Lightweight measurement methods for internet infrastructure remote fingerprinting

Today, our digital economy relies on the smooth and uninterrupted operation of the Internet. Many failures and high-profile attacks are due to vulnerabilities and bugs in core network infrastructure, with routers increasingly becoming prime targets for malicious actors who want to gain an initial foothold in networks. Identifying the vendor of routers in the wild, i.e., fingerprinting the routers, is an essential step toward analyzing the potential security risks. It is also imperative to study routers’ deployment uniformity within a network or a region to assess the risk of correlated failures due to vulnerabilities in a single vendor. This thesis introduces lightweight methods for mapping Internet infrastructure, i.e., Internet Protocol addresses alias resolution and dual-stack association, as well as router vendor fingerprinting. We first present the results of a measurement study on the adoption of the latest version of the Simple Network Management Protocol (SNMPv3). We show that the adoption of SNMPv3 offers a unique -and unintended- opportunity for remotely fingerprinting Internet infrastructure in the wild. Specifically, by sending unsolicited and unauthenticated SNMPv3 requests, we obtain detailed information about the configuration and status of network devices, including vendor, uptime, and the number of reboots. More importantly, the reply contains a persistent and strong identifier that allows for lightweight Internet-scale alias resolution and dual-stack association. Next, we take a protocol-centric approach for alias resolution and dual-stack inference and consider two of the most commonly used protocols on the Internet, namely the Boarder Gateway Protocol (BGP) and Secure Shell (SSH). We show that by utilizing data obtained from the connection establishment phase for these protocols, we can build a globally unique host identifier that can be used to resolve dual-stack and alias addresses for IPv4 and IPv6 with high accuracy and coverage. Lastly, we present the design and evaluation of LFP, a new lightweight remote router fingerprinting technique that relies on data obtained from the IPv4 protocol header and enables large-scale analysis of router vendors on the Internet. We demonstrate how LFP can be used to further explore the physical properties of the Internet, such as the composition of router vendors within network providers, regions, and along network paths.