{"id":15553,"date":"2018-10-12T05:52:09","date_gmt":"2018-10-12T05:52:09","guid":{"rendered":"http:\/\/10a2fd21-6a42-4083-9d00-bb641cce812f"},"modified":"2018-10-12T05:52:09","modified_gmt":"2018-10-12T05:52:09","slug":"uks-ncsc-to-monitor-internet-routing-to-stop-ddos-and-hijacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/uks-ncsc-to-monitor-internet-routing-to-stop-ddos-and-hijacks\/","title":{"rendered":"UK’s NCSC to monitor internet routing to stop DDoS and hijacks"},"content":{"rendered":"
<\/div>\n

The United Kingdom’s National Cyber Security Centre (NCSC) continues to push the boundaries of cyberdefence. It’s been implementing simple things at scale to great effect. And for an intelligence agency — it’s part of GCHQ — it’s continuing to be remarkably open.<\/p>\n

Two years ago, NCSC technical director Dr Ian Levy outlined his plans to secure the entire nation<\/a> through strong, national enforcement of network protocols. The plan was dubbed “Active Cyber Defence”, and in February 2018 the NCSC reported on its first year<\/a> of operation.<\/p>\n

Levy updated some of that information in his keynote address to the newly rebranded Australia Cyber Conference, the annual conference of the Australian Information Security Association (AISA), in Melbourne on Thursday. He also outlined his plans for the next stages of Active Cyber Defence.<\/p>\n

Since 2016, the NCSC has built a platform that provides a view of the entire state of internet routing in the UK. By monitoring all of the Border Gateway Protocol (BGP) messages that control routing, the NCSC should be able to spot routing hijacks and other threats before they can cause any damage.<\/p>\n

“We’ve done a test, we’ve been running this as an alpha for a while, and it seems to work,” Levy said.<\/p>\n

The NCSC is also collecting statistics on the usage of the domain name system (DNS) across the .gov.uk domain space. Levy had previously described his intention to build a single anycast DNS system for all of the UK public sector, “and I’m going to force everyone to use it”. As of August 31 this year, 216 UK government agencies have been fully converted to using that DNS.<\/p>\n

“During that month, we served about 6 billion requests off our DNS resolver. We blocked about a million things, for about 21,000 reasons,” Levy said.<\/p>\n

\n<\/section>\n

The DNS stats can also help defend against distributed-denial-of-service (DDoS) attacks.<\/p>\n

“You can spot botnets charging to do a DDoS anywhere between a minute and an hour before they start,” Levy said.<\/p>\n

That information is fed back into the NCSC’s threat intelligence messaging system, called the Threat-o-Matic. Then, using its knowledge of the state of BGP, it can predict where the attack traffic will come from, and notify internet service providers so they can take appropriate action.<\/p>\n

The result? No DDoS.<\/p>\n

“That’s got to be awesome if it works,” Levy said.<\/p>\n

“It might fall flat on it’s arse for some reason. Don’t know. But we’re going to try it, and we’re going to publish the results of it.”<\/p>\n

Last week, the NCSC reached a milestone that Levy described as “awesome”: An analyst on a top-secret system pushed a button to release three “indicators” (IP addresses or domain names), push them through a policy and compliance process, and automatically load them into the public sector DNS. It all happened in under two minutes.<\/p>\n

“That is a game changer. That’s how you start to use top-secret intelligence to protect a country,” he said.<\/p>\n

One of the NCSC’s big successes has been to cut off malicious email campaigns before they can have a major effect. Around 879 gov.uk domains are now protected by DMARC, which prevents people from spoofing those domains for email. Last year, that blocked 80 million spoofed emails.<\/p>\n

“That’s how you stop people clicking on the link, because they never get the crap in the first place. Simple things done at scale can have a difference,” Levy said.<\/p>\n

“We want people to implement DMARC, because if you make cybercrime harder, they’ll go somewhere else,” he said.<\/p>\n

“My job is not to beat cybercrime. It’s to send it to France.”<\/p>\n

Levy’s goal is “to protect the majority of the people in the UK from the majority of the harm caused by the majority of the attacks the majority of the time”.<\/p>\n

The NCSC’s tooling to test and report on email security for a large number of domains has been posted at GitHub<\/a> under the Apache License 2.0. It’s built on Amazon Web Services (AWS).<\/p>\n

Understanding how people use technology<\/strong><\/h3>\n

The NCSC has commissioned polling firm Ipsos MORI to conduct a “proper qualitative and quantitative” research project to try to understand how people use technology and how they feel about it.<\/p>\n

The NCSC will then “pick a thing”, “do some interventions” to change it, and then do the survey again to see if people’s views have changed, Levy said.<\/p>\n

“It’s called science,” he said.<\/p>\n

Tackling consumer IoT security<\/strong><\/h3>\n

The last two years have seen a number of proposals for some sort of security rating system for consumer Internet of Things (IoT) products. It would make security a commercial issue<\/a>. In Australia, a Cyber Kangaroo<\/a> has been proposed.<\/p>\n

Levy is proposing a system similar to food labelling, focusing on just three measures:<\/p>\n