What you need to know about a DDoS attack

Transcription

1 E-book What you need to know about a DDoS attack Distributed Denial of Service (DDoS), four humble words that as an online business owner probably don t mean a lot (other than meaning something bad) and as a hosting service provider, are the stuff of nightmares. Call or visit

2 Introduction What is a DDoS attack? How does Netregistry mitigate? Why do people attack? Summary What you need to know about DDoS attacks 2

3 As a large hosting provider, Netregistry is a target for Distributed Denial of Service (DDoS) least once or twice a year, to the great detriment of our customer base - it s also a time when all staff end up working around the clock either trying to directly mitigate the issue, mass communicating with clients about the status of the issue or handling the massive influx of support inquiries that it generates. In this e- book we explain what a (DDoS) event is, the ins and outs and how it is addressed by Netregistry as a hosting provider. What you need to know about DDoS attacks 3

4 What is a DDoS attack? There are many types of actual DDoS attacks, however for the purpose of this article we ll break them into two broad categories. In the first scenario, the attack relies on sending a piece of information to a targeted server. They are trying to make the server respond to that piece of information, it might for example be a request for a web page using the HTTP protocol. The theory is simple make more and more requests, make the server do more and more work until it either degrades to an unworkable state or goes off- line completely. The first type of scenario today is somewhat rare. It used to be that a person launching an attack would often not have a great deal of bandwidth available to them, maybe just the combined power of a few servers. Because of this, they would tend to target single machines to overload them from the point of view of being able to process all the requests they were sending. Generally from a mitigation perspective this type of attack was far simpler to control, you had a small number of hosts initiating the attack and you could therefore identify them and you would tell your targeted server to simply ignore any requests coming in from the servers sending the malicious requests. This type of attack is much easier to combat. In the second scenario, the attack asks the server to do anything. It s all about clogging the network that connects the server to the Internet. So when a machine is targeted, packets of information are sent to it and the volume of that data will be massive and designed to simply flood the entire network of the target so that no valid traffic is able to come in. So for a hosting provider, this means that you as an end user trying to download or send , or visitors to your website simply can t get through - the online equivalent of a massive traffic jam. This results in a second attack type and the term Botnet. In the simplest terms a Botnet is a collection of computers that have all been compromised usually by a virus or trojan. They sit there idly doing nothing until the person controlling the Botnet issues commands then en masse they begin to do their damage like one big anti- social network. Their deeds may include sending spam, or in the context of this article trying to flood the network of a target. The charming individuals running botnets live in the murky depths of the Internet, and rent out the use of their network to people wanting to send you s about the wonders of v1@gr@, or indeed to launch random DDoS attacks. So how does Netregistry mitigate? Netregistry has a number of connections to the Internet, our pipes as our engineers like to call them, have an aggregate capability of around 1GB/second of data flow. In normal circumstances we run the individual connections at less than 60% capacity at all times so that when faced with genuine spikes in traffic from clients services we have enough available bandwidth to more than adequately handle it. What happens then when something that has 5000x the capacity of our network begins sending bad data to us to clog our network? The short answer is things go very very bad, very very quickly. Visitors to your website simply can t get through - the online equivalent of a massive traffic jam. To give you an idea of such an attack, as experienced by Netregistry over a 24+ hour period commencing on Wednesday April 11th, 2012 the traffic coming in was around 5-10 times the maximum capacity of our network. Not only that it was originating from tens of thousands of hosts so it becomes far more complex than simply saying to our servers hey ignore requests from these specific servers. Even if you can identify them all, the attackers will usually just keep shifting the sources of the attack. What you need to know about DDoS 4

5 Why do people do attack? It s a bit like asking why kids scribble graffiti on public buildings or take joyrides in stolen cars. Mostly it s the public nuisance factor, or infamy if they are able to take down a large site like the FBI as an example. Sometimes it s some perceived grievance over a website hosted by the provider, we don t like that site, we are going to take it down and the other 100,000 sites all hosted by that provider. There is no rhyme or reason, it s simply malicious destructive behaviour that unfortunately there is a very low prospect of being caught over. Sadly it s an area that law enforcement and the judicial process is a long way behind in. Lets say a small to medium sized host has 10,000 active sites under its management, that includes the web site and . If all those sites belong to small business with an average of 5 staff, it s reasonable to estimate a loss in profit and loss in productivity of $500 to $1,000 per hour. For example, say there a disruption runs 4 hours, that s: 4 x $500 x 10,000=$20,000,000. Now, if someone robbed a cool $20 million dollars from a bank, surely law enforcement would be launching a major investigation into it. For a less tangible loss, it s been very difficult to actually talk to someone in law enforcement whose eyes don t immediately glaze over. Three ways to address a DDoS attack? 1. Ensure you have enough bandwidth that no matter the size of the attack you still won t completely saturate it. Given you don t actually know the size of an attack that might happen, you can t plan using this strategy, it s also generally cost prohibitive. For example, for Netregistry to have 5GB/s of available data sitting there on tap 24/7 the price is into the hundreds of thousands of dollars per month for that capacity (millions per year).why should I buy your fantastic doohickey and not somebody else s? If I m looking at a particular product, am I likely to have a specific interest, goal or need and does the page explain how those can be met? What typical questions may I have on buying your product and are they suitably answered? 2. You can put devices into the front of your network that are able to determine junk (malicious) traffic from normal traffic, much like anti- spam software used to identify spam mail from real- mail. These devices are great up to a point, when the size of the attack is less than the size of your connections to the internet, as soon it reaches the point when your connections are filled to capacity it s one big traffic jam and as described earlier the real customer traffic coming in simply can t get through. Again you re talking about costs in the mid hundreds of thousands to implement. 3. You can try and work with the bigger networks upstream to see if they can ignore the bad traffic coming in. Sometimes that s feasible, sometimes it s not, depending on how complex the attack is and what kind of data they are sending in. Alternately, you can wash your traffic through a provider who ll take the dirty and give you clean data, but as a monthly subscription it can sometimes cost anywhere between 0 s to 100 s of thousands in ongoing monthly costs. Of course behind the scenes there is a million things that engineers try to identify and stop during an attack but the attackers aren t dumb so the attack changes over time. In tech talk this is called a non- trivial exercise. For the rest of us this is just a massive pain. There is no rhyme or reason, it s simply malicious destructive behaviour that unfortunately there is a very low prospect of being caught over. What you need to know about DDoS 5

6 Summary A DDoS can potentially be a very destructive attack on hosting providers with implications for all end users. Whilst there are ways in which you can help prevent the affects of an attack, it is much harder to identify when an attack will occur. Hopefully, one day DDoS attacks will be viewed as a far more serious crime, and those performing DDoS attacks will face consequences in their actions, but today they mostly don t and it progresses largely unchecked (hint - try Googling successful prosecutions anywhere in the world). So the responsibility of trying to mitigate this type of incident falls to us, your web hosting provider. We do our best, and we understand the implications of downtime to online business, in fact we are acutely aware as it affects us in the exactly same way. Netregistry has a technical team with many years of experience in dealing with these types of attacks. We have a number of procedure and protocols in place to ensure constant communication and a smooth recovery period during such times. Call or visit