira, poyambira, mndandanda wamayendedwe okha ndi ma prefixes anu ndiwokwanira. Ngati muli ndi gawo ndi ife, chonde onani kuti njira zanu zonse zatumizidwa. Tsoka ilo, izi ndizoyenera kukumbukira chifukwa ogwiritsa ntchito ena amaiwala mawu oyamba kapena awiri motero amasokoneza njira zathu zofufuzira. Ngati tachita bwino, tidzakhala ndi chidziwitso chodalirika chokhudza ma prefixes anu, omwe m'tsogolomu adzatithandiza kuzindikira ndi kuzindikira izi (ndi zina) zamtundu wa magalimoto pa malo anu adiresi.
Ngati muzindikira kusokoneza koteroko kwa magalimoto anu munthawi yeniyeni, mutha kuyesa kuthana nayo nokha. Njira yoyamba ndikulengezetsa njira ndi ma prefixes ena enieni inunso. Pakachitika kuukira kwatsopano pa prefixes izi, bwerezani.
Njira yachiwiri ndiyo kulanga wowukirayo ndi omwe ali gawo lofunikira (panjira zabwino) mwa kudula njira zanu zopita kwa wowukirayo. Izi zitha kuchitika powonjezera ASN ya wowukirayo ku AS_PATH yamayendedwe anu akale motero amawakakamiza kuti apewe AS kugwiritsa ntchito njira yodziwira loop mu BGP. .
Source: www.habr.com