Dude, where’s that IP?: circumventing measurement-based IP geolocation

  • Authors:

  • Phillipa Gill;Yashar Ganjali;Bernard Wong;David Lie

  • Affiliations:

  • Dept. of Computer Science, University of Toronto;Dept. of Computer Science, University of Toronto;Dept. of Computer Science, Cornell University;Dept. of Electrical and Computer Engineering, University of Toronto

  • Venue:
  • USENIX Security'10 Proceedings of the 19th USENIX conference on Security
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

Many applications of IP geolocation can benefit from geolocation that is robust to adversarial clients. These include applications that limit access to online content to a specific geographic region and cloud computing, where some organizations must ensure their virtual machines stay in an appropriate geographic region. This paper studies the applicability of current IP geolocation techniques against an adversary who tries to subvert the techniques into returning a forged result. We propose and evaluate attacks on both delay-based IP geolocation techniques and more advanced topology-aware techniques. Against delay-based techniques, we find that the adversary has a clear trade-off between the accuracy and the detectability of an attack. In contrast, we observe that more sophisticated topology-aware techniques actually fare worse against an adversary because they give the adversary more inputs to manipulate through their use of topology and delay information.