MITIGATING LAYER 2 ATTACKS RETHINKING THE DIVISION OF

MITIGATING LAYER 2 ATTACKS: RE-THINKING THE DIVISION OF LABOR M. Sc Final Project Nir Solomon Supervised by: Prof. Anat Bremler-Barr December 2015 | IDC Herzliya

General Idea in One Slide While Open. Flow’s whole-view enables to gather network statistics to prevent attacks, it is also susceptible to some Specifically: ARP Poisoning and Controller DDo. S We will show these attacks are executed Also –the Controller cannot support the load of handling all the forwarding decisions by itself Our solution – called Reactive ARP Query, helps mitigate these attacks By shifting Control-plane responsibilities back to the switch! Controller SDN Switch

Outline Open. Flow – Intro Legacy Network Layer 2 Attacks Our Contribution Related and Previous Work SDN Layer 2 Attacks Proposed Solution Evaluation Conclusions

OPENFLOW – INTRO Open. Flow - Introduction LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Provides a scalable way to manage SDN networks PROPOSED SOLUTION Control-Plane and Data-Plane EVALUATION A centralized Controller CONCLUSIONS “Whole” view of the network The ability to gather information and statistics from every network component

OPENFLOW – INTRO Open. Flow – Flow Tables LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Every flow that has been installed by the Controller, is added to a “flow table” residing on the Switch Rule SRC MAC DST MAC Action Rule 1 AA: BB: CC: DD: EE 00: 20: B 9: CC: 2 D: A 8 Output to port 1 Rule 2 00: 11: 22: 33: 44: BE: EF 00: 6 F: 25: 1 B: 99: 0 C Output to Port 2 Rule 3 * (Don’t Care) Send to Controller PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Open. Flow – Learning Switch LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS An application running on the Controller Reactively installs flows on the switch for every packet that don’t have a matching flow and arrives an the Controller This event is called a packet-in The next time that a packet is received by the switch, it will be handled and forwarded automatically PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Open. Flow – Reactive & Proactive LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK Reactive Proactive SDN LAYER 2 ATTACKS flow triggers controller to insert flow entries Efficient use of flow table Every flow incurs small additional flow setup time If control connection lost, switch has limited utility table in switch Must know the network topology ahead of time Zero additional flow setup time Essentially requires aggregated (wildcard) rules Hard to install new flows after the network starts operating – problematic in BYOD networks EVALUATION Packet not matching any Controller pre-populates flow PROPOSED SOLUTION CONCLUSIONS

OPENFLOW – INTRO The ARP Protocol LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS ARP Request: PROPOSED SOLUTION – EVALUATION Argon broadcasts an ARP request to all stations on the network: “What is the hardware address of 128. 143. 137. 1? ” CONCLUSIONS

OPENFLOW – INTRO The ARP Protocol LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS ARP Reply: PROPOSED SOLUTION – EVALUATION Router 137 responds with an ARP Reply which contains the hardware address CONCLUSIONS

OPENFLOW – INTRO The ARP Protocol - Cache Hosts maintain a table (ARP Cache) of current entries for each NIC installed The entries expire after some time (implementation dependant – e. g. Windows XP - 2 mins, Red. Hat - 60 secs). For example, an ARP cache in Windows (“arp -a” ): LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO The ARP Protocol – Gratuitous ARP LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Gratuitous ARP - an ARP request/reply that is not normally needed according to the RFC but could be used in some cases Request: the packet has the source and destination IP both set to the IP of the machine issuing the packet and the destination MAC is the broadcast address Reply: is a reply to which no request has been made Useful for: Detecting IP conflicts Push update to other machines’ ARP tables (e. g. when host changes its IP address) Inform switches of the hosts’ address on a given switch port PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Layer 2 Attacks – ARP Poisoning A forged ARP Request or Reply can be used to update the ARP cache of a remote system with a forged entry LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS PROPOSED SOLUTION To: 00: 00: 00: 03 192. 168. 1. 2 EVALUATION CONCLUSIONS Alice MAC: 00: 00: 00: 01 IP: 192. 168. 1. 1 Bob MAC: 00: 00: 00: 02 IP: 192. 168. 1. 2 Switch 192. 168. 1. 2 is at 00: 00: 00: 03 192. 168. 1. 1 is at 00: 00: 00: 03 Eve MAC: 00: 00: 00: 03 IP: 192. 168. 1. 3

