and 26th november 2016

Transcription

1

2 DDoS WHERE'S THE THREAT? and WHAT CAN YOU DO? 26th november 2016 Pieter Hanssens pieter.hanssens(at)belnet.be Thomas Eugène thomas.eugene(at)cert.be

3 Presentation based on Whitepaper DDoS: Proactive and reactive measures Available on

4 What's a Denial-of-Service? A denial-of-service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users.

5 and a DDoS? That's a Distributed DoS

6 Why a DDoS? Blackmail Online protest Anti-competition business Smoke Screen (data breaches) Just a game (script kiddies) Unintentional

7 There are 3 types of DoS Volume based Protocol based Application based

8 Volume based Network bandwidth is exhausted. Example: Amplification Attack

9 Protocol based Server resources are exhausted Example: SYN flood,...

10 Application based Server resources are exhausted. The service is directly attacked. Example: vulnerability exploit, mail bomb,...

11 Trendy attack: Amplification attack Volume based Attack Use misconfigured servers Awarness can help to reduce the risk

12 Amplification Attack What is needed? IP spoofing possibility (UDP) Query size < Response size

13 Amplification Attack protocols Source: TA14-017A - US-CERT

14 openntp Servers in Belgium

15 opendns Resolvers in Belgium

16 opensnmp Systems in Belgium

17 Exploitable servers in Belgium

18 Prevention & Basic Security Prepare a reaction plan Check bottlenecks in your infrastructure Monitor your network and systems Secure your network (Firewall, IDS,...) Keep your systems up-to-date

19 Mitigation You need to identify the attack!

20 Mitigation Mitigation techniques will change with the type of attack

21 Mitigation on network based attack This type of attack is using all your Internet bandwidth. Ask filtering to your ISP Switch on your backup line Use Cloud-based DDoS protection services

22 Mitigation on protocol based attack This type of attack tries to exhaust your device resources Use QoS Increase your queues limit Decrease your connection timeout Blacklist or/and whitelist Use Cloud-based DDoS protection services

23 Mitigation on application based attack This will involve the way you application is developed. Blacklist and/or whitelist Install Load-Balancer Use third-party hosting or cdn Redesign your webservices to be lighter Use Cloud-based DDoS protection services

24 In Real Life Mixed-attack Evolution during the attack Hackers are creative Keep in mind that it can be a SmokeScreen

25 What about Belnet?

26 ISP vs DDoS Unique position of an ISP Volumetric defence makes sense Blocking and ratelimiting gets you a long way Huge jump in cost for 100% mitigation

27 Belnet vs DDoS BCP38 implemented since forever Netflow analysis since 2009 RTBH with all upstream providers RTBH on BNIX route-server Great amount of expertise available through CERT.be

28 Belnet vs DDoS Founding Member of SIG-NOC Participating in SIG-ISM (e.g. DDoS WS Vienna) 24/7 procedure in place (without SLA s!) Willingness to participate on a larger level

29 What can Belnet do for it s customers? Aiding in analysis of the attack (Best Effort) Involve CERT.be Offer a 24/7 service without SLA s Install filters and ratelimiters on customer s demand Follow-up on on-going attacks (counters) Trigger upstream providers in case of a large volumetric attack

30 Belnet customer: How to report? 24/7 Belnet Servicedesk: 02/ /7 FEDMAN Servicedesk: 02/ /7 BNIX Servicedesk: 02/ Log your actions Find the lowest common denominator Agree with Belnet engineer on countermeasures Have some people on stand-by for 24/7 follow-up on customer s side. Please report again when attack has stopped

31 Non-Belnet customer: How to report? Customer internal escalation Log your actions Report to CERT.be cert@cert.be Describe observed fingerprint of attack

32 Belnet: experiences Large volumetric attacks Rapidly evolving attacks Smaller but highly mediatized attacks Attacks are incoming, never outgoing at the moment R&E community is less targeted than administration R&E traffic not easily predicted nor baselined All attacks have been mitigated without the use of scrubbing services

33 Belnet: Future Volumes of attacks keep rising and our upstream is not unlimited Possibility of working together with: - (a subset of) transit providers - CDN s - cloud scrubbers Possibility of doing a joint procurement in the NREN community

34 Belnet: Future Some other mechanisms - Firewall on Demand - Local Scrubbing Center // On Premises Scrubbing Center - BGP FlowSpec

35 Cloud-based DDoS protection Huge bandwidth Traffic is spread all around the world Filter your traffic All your traffic is redirected to this provider! Never use it for sensitive data's

36 What are the roles of CERT.be Prevention We can support you to improve your resistance against DDoS Action Help you to coordinate and manage the event Reporting always help us to get an overview

37 How to contact CERT.be You can always send us to: Website: Our phone number is: 02/ In case of incidents: 02/

38 &

39