Routing worm: a fast, selective attack worm based on IP address information
Routing worm: a fast, selective attack worm based on IP address information
复制标题
DOI：
10.1109/pads.2005.24
复制
发表时间：
2005-06
期刊：
影响因子：
--
通讯作者：
C. Zou;D. Towsley;W. Gong;Songlin Cai
中科院分区：
文献类型：
--
作者：
C. Zou;D. Towsley;W. Gong;Songlin Cai
大多数著名的蠕虫，如Code Red、Slammer、Blaster和Sasser，通过扫描整个IPv4地址空间感染易受攻击的计算机。在本文中，我们提出了一个先进的蠕虫称为“路由蠕虫”，它实现了两个先进的攻击技术。首先，路由蠕虫使用BGP路由表只扫描Internet可变地址空间，这使得它的传播速度比传统蠕虫快三倍。其次，更重要的是，BGP路由前缀的地理信息使路由蠕虫能够通过对特定国家、公司、互联网服务提供商或自治系统中易受攻击的计算机造成严重损害来进行精确的“选择性攻击”，而不会对其他计算机造成附带损害。由于BGP路由表固有的公开性，攻击者可以很容易地部署路由蠕虫，这使路由蠕虫与其他“最坏情况”蠕虫区分开来。与传统蠕虫相比，路由蠕虫可能会对互联网主干造成更严重的拥塞，因为路由蠕虫发送的所有扫描都是互联网可变的（只能在目的地丢弃）。此外，快速检测受路由蠕虫感染的计算机也很困难，因为如果不等待流量响应，我们就无法区分非法扫描和常规连接。为了防御路由蠕虫和所有扫描蠕虫，一个有效的方法是将目前的互联网从IPv4升级到IPv6，尽管这样的升级将需要付出巨大的努力，并且仍然是一个有争议的问题。
Most well-known worms, such as Code Red, Slammer, Blaster, and Sasser, infected vulnerable computers by scanning the entire IPv4 address space. In this paper, we present an advanced worm called "routing worm", which implements two advanced attacking techniques. First, a routing worm uses BGP routing tables to only scan the Internet mutable address space, which allows it propagate three times faster than a traditional worm. Second, and more importantly, the geographic information of BGP routing prefixes enables a routing worm to conduct pinpoint "selective attacks" by imposing heavy damage to vulnerable computers in a specific country, company, Internet service provider, or autonomous system, without collateral damage done to others. Because of the inherent publicity of BGP routing tables, attackers can easily deploy routing worms, which distinguishes the routing worm from other "worst-case" worms. Compared to a traditional worm, a routing worm could possibly cause more severe congestion to the Internet backbone since all scans sent out by a routing worm are Internet mutable (and can only be dropped at the destinations). In addition, it is harder to quickly detect a routing-worm infected computer since we cannot distinguish illegal scans from regular connections without waiting for traffic responses. In order to defend against routing worms and all scanning worms, an effective way is to upgrade the current Internet from IPv4 to IPv6, although such an upgrade will require a tremendous effort and is still a controversial issue.