OPENFLOW – INTRO Layer 2 Attacks - DDo. S The attempt to make a machine or service unavailable to its legitimate users, by consuming its resources by a large group of attackers A DDo. S scenario may quickly worsen, such as when sending a packet to the victim will cause him to send a reflected packet to another host In many cases, the best solution to contain the damage is to use Rate Limiting We will show that it is possible to create a Layer 2 DDo. S on the Open. Flow Controller, while using only ARP packets LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Our Contribution LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS In summary, our work makes the following contributions: Overview of an ARP Poisoning attack and its execution in an Open. Flow network Presentation of a new attack vector on Open. Flow - ARP level Distributed Denial of Service (DDo. S) attack on the Open. Flow Controller Extension of the current implementation of Open. Flow to include new mechanisms to mitigate Layer 2 attacks, and an evaluation PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Related & Previous Work LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Legacy ARP Poisoning Mitigation: Open. Flow Vulnerability Assessments – including DDo. S: [Shin and Gu, 2013] Shifting responsibilities from the Controller to the Switch: [Yan et al, 2015], [Kloti et al, 2013], [Benton et al, 2013] Using specially-crafted packets to attack Open. Flow networks: [Nam et al, 2010] [Shin et al, 2013], [Curtis et al, 2011] Using the Whole-View of SDN to mitigate network attacks: [Braga et al, 2013], [Phaal et al, 2013], [Porras et al, 2012] PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO LEGACY LAYER 2 SDN Attacks - ARP Poisoning ATTACKS OUR CONTRIBUTION Table 0 SRC MAC IN PORT Action RELATED WORK SDN LAYER 2 ATTACKS To: 00: 00: 00: 03 192. 168. 1. 2 00: 00: 00: 01 1 GOTO Table 1 00: 00: 00: 02 2 GOTO Table 1 EVALUATION 00: 00: 00: 03 3 GOTO Table 1 CONCLUSIONS Table 1 Alice MAC: 00: 00: 00: 01 IP: 192. 168. 1. 1 Bob MAC: 00: 00: 00: 02 IP: 192. 168. 1. 2 SDN Switch 192. 168. 1. 2 is at 00: 00: 00: 03 192. 168. 1. 1 is at 00: 00: 00: 03 Eve MAC: 00: 00: 00: 03 IP: 192. 168. 1. 3 DST MAC Action 00: 00: 00: 01 OUTPUT to 1 00: 00: 00: 02 OUTPUT to 2 00: 00: 00: 03 OUTPUT to 3 PROPOSED SOLUTION

OPENFLOW – INTRO SDN Attacks – Controller DDo. S We would like to overload the Controller with multiple packet-in events An attacker can spoof a packet as he likes Let us create a specially crafted packet that will cause a packet-in LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS PROPOSED SOLUTION EVALUATION CONCLUSIONS This attack is unique to Open. Flow and inherent in its design

OPENFLOW – INTRO SDN Attacks – Controller DDo. S LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK No Flow available Send to Controller Packet-in Crafted Packet SDN LAYER 2 ATTACKS PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO SDN Attacks – Controller DDo. S LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION Controller: running on a Mac. Book Pro with 16 GB of RAM and Core i 7 CPU RELATED WORK Attacker: simulated with Cbench on an Ubuntu machine with Core i 5 CPU and 4 GB of RAM SDN LAYER 2 ATTACKS Reaching a certain threshold of about 1. 3 Mpps (million packet-ins per second), the number of responses does not increase correspondingly EVALUATION PROPOSED SOLUTION CONCLUSIONS

