Hands-on-4: BGP Exploration and Attack

Read the following hands-on. Do as instructed, and submit your solutions in English or Chinese for the following quizes. Upload your answers to Canvas in a .pdf file.

Due is 2022/12/28 23:59

This hands-on would help you learn more about the BGP (Border Gateway Protocol) and BGP attacks.

BGP Exploration

Q1: What is BGP? Why do we need BGP in the network? Please describe it using your own words

We use an emulator in this handson. You can download the emulator from the course homepage. We recommend doing this handson on Ubuntu 20.04 or 18.04 virtual machine.

Some basic software packages are required. e.g., docker, docker-compose, python3, etc.

Start the emulation:

In this emulator, each computer (hosts or routers) is a docker container. Go to the Labsetup/output folder, run the following commands to initialize the containers:

docker-compose build
docker-compose up

Then you can see each computer that form a mini Internet from this URL: http://localhost:8080/map.html:

(NOTE: The map figure may be different on your computer)

You can also access each "computer" using docker commands, such as getting a shell inside a container.

You can filter the protocols in the "Filter box" at the top left of the map. After filtering, you can see the blinks in the map that denote the network transmissions.

Click the circles in the map, which denote routers, and you can see the details of the router, take router 162 as an example:

You can click Launch console to access the router. Use ip addr command, and you can see information like the following:

xxxxxxxxxx
root@01ea20a8b04a / # ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: dummy0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
    link/ether 4e:0d:ce:a1:2c:5a brd ff:ff:ff:ff:ff:ff
    inet 10.0.0.28/32 scope global dummy0
       valid_lft forever preferred_lft forever
972: ix103@if973: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc tbf state UP group default qlen 1000
    link/ether 02:42:0a:80:21:06 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.103.0.162/24 scope global ix103
       valid_lft forever preferred_lft forever
978: net0@if979: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc tbf state UP group default qlen 1000
    link/ether 02:42:0a:80:16:04 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 10.162.0.254/24 scope global net0
       valid_lft forever preferred_lft forever

You can use tcpdump to capture and display packets. Run the following commands at router 162:

xxxxxxxxxx
tcpdump -nti any -vvv "tcp port 179"

Keep the command executing. Now, we can find that another router, router 164, is connected with AS 12 (you can search the router by the "Search" box).

Disconnect router 164 with AS 12 by click to the Disable in "BGP sessions" in the detail menu:

You can find that router 162 receives new packets after the disconnection between 164 and 12 through the "tcpdump" command.

Q2: Paste the information of the new packet. Explain why router 162 receives the packet after the disconnection, and how the packet is sent to the router 162.

Q3: Explain what the "AS Path" in the packet information means, and mark the path in the map.

Now re-enable the connection of AS 164 with AS 12. Again, router 162 receives new packets after the reconnection.

Q4: Paste the information of the new packet. Explain why router 162 receives the packet after the reconnection, and how the packet is sent to the router 162.

Let's try to disconnect other routers. Click router 151, disconnect it with AS 150.

Q5: Do you receive new packets this time by disconnecting AS 150 from AS 151? Explain the phenomenon.

BGP Attacks

In this section, we will try to operate a BGP attack in the emulated network.

The target we want to hijack is 10.154.0.0/24, which belongs to AS 154 in the emulator.

Firstly, randomly choose a Host in the network. For example, we use AS 160 's host_1 (whose IP is "10.160.0.72/24"), and ping AS 154's webservice_1 (10.154.0.72) from AS 160 host_1. You can see the following outputs:

xxxxxxxxxx
# In AS160 host_1
root@523d27b8371e / # ping 10.154.0.72
PING 10.154.0.72 (10.154.0.72) 56(84) bytes of data.
64 bytes from 10.154.0.72: icmp_seq=1 ttl=57 time=0.966 ms
64 bytes from 10.154.0.72: icmp_seq=2 ttl=57 time=0.835 ms
...

Write icmp && dst 10.154.0.72 in the Filter box on the top left. You can see the traffic between AS 160 and AS 154:

Now, we want to hijack AS 154. We choose the router from AS 153 to see its BGP configuration by the following commands:

x
# In AS153 router
root@23188f7e5c87 / # cd /etc/bird 
root@23188f7e5c87 /etc/bird # ls          
bird.conf  envvars
root@23188f7e5c87 /etc/bird # vim bird.conf 

Bird is the routing software used in the Emulator.

We add a new protocol at the end of the bird.conf: (blackhole means that the packets will be dropped)

​x
# Add the following lines to the end of bird.conf

protocol static hijacks{
    ipv4 {
        table t_bgp;
    };
    route 10.154.0.0/25 blackhole {bgp_large_community.add(LOCAL_COMM); };
    route 10.154.0.128/25 blackhole {bgp_large_community.add(LOCAL_COMM); };
}

After we reload the configuration by:

xxxxxxxxxx
root@23188f7e5c87 /etc/bird # birdc configure
BIRD 2.0.7 ready.
Reading configuration from /etc/bird/bird.conf
Reconfigured

We can see the traffic from host 160 to host 154 is completely hijacked, and the ping of 160 can get nothing:

Q6: Why the traffic from 160 to 154 is now to 153? Explain how the attack works.

Q7: Explain why we use "10.154.0.0/25" and "10.154.128.0/25" in the configure. How about 10.154.0.0/24? How about 10.154.0.0/23?

After we simply disconnect AS 153, we can see that AS 160 can connect to AS 154 again, and ping continues output results.

Q8: Explain why AS 160 can find AS 154 now in 1 sentence.

(Hint: reference the explanation in Q2)

Q9: Explain that if AS 153 is still connected, how to help AS 160 fight back.

(Hint: match longer ip prefix)

REFERENCE:

https://seedsecuritylabs.org/Labs_20.04/Networking/BGP/BGP_Exploration_Attack/