ddos – yesterday, today and tomorrowhitcon.org/2012/download/0721d5_frank&william_ddos... ·...
TRANSCRIPT
![Page 1: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/1.jpg)
DDoS – Yesterday, Today and tomorrow Frank Tse, William Guo
Nexusguard
![Page 2: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/2.jpg)
Page § 2
Agenda
DDoS Introduction
DDoS Attack Analysis
DDoS Detection and Mitigation
Fighting DDoS in Mobile Era
1 2 3 4
FAQ 5
![Page 3: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/3.jpg)
Page § 3
About us
Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud Internet Security Solutions. Nexusguard delivers solutions over the internet to ensure that our clients enjoy uninterrupted web-service delivery to their users, by protecting them against the ever-increasing and evolving multitude of internet threats, particularly Denial-of-Service (DDoS) attacks, and other attacks directed at web application software.
![Page 4: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/4.jpg)
Page § 4
What is DDoS
§ A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system.
§ The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users.
![Page 5: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/5.jpg)
What is DDoS
Page § 5 5
Zombies on innocent computers
Server-level DDoS attacks (Protocol / Application)
Infrastructure-level DDoS attacks
Bandwidth-level DDoS attacks
![Page 6: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/6.jpg)
Page § 6
What is DDoS
Credit http://www.wired.com/politics/security/magazine/15-09/ff_estonia_bots
![Page 7: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/7.jpg)
Page § 7
DDoS in the news
![Page 8: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/8.jpg)
Motivation of Cyber Attack
Page § 8
![Page 9: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/9.jpg)
Page § 9
DDoS vs. Hacking
DDoS
Hacking
If (Availble){ try
{ SQLi, XSS, CSRF MITM, Brute Force, Reverse Engineering, Buffer Overflow, RFI, Session Hijacking, Information Leakage, Defacement, something cool
} catch (data) finally { DDoS }
while (Available){ try
{ DDoS()} finally { Give_up()}
![Page 10: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/10.jpg)
Page § 10
Trend of DDoS attack
POC Organized Collaborated
Volume Focus
0-day focus
2008
2009
DJB33X
100+Gbps / 70Mpps
![Page 11: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/11.jpg)
Page § 11
DDoS Attack – Brief History
Packet Generator Packet Crafter Creative Attacks
![Page 12: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/12.jpg)
Page § 12
DDoS - Yesterday
2002 root DNS attack All thirteen (13) DNS root name servers were targeted simultaneously. Attack volume was approximately 50 to 100 Mbits/sec (100 to 200 Kpkts/sec) per root name server, yielding a total attack volume was approximately 900 Mbits/sec (1.8 Mpkts/sec). Attack traffic contained ICMP, TCP SYN, fragmented TCP, and UDP.
Some attack types you might heard of ICMP flood, Ping flood, UDP flood, IP Fragment, SYN flood, Teardrop, ACK flood, RST flood, Land attack, smurf attack, Ping to death, Nuke, ARP Poison, Reflex attack, TCP NULL, XMAS, Malformed TCP flags, PUSH ACK flood, DNS query flood, GET flood, POST flood, authentication flood, de-authentication flood, SIP flood
![Page 13: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/13.jpg)
Page § 13
DDoS - Yesterday
Tools (comes with your OS) Ping, telnet, wget
Tools ( can easily get from internet)
hping, scapy, cURL, Library:
Libpcap-dev, libthread, libnet-dev, netinet/*.h, string.h
for ((i=0;i<100;i++)) do `wget target.com &`; done
Simple GET flood in 1 line
![Page 14: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/14.jpg)
Page § 14
DDoS - Today
• Open source, • Cross platform, • More in flow control, • More in application layer Tools ( can be easily get from internet)
apache-killer.pl, slowloris.pl, slowhttptest, LOIC, HOIC, via IRC channel
Library:
Libpcap-dev, libthread, libnet-dev, urllib, libpcap-dev, libdnet-dev, socket
![Page 15: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/15.jpg)
Page § 15
DDoS - Today
$p = ""; for ($k=0;$k<1300;$k++) {
$p .= ",5-$k"; } $p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n”;
apache-killer.pl
![Page 16: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/16.jpg)
Page § 16
DDoS - Today
-w bytes start of the range advertised window size would be picked from.
Effective in slow read (-X) mode only, min: 1, default: 1 -y bytes, end of the range advertised window size would be picked from. Effective in slow read (-X) mode only, min: 1, default: 512
-x bytes, max length of each randomized name/value pair of follow up data per tick, e.g. -x 2 generates X-xx: xx for header or &xx=xx for body, where x is random character, default: 32
-z bytes bytes to slow read from receive buffer with single read() call. Effective in slow read (-X) mode only, default: 5
Slowhttp ‘test’
![Page 17: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/17.jpg)
Page § 17
DDoS – Tomorrow
• 0-day focused • Standardized – part of worms and bots • DDoS as a project, in a team • Focus on target application Tools:
HashDDoS – DJB33X, protocol fuzzer, iFrame bot, js bot, Unicornscan (2007), plug-in for worms, mobile bots
DDoS as a Service:
DDoS attack repository, open DDoS ‘testing’ server, RFC for DDoS, “Like” this attack, DDoS ‘app’ market, auto CAPTCHA breaking
![Page 18: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/18.jpg)
Page § 18
DDoS – Tomorrow
Internet is designed for inter-connect, goodwill in self-discipline
Internet is NOT designed for security.
