Introduction to DDoS Attacks. Chris Beal Chief Security Architect on Twitter

Transcription

1 Introduction to DDoS Attacks Chris Beal Chief Security Architect on Twitter

2 DDoS in the News Q1 2014

3 DDoS Attack Trends

4 DDoS Attack Trends Q Mobile devices and apps used to attack targets Record volume of attacks for one quarter Average attack duration: hours Peak average bandwidth: 4.43 Gbps Peak packets per second: 10.6 Mpps Source: Prolexic Q Global DDoS Attack Report

5 DDoS A&ack Vector Analysis n Use of CHARGEN protocol increased 92.31% compared to Q n UDP and SYN floods were the most popular infrastructure-layer attack vectors n HTTP GET floods were most popular application-layer attack vector n Misuse of Network Time Protocol (NTP) is an emerging trend that should be monitored Source: Prolexic Q Global DDoS Attack Report

6 NTP Amplifica9on A&acks Comparing DDoS attacks in Feb 2014 to Jan 2014 n % increase in total NTP amplification attacks n % increase in average peak attack bandwidth n % increase in average peak PPS rate n Targeted industries included finance, gaming, e-commerce, Internet, media, education, SaaS, and security Source: Prolexic Threat Advisory GSI ID 1070 March 2014

7 DDoS Attack NCREN Network NTP DDoS Attack Seen on NCREN in February, 2014

8 DDoS Attacks Seen on NCREN Feb Gbps NTP UDP Fragmentation CHARGEN TCP SYN K-12 School Feb 3-Feb 5-Feb 7-Feb 9-Feb 11-Feb 13-Feb 15-Feb 17-Feb 19-Feb 21-Feb 23-Feb 25-Feb 27-Feb

9 DDoS As A Service

10 DDoS As A Service

11 DDoS Explained Distributed Denial of Service

12 DDoS Explained Source: Andy Hull, Associated Bank, N.A.

13 DDoS Explained Make information resources unavailable to intended users Web sites systems VoIP (Phones) Network Infrastructure Why? Boredom Revenge General Malice Politics Hide Identity Distraction

14 DDoS Explained Types of DDoS A&acks Volumetric Flood the victim with a high volume of packets or connections, overwhelming networking equipment, servers, or bandwidth resources Most typical type of DDoS attack Application Target the application layer and aim to exhaust processing resources Can be more efficient as they generally require fewer network connections to achieve their goal Low-Rate Designed to take down the victim system with minimum bandwidth and network connections Often target implementation weaknesses and design flaws Can be difficult to detect Source: Cisco Guide to Defending Against Distributed Denial of Service Attacks

15 DDoS Explained n Examples of DDoS Attacks: ICMP Flood (Smurf) TCP SYN Flood UDP Flood Fragmentation Amplification (DNS, NTP) n Common Attack Tools Online IP Stress Tests Slowloris Low Orbit Ion Cannon (LOIC) High Orbit Ion Cannon (HOIC) Source: Cisco Guide to Defending Against Distributed Denial of Service Attacks

16 DDoS Tools

17 NTP Amplifica9on A&ack Explained n Older versions of NTP server software support a query command called MONLIST. This query causes the server to return a list of up to the last 600 devices that the server interacted with. Request packet for MONLIST query is ~234 bytes long. A response from a busy NTP server returning a full list of 600 devices would be ~48 kbytes, split over ~100 packets. Amplification factor of 100x on packets and over 200x on size! n NTP is a UDP protocol, easy to spoof n Attacker sends request to vulnerable NTP server and spoofs the source IP in the packet to be the victim s IP address. n When the query response is returned by the server, it is destined for the victim.

18 NTP Amplification Attack Explained

19 DDoS Protection Solution Type Examples Strengths Challenges On-Premise Arbor, Radware, Corero, Checkpoint, F5 Tipping Point (HP), Sourcefire (Cisco), McAfee, Snort Best way to effectively deal with application attacks Visibility & Data Security Don t adequately address volumetric attacks Need specialized expertise Complexity Clean-Pipe ISP Best way to deal with volumetric attacks Efficiency Cannot effectively deal with application or lowrate attacks. Lack of granularity Cloud Scrubber Prolexic (Akamai), CloudFlare Efficiency (simple deployment, less resources required) Data Security Cost

20 DDoS Protec9on Network Level Attacks Amplification Attacks Outbound Attacks Application Attacks Specially Crafted Packet Attacks Recon Advanced Evasion Techniques On-Premise DDoS Defense Clean Pipe Service Cloud Scrubbing Service Traffic Filtering Rate- Limiting Stateful Flow Awareness Traffic Filtering Bi- Directional Traffic Analysis Deep Packet Inspection Behavior Analysis Deep Packet Inspection Protocol Analysis Scan Obfuscation Disinformation Advanced Evasion Detection Source: Stephen Gates, Corero Network Security

21 Responsibili9es n Constituents Secure your systems Secure your network infrastructure Communication Address Application DDoS n MCNC Clean Pipe (Address Volumetric DDoS) Communication Be a good citizen

22 Communica9on

23 What is MCNC Doing? n Current state Some tools in place to identify DDoS traffic (reactive) Communicate with constituents when issues arise Implement targeted filtering when issues identified Work with upstream providers to address issues as required n Future State Working to develop a proactive DDoS detection and mitigation capability - Proactive detection - Automated remediation Proactive communication Security hardening

24 What Can You Do? n Ensure that BC / DR and Incident Response plans address responding to a DDoS attack Engage MCNC early! Know how you want to communicate internally n Make sure servers are patched and hardened n Make sure network infrastructure is patched and hardened n Least Privilege Filtering Inbound and Outbound n Prevent spoofed traffic from leaving your network BCP 38 RFC 2827 urpf n Rate Limiting n Plan for how to address SYN Flood attacks n Plan for how to address Application DDoS

25 Ques9ons?