OPENFLOW – INTRO Solution - Desired Properties A “normal” Reactive learning switch enables both ARP Poisoning and a DDo. S attack We would like to define a solution with the following properties: Little load on the Controller Lesser A Reactive solution We can use multiple or distributed Controllers to mitigate DDo. S This number of flows installs on the Switch is an orthogonal solution We will compare our proposed solution to the Reactive approach, and the tradeoffs of using it LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Solution - Shifting Control-Plane Responsibilities LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Usually, separation between the control plane and the data plane Creates a load on the Controller Shifting responsibilities from Controller Switch Allowing the switch to hold the IP to-MAC mappings of the hosts connected to it Similar to all the mappings usually held by the Controller Shifting control plane responsibilities has been suggested: Avant. Guard Devo. Flow [Shin et al, 2013] [Curtis et al, 2011] PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Solution – General Idea LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS In both Layer 2 attacks, spoofed ARP packets are used PROPOSED SOLUTION We aim to retain: EVALUATION IP-to-MAC mappings and MAC-to-Physical port mappings Of each host connected to the switch Saved in the switch, in the form of Open. Flow flows When a new host connects to the network, we want to “authenticate” it No matching flow for a packet sent from the new host We will send a “Reactive ARP Packet” If and only if the host is validated, we will send a packet-in to the Controller Else: drop the packet CONCLUSIONS

OPENFLOW – INTRO Solution – Attacker Types LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS When discussing the use of spoofed ARP packets, there are two kinds of attackers: Naive Attacker: will not reply to an ARP request for the (MAC, IP) he spoofs Sophisticated Attacker: will reply to an ARP request for the (MAC, IP) he spoofs PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Solution – Possible Scenarios LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS When sending the Reactive ARP Query, there are three possible scenarios: Two ARP replies (one with expected MAC, one with other MAC) Invalid ARP reply (a packet is returned with a different MAC address than expected/No reply) Valid ARP reply (matching IP and MAC) PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO LEGACY LAYER 2 Solution – Scenario 1 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Scenario 1: Two ARP replies (one with expected MAC, one with other MAC) PROPOSED SOLUTION EVALUATION This is a sophisticated attacker! 192. 168. 1. 1 is at WHO HAS 192. 168. 1. 154? 00: 00: 00: 99 Spoofed SRC MAC: 00: 00: 00: 99 Spoofed SRC IP: 192. 168. 1. 1 CONCLUSIONS DROP! (no packet-in) WHO HAS 192. 168. 1. 1? Controller Eve MAC: 00: 00: 00: 03 IP: 192. 168. 1. 3 SDN Switch 192. 168. 1. 1 is at 00: 00: 00: 01 Alice MAC: 00: 00: 00: 01 IP: 192. 168. 1. 1 SRC MAC SRC IP SRC PORT Action 00: 00: 00: 01 192. 168. 1. 1 1 GOTO Table 1

OPENFLOW – INTRO LEGACY LAYER 2 Solution – Scenario 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Scenario 2: Invalid ARP reply (a packet is returned with a different MAC address than expected/No reply) PROPOSED SOLUTION EVALUATION CONCLUSIONS DROP! WHO HAS 192. 168. 1. 154? Spoofed SRC MAC: 00: 00: 00: 99 WHO HAS 192. 168. 1. 1? Spoofed SRC IP: 192. 168. 1. 1 (no packet-in) Controller Eve MAC: 00: 00: 00: 03 IP: 192. 168. 1. 3 SDN Switch 192. 168. 1. 1 is at 00: 00: 00: 01 Alice MAC: 00: 00: 00: 01 IP: 192. 168. 1. 1 SRC MAC SRC IP SRC PORT Action 00: 00: 00: 01 192. 168. 1. 1 1 GOTO Table 1