TCP is : designed for state-ful,
connection-oriented connection, TCP is NOT: temper proof
synchronized source authenticate sensitive to intercept (MITM)
![Page 19: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/19.jpg)
Page § 19
DDoS – Tomorrow
Unicronscan (http://www.unicornscan.org/ ) Unicrons are fast!
Asynchronous stateless TCP scanning with all variations of TCP Flags. Asynchronous stateless TCP banner grabbing Asynchronous protocol specific UDP Scanning
![Page 20: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/20.jpg)
Page § 20
DDoS – Tomorrow
Web Shell
Credit http://ddos.arbornetworks.com/2012/02/ddos-tools/
![Page 21: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/21.jpg)
Page § 21
DDoS Detection and mitigation– Brief History
Collect &
Filter
Detect &
Challenge
Learn &
Fight back
![Page 22: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/22.jpg)
Page § 22
DDoS Detection and mitigation – Yesterday
• Blackhole • Rate-limiting • ACL • iptables • CoPP • SYN-cookie • IDS • IPS • Load balancing • Port-security
• Detection: SNMP, netflow
![Page 23: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/23.jpg)
Page § 23
DDoS Detection and mitigation – Today
• DNS poisoning • CDN • WAF • Hot-link protection • CAPTCHA • Source authentication • Detection: SNMP, Netflow, PCAP
![Page 24: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/24.jpg)
Page § 24
DDoS Detection and mitigation – Tomorrow
• Browser authentication • User behavior validation • Application learning • User-id correlation • Differentiate mitigation • Bot / tools identification • (Friendly) Attack back
• Detection: SNMP, Netflow, PCAP, logs + big data
"Apparently the war is over and you are ordered to cease firing; so, if you see any Jap planes in the air, you will just have to shoot them down in a friendly manner.” - Admiral Halsey, 1945
![Page 25: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/25.jpg)
Next Generation Detection---Profiling and Data Mining
Page § 25
![Page 26: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/26.jpg)
A HTTP Get Flood Attack Analysis
Page § 26
![Page 27: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/27.jpg)
A HTTP Get Flood Attack Analysis
Page § 27
![Page 28: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/28.jpg)
Next Generation Detection---With Google API ?
Page § 28
![Page 29: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/29.jpg)
Mobile Internet & Web API
Page § 29
![Page 30: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/30.jpg)
API Request Load
30
• Make money � 60% of all lis2ngs on eBay.com added via their APIs
• Save money � SmugMug saves > $500K/year with Amazon S3 Storage
• Build brand � Google Maps 300% growth vs 20% MapQuest
• Move to the cloud � Over 50% of all transac2ons via their API, Force.com
• Go anywhere � NeQlix now available on over 200 devices
Credit : ProgrammableWeb
![Page 31: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/31.jpg)
Flipboard / Instgram Down?
Page § 31
![Page 32: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/32.jpg)
Know it before you hack it
Page § 32
![Page 33: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/33.jpg)
API Abused DDoS
Page § 33
§ API Security Threats - API Key spoofing - API Throttling bypass - Quota System bypass - API ACL (Private API accessed by Public)
§ API Request DDoS - HTTP/HTTPS GET flood - HTTP/HTTPS POST flood - PUT/DELETE/HEAD ?
![Page 34: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/34.jpg)
What if it’s not abuse?
Page § 34
100,000 Users Have Downloaded Malware From Google Play
![Page 35: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/35.jpg)
Google/ Alternative Android Markets and the Audit Policy
Page § 35
![Page 36: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/36.jpg)
Mobile Device Botnet---Existing Apps
Page § 36
Android DDoS Tool Available in Google Play 1. Requires Internet access
to send the http post data 2. Requires phone state to
access the IMEI
Pretty common requirement for Apps.
![Page 37: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/37.jpg)
Page § 37
Mobile Device Botnet--- Free App Generator
![Page 38: DDoS – Yesterday, Today and tomorrowhitcon.org/2012/download/0721D5_Frank&William_DDoS... · Nexusguard, incorporated in 2008, is a premium provider of end-to-end, in-the-cloud](https://reader033.vdocuments.mx/reader033/viewer/2022050214/5f5ff3c47eccd471556255c6/html5/thumbnails/38.jpg)
Next Generation Detection---Profiling and Data Mining
§ Traffic Baseline - HTTP Field Pattern - HTTP Traffic Volume - TCP Connections
§ IP Ranking - Geo IP - 80 / 20 - Open API Data Comparison---e.g. Google Safe Browsing API - Seculert API(expensive!).
Page § 38