characterizing and mitigating the ddos-as-a-service phenomenon · 2014-07-04 · booter type of...

16

Characterizing and Mitigating The DDoS-as-a-Service Phenomenon Jair Santanna Design and Analysis of Communication Systems 30/06/2014 [email protected]

Upload: others

Post on 11-Aug-2020

2 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

Characterizing and Mitigating The DDoS-as-a-Service

PhenomenonJair Santanna

Design and Analysis of Communication Systems 30/06/2014

[email protected]

mailto:[email protected]

Page 2: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

DDoS attacks!

300Gbps

400Gbps

Page 3: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

Page 4: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

“Booter" | “Stresser" | “DDoSer" | "DDoS-as-a Service”|"DDoS-for-hire"

Page 5: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

Online Tools that offer "DDoS-as-a-$ervice".

“Booter" | “Stresser" | “DDoSer" | "DDoS-as-a Service”|"DDoS-for-hire"

$5

Page 6: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

DDoS Attack

The DDoS-as-a-Service Phenomenon

Less than 5 Dollars to attack everyone

No more opponents!!

No more ONLINE exams!!

Economic Impact!!

Page 7: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

DDoS Attack

The DDoS-as-a-Service Phenomenon

Less than 5 Dollars to attack everyone

KEEP your boyfriend far from "Nerd stuff"

More attention to your presentation!!!

Page 8: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

How to Characterize the DDoS-as-a-Service phenomenon?

How to Mitigate the DDoS-as-a-Service phenomenon?

Research Questions:

Booter

Page 9: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

• How to mitigate DDoS-as-a-Service at the customer level?• How to mitigate DDoS-as-a-Service at the target level?• How to mitigate DDoS-as-a-Service at the point where the infrastructure is controlled?

Mitigate• How popular they are and which services they offer?• What are the characteristics of DDoS attacks launched by them?• How do they control infrastructures that perform attacks?

Characterize

Front-end

Customer TargetBack-end

DNS Server

NTP Server

Bot (from a botnet)

How do Booters work?

Booter

Page 10: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

...

Page 11: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

"One more thing…"

Page 12: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

TWO

Page 13: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

About Price

Repeat as much as you want!

�

��

��

��

��

��

� � � � � ��

��

��

��

��

��

��

��

��

� � � � � ��

��

��

�

��

�

��

� ��

� ��

Package expiration + Attack duration

"Package" || "Bundle" || "Plans"

Page 14: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

Booter Type of Attack Avg Traffic Rate![Gbps]

N° Misused !systems

B1 DNS-based 0.7 4486B2 DNS-based 0.25 78B3 DNS-based 0.33 54B4 DNS-based 1.19 2970B5 DNS-based 0.006 8281B6 DNS-based 0.15 7379B7 DNS-based 0.32 6075

B8 CharGen-based 0.99 281B9 CharGen-based 5.48 3779

9427x

Potencial for worse attacks

Page 15: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

The DDoS-as-a-Service Phenomenon…

Very Cheap and

Powerful*

Page 16: Characterizing and Mitigating The DDoS-as-a-Service Phenomenon · 2014-07-04 · Booter Type of Attack Avg Trafﬁc Rate! [Gbps] N° Misused ! systems B1 DNS-based 0.7 4486 B2 DNS-based

Thanks!Děkuji!

