Exploiting information centric networking to build an attacker-controlled content delivery network

The Information Centric Networking (ICN) model relies on the ubiquitous use of caching to improve performance and reduce bandwidth requirements. ICN also makes it possible for routers to fetch content from downstream nodes, such as when a content for a home user is fetched from a neighbor’s home router, with significant performance improvement. This paper shows how an attacker using compromised hosts can easily gather a massive amount of low-cost, low-latency storage for malware, junk, and other attacker-controlled content. We conclude by considering a possible countermeasure, a blacklist fed by a honeypot, which we show to be effective.