OPENFLOW – INTRO LEGACY LAYER 2 Solution – Scenario 3 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Scenario 3: Valid ARP reply PROPOSED SOLUTION EVALUATION Packet-out+ Install Flow CONCLUSIONS 192. 168. 1. 99 is at WHO HAS 192. 168. 1. 2? 00: 00: 00: 99 Spoofed SRC MAC: 00: 00: 00: 99 WHO HAS 192. 168. 1. 99? Packet-in Spoofed SRC IP: 192. 168. 1. 99 Eve MAC: 00: 00: 00: 03 IP: 192. 168. 1. 3 Alice MAC: 00: 00: 00: 01 IP: 192. 168. 1. 1 Controller Host (or attacker) is validated SDN Switch SRC MAC SRC IP SRC PORT Action 00: 00: 00: 01 192. 168. 1. 1 1 GOTO Table 1 00: 00: 00: 99 192. 168. 1. 99 3 GOTO Table 1

OPENFLOW – INTRO Solution – What About the Last Scenario? LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS A sophisticated attacker may still be validated – he can still create packet-ins! PROPOSED SOLUTION We can use a Rate Limiting mechanism EVALUATION Rate limit only the table misses Only the physical port of the sender Also used against DNS DDo. S Amplification attacks CONCLUSIONS

OPENFLOW – INTRO Solution – Rate Limiting LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS “With regard to denial-of-service vulnerabilities, controller vendors need to emphasize the importance of rate-limiting. ” PROPOSED SOLUTION “Even for an application as simple as this one (Learning Switch) protecting it requires implementing MAC spoofing protection through port counters (with timers if network flexibility is required), rate limiters for traffic to unknown hosts, and switch rules for multicast. ” CONCLUSIONS “Networks that rely heavily on Packet. In messages (i. e. reactive designs) can be exposed to denial-of-service attacks against the switches and controller(s) without complex rate-limiting logic in the controller. ” Open. Flow Vulnerability Assessment, [Benton et al, SIGCOMM 2013] EVALUATION

OPENFLOW – INTRO Solution – Rate Limiting (Continued) LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Work is being done to gather network statistics in Open. Flow PROPOSED SOLUTION Flow Collector - Percentage of Pair-flows (PPf) – [Braga et al, 2013] EVALUATION “Pair-Flow”: CONCLUSIONS The source IP of flow 1 must be equal to the destination IP of flow 2 The destination IP of flow 1 must be equal to the source IP of flow 2 Both flows must have the same communication protocol DDo. S increases the number of “single-flows” A switch that has a host suspected as a sophisticated attacker, may use these statistics to decide if the physical port has a large number of single-flows, and limit it accordingly Out of the scope of this work

OPENFLOW – INTRO Solution – Assumptions LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS We assume a steady state when the network starts operating If an attacker binds the victim’s IP address to its MAC address before the victim connects, the victim’s packets will be dropped Can be prevented: By using our solution as soon as the network starts operating Or by installing proactive rules for all known safe hosts ahead PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Solution – The Division of Labor LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS There is a fine line between the Control Plane and the Data Plane PROPOSED SOLUTION Only some suggested that this line should be crossed EVALUATION ״ When thinking of the default component used to mitigate network attacks in an SDN network, we think of the Controller ״ - [Braga et al, 2013] We conclude that the Controller, by itself, cannot hold these responsibilities, as the load may cause it to stop function correctly Instead, our approach takes the a different direction; we shift these responsibilities from the “default” component, the Controller (control plane) into the switch (data plane) CONCLUSIONS

OPENFLOW – INTRO LEGACY LAYER 2 Evaluation – ARP Poisoning ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS PROPOSED SOLUTION 192. 168. 1. 2 is at 00: 00: 00: 02 EVALUATION WHO HAS 192. 168. 1. 2? CONCLUSIONS DROP! Alice MAC: 00: 00: 00: 01 IP: 192. 168. 1. 1 Bob MAC: 00: 00: 00: 02 IP: 192. 168. 1. 2 SDN Switch 192. 168. 1. 2 is at 00: 00: 00: 03 Eve MAC: 00: 00: 00: 03 IP: 192. 168. 1. 3 (also: no packet-in) Table 0 – Steady State SRC MAC SRC IP IN Action PORT 00: 00: 00: 01 192. 168. 1. 1 1 GOTO Table 1 00: 00: 00: 02 192. 168. 1. 2 2 GOTO Table 1