Jair [email protected]

mailto:[email protected]

HPIMP: Measuring Booter Services - RIPE 77 · DDoS & Booter Services • We see DDoS attacks on a daily basis at IXPs • What's their origin? • How bad is it? • Understand the

Constellation: automated discovery of service and host ......DHCP MOM DNS DNS KERBEROS LDAP HTTP SMB LDAP MOM DNS DNS DNS DNS Figure 1: Small fragment of a constellation depicting

The Computer Booter

DNS Session 2: DNS cache operation and DNS debugging

Oral Surgeon San Diego CA - Randall Stettler, DDS (619) 463-4486

Case No. 03-4486 - Sixth Circuit Blog No. 03-4486 _____ UNITED STATES COURT OF APPEALS FOR THE SIXTH CIRCUIT _____ JEROME R. MIKULSKI; ELZETTA C. MIKULSKI, On Behalf of Themselves

2016 Singleton Heights Public School Annual Report...2016 4486 Page 1 of 17 Singleton Heights Public School 4486 (2016) Printed on: 5 May, 2017 Introduction Message from the Principal

2010 ICF Canoe Slalom World Championships SLOKA 2010...2010/09/12 · 25 FORIZS Reka HUN DNS DNS 27 POLEZHAEVA Svetlana KAZ DNS DNS 28 NIKOLAEVA Irina UZB DNS DNS Chief Judge _____

DNS Session 2: DNS cache operation and DNS debuggingbrian/doc/dns/dns2-presentation.pdf · DNS Session 2: DNS cache operation and DNS debugging ... the wrong answers if the authoritative

Coletanea booter antenatv

Configuring DNS · Example: Configuring DNS Spoofing Inthefollowingexample,thedeviceisconfiguredtospoofrepliestoanyDNSqueries: ip dns server ip dns spoofing no ip domain lookup

Networking:! UDP&!DNS! · 2018-06-27 · Root DNS Servers com DNS servers org DNS servers edu DNS servers poly.edu DNS servers umass.edu DNS servers yahoo.com DNS servers amazon.com

RIPE76 DNS Privacy measurements · DNS WG @ RIPE76 DNS Privacy Measurements Latest Measurements on DNS Privacy Sinodun ... Unbound . DNS WG @ RIPE76 DNS Privacy Measurements Test

Implant Dentist San Diego - Randall Stettler, DDS (619) 463-4486

Passive DNS Hardening - Farsight Security...Introduction DNS Security Issues Passive DNS hardening DNSDB DNS Passive DNS ISC SIE Passive DNS I Passive DNS replicationis a technology

Web Design Company St. Catharines – White Shark Media | 289-271-4486

Securing DNS: Doing DNS As If DNS Actually Matteredjoe/secprof10-dns/secprof10-dns.pdf · Doing DNS As If DNS Actually Mattered ... -- releasing malware that tweaks host file entries

USENIX | The Advanced Computing Systems Association · DNS, LDAP, Port Mapper, RPC DNS, LDAP DNS Mail exchange, DNS DNS, AD, Kerberos ... Knowing in advance Improves response time

DNS 103: DNS Performance And Security

Domain Name System. CONTENTS Definitions. DNS Naming Structure. DNS Components. How DNS Servers work. DNS Organizations. Summary

4486 4490.output

DNS for Dummies Ebook Amazon | DNS

DNS-2640 User Manual QS0001 - DataON Storagedoc.dataonstorage.com/product/DNS/2640/DNS-2640_User_Manual.pdf · DNS-2640 User Manual 2 Package content The DNS-2640 box contains the

DNS DNS SPS ThreatAvertdnsops.jp/event/20180627/DNSセキュリティはDNSで... · 2018-09-11 · DNS DNS " " SPS ThreatAvert DNS " DDoS ( $30 5+ 2018*6-27, ! " % '.46)/2 ©Akamai

KDN No: PP10311/10/2012(031241) † ISSN No. : 2180-4486 www ...mpoc.org.my/wp-content/uploads/2019/07/GOFB-Global-Oils-and-Fat… · PP10311/10/2012(031241) † ISSN No. : 2180-4486

Domain Name System (DNS). Outline Functions of DNS Design goals of DNS History of DNS Elements of DNS –Name space and resource records –Name servers –Name

Seculabs eBook - Prodigys Booter With Mass Shell Adder

Networking:! UDP&!DNS! · Root DNS Servers com DNS servers org DNS servers edu DNS servers poly.edