Ítalo Cunha

Compreender como vulnerabilidades evoluem em dispositivos conectados à Internet é importante para que operadores de rede possam priorizar esforços em segurança. Neste artigo, realizamos uma caracterização temporal de vulnerabilidades em dispositivos expostos na internet brasileira usando dados do Shodan. O principal desafio é identificar de forma confiável o mesmo dispositivo físico ao longo de múltiplas observações, já que endereços IP podem mudar com o tempo. Para isso, combinamos a identificação de IPs estáticos, usados como base verdade, com um identificador de dispositivo derivado de atributos SSL/TLS (impressão digital SHA-256 e campo common name de certificados X.509), validado com especificidade de 0,99 e AUC de 0,72. Aplicando a abordagem a dispositivos expostos entre 2024 e meados de 2025, observamos que as vulnerabilidades críticas são as mais persistentes, ativas por mais de oito meses em média, e que setores fora do polo de tecnologia, como Educação e Administração Pública, concentram as maiores proporções de risco crítico.

The identification of services and devices is an important step in vulnerability analysis, responsible for listing all assets that should be scanned for vulnerabilities. In recent years, this task has become increasingly complex due to the proliferation of new types of services and Internet-connected devices, such as IoT devices. In this context, search engines like Censys and Shodan have become popular tools, often used in one or more stages of the process for scanning network-accessible vulnerabilities. However, while these tools are capable of probing numerous devices worldwide, the information they process is often incomplete, primarily due to the challenge of keeping pace with the rapid creation of new applications. This paper introduces our solution for efficient service enumeration based on fingerprint matching, which can complement existing information about scanned devices. Our solution is highly efficient as it leverages the responses from connections established by search engines during their probing as input data, eliminating the need for additional scans. Furthermore, our processing engine is optimized and capable of processing data in parallel. To validate our solution, we compared the information obtained by our framework with that provided by Shodan. Overall, we were able to identify a larger number of services and devices. For instance, our approach increased the identification of services such as operating systems by 1.6 times and hardware information by up to 14 times. Additionally, we present two use cases demonstrating how our framework can assist in vulnerability analysis by providing more accurate and detailed information.

Clouds provide latency-sensitive services to clients at geographically distributed sites. They need precise control of client-site mappings for performance and, if a site fails, fast failover to other sites without cascading failures due to failover-induced overload or risky routing reconfiguration. However, clouds today route clients to sites by anycast or unicast with DNS-based redirection--methods that compromise either control or availability. In fact, even beyond these existing techniques, we find that all general-purpose approaches for directing clients to sites face inevitable tradeoffs among control, availability, and routing stability. We then present new general-purpose routing techniques and demonstrate via Internet-scale experiments that they provide much better tradeoffs among these three goals than existing techniques. One of our techniques achieves anycast's advantages with much better control, and another speeds up unicast's failover while preserving its advantages. Our techniques establish a new Pareto frontier for cloud routing.

The Border Gateway Protocol (BGP) enables communication between Autonomous Systems (ASes) on the Internet. BGP offers significant flexibility for traffic engineering through BGP communities, which are operator-defined tags that convey information or requests in route announcements. Unfortunately, the absence of standardized semantics or centralized repositories for BGP communities complicates and limits their use, hindering the effective management of interdomain routing. This thesis develops techniques to infer BGP community semantics using public BGP data from routing collectors, overcoming the lack of documentation and providing datasets that can be automatically updated. We first propose a set of techniques to infer location communities, which are communities related to entities or locations traversed by a route. We apply our techniques to billions of routing records from public BGP collectors and show that they produce high precision (ranging from 86% to 93%) and recall (ranging from 72% to 81%). We also design and evaluate algorithms to automatically uncover BGP action communities and ASes that violate standard practices, revealing undocumented relationships between them (e.g., sibling relationships). Our experimental evaluation uncovers previously unknown AS relationships and shows that our algorithm to identify action communities achieves average precision and recall of 92.5% and 86.5%, respectively.

The Border Gateway Protocol (BGP) offers several ''knobs'' to control routing decisions, but they are coarse-grained and only affect routes received from neighboring Autonomous Systems (AS). To enhance policy expressiveness, BGP was extended with the communities attribute, allowing an AS to attach metadata to routes and influence the routing decisions of a remote AS. The metadata can carry information to (e.g., where a route was received) or request an action from a remote AS (e.g., not to export a route to one of its neighbors). Unfortunately, the semantics of BGP communities are not standardized, lack universal rules, and are poorly documented. In this work, we design and evaluate algorithms to automatically uncover BGP action communities and ASes that violate standard practices by consistently using the information communities of other ASes, revealing undocumented relationships between them (e.g., siblings). Our experimental evaluation with billions of route announcements from public BGP route collectors from 2018 to 2023 uncovers previously unknown AS relationships and shows that our algorithm for identifying action communities achieves average precision and recall of 92.5% and 86.5%, respectively.

The Border Gateway Protocol (BGP) enables communication between Autonomous Systems (ASes) on the Internet. BGP offers significant flexibility for traffic engineering through BGP communities, which are operatordefined tags that convey information or requests in route announcements. Unfortunately, the absence of standardized semantics or centralized repositories for BGP communities complicates and limits their use, hindering the effective management of interdomain routing. This thesis develops techniques to infer BGP community semantics using public BGP data from routing collectors, overcoming the lack of documentation and providing datasets that can be automatically updated. We first propose a set of techniques to infer location communities, which are communities related to entities or locations traversed by a route. We apply our techniques to billions of routing records from public BGP collectors and show that they produce high precision (ranging from 86% to 93%) and recall (ranging from 72% to 81%). We also design and evaluate algorithms to automatically uncover BGP action communities and ASes that violate standard practices, revealing undocumented relationships between them (e.g., sibling relationships). Our experimental evaluation uncovers previously unknown AS relationships and shows that our algorithm to identify action communities achieves average precision and recall of 92.5% and 86.5%, respectively.

The Border Gateway Protocol (BGP) offers several "knobs" to control routing decisions, but they are coarse-grained and only affect routes received from neighboring Autonomous Systems (AS). To enhance policy expressiveness, BGP was extended with the communities attribute, allowing an AS to attach metadata to routes and influence the routing decisions of a remote AS. The metadata can carry information to ( e.g. , where a route was received) or request an action from a remote AS ( e.g. , not to export a route to one of its neighbors). Unfortunately, the semantics of BGP communities are not standardized, lack universal rules, and are poorly documented. In this work, we design and evaluate algorithms to automatically uncover BGP action communities and ASes that violate standard practices by consistently using the information communities of other ASes, revealing undocumented relationships between them (e.g., siblings). Our experimental evaluation with billions of route announcements from public BGP route collectors from 2018 to 2023 uncovers previously unknown AS relationships and shows that our algorithm for identifying action communities achieves average precision and recall of 92.5% and 86.5%, respectively.