OPENFLOW – INTRO Evaluation – DDo. S Naive Attacker - Packet-ins LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Using a normal Open. Flow Switch, each spoofed packet requires a packet-in to be received by the Controller PROPOSED SOLUTION Using the Reactive ARP Query Switch, no packet-ins are received at the Controller at all CONCLUSIONS EVALUATION

OPENFLOW – INTRO Evaluation – DDo. S Naive Attacker - Flows Installed LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Using a normal Open. Flow Switch, two flows will be installed for each packet-in - one matches on the source, and one on the destination In our solution, we drop the attacking packet, without installing any flows, and without informing the Controller PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Evaluation – DDo. S Sophisticated Attacker - Packet-ins LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Using a normal Open. Flow Switch, each spoofed packet requires a packet -in to be generated by the switch and received by the Controller PROPOSED SOLUTION Using the Reactive ARP Query Switch, the rate of the packet-ins are limited (in our case, to 100 packets per second, chosen arbitrarily) CONCLUSIONS If the Rate-Limiting rate is N pps, then we can assure that the maximum packet-in rate at the Controller will be N pps as well EVALUATION

OPENFLOW – INTRO Evaluation – DDo. S Sophisticated Attacker - Flows Installed LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS Using a normal Open. Flow Switch, two flows will be installed for each packet-in - one matches on the source, and one on the destination PROPOSED SOLUTION In our solution, we rate-limit the incoming packet-ins, so the rate of the creation of new flows depends on the rate limitation CONCLUSIONS EVALUATION

OPENFLOW – INTRO Evaluation – Network Overload LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS The three possible scenarios are: Two ARP replies (one with expected MAC, one with other MAC). Invalid ARP reply (a packet is returned with a different MAC address than expected/No reply). Valid ARP reply (matching IP and MAC). The is Attacker. naive and a single used for Mightattacker be the attacker’s packet or a Reactive valid host. ARP the packet connected tobe the network. Sophisticated The first packet sent by himiswill intercepted by packet to Let us assume thedropped. worst case scenario - that this is an attacker. will send an ARP the switch. A be single Reactive ARP packet willhost be issued for the. We attacker’s validation, he will be validated. No more packets from him with his SRC MAC will be packet to and be dropped. validated as a flow is being installed by the Controller. Thus the network overhead here is only a single packet PROPOSED SOLUTION EVALUATION CONCLUSIONS

OPENFLOW – INTRO Conclusions LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK We presented the execution of Layer 2 attacks in Open. Flow network: SDN LAYER 2 ATTACKS ARP Poisoning; and a Layer 2 DDo. S on the Controller, which is an inherent vulnerability in Open. Flow networks. EVALUATION We have proposed an extension to Open. Flow – Reactive ARP Query. While our solution has only a minor network overhead, both attacks can be mitigated successfully. This is a major step in changing our approach by shifting the control plane responsibilities back to the switch. PROPOSED SOLUTION CONCLUSIONS

OPENFLOW – INTRO Future Work LEGACY LAYER 2 ATTACKS OUR CONTRIBUTION RELATED WORK SDN LAYER 2 ATTACKS We hope to allow the creation of a “smart” Rate-Limiting algorithm, by gathering flow metrics from the whole network Rate-Limit the physical port according to the flow metrics gathered We hope to also implement the Reactive ARP Query extension on a physical switch. This implementation will allow the evaluation of its performance while running as a totally independent data plane component PROPOSED SOLUTION EVALUATION CONCLUSIONS

Questions? Thanks!