Item

Abstract

The Internet is a critical resource in the day-to-day life of billions of
users. To support the growing number of users and their increasing demands,
operators have to continuously scale their network footprint -- e.g., by
joining Internet Exchange Points -- and adopt relevant technologies -- such as
IPv6. IPv6, however, has a vastly larger address space compared to its
predecessor, which allows for new kinds of attacks on the Internet routing
infrastructure.
In this paper, we present Kirin: a BGP attack that sources millions of IPv6
routes and distributes them via thousands of sessions across various IXPs to
overflow the memory of border routers within thousands of remote ASes. Kirin's
highly distributed nature allows it to bypass traditional route-flooding
defense mechanisms, such as per-session prefix limits or route flap damping. We
analyze the theoretical feasibility of the attack by formulating it as a
Integer Linear Programming problem, test for practical hurdles by deploying the
infrastructure required to perform a small-scale Kirin attack using 4 IXPs, and
validate our assumptions via BGP data analysis, real-world measurements, and
router testbed experiments. Despite its low deployment cost, we find Kirin
capable of injecting lethal amounts of IPv6 routes in the routers of thousands
of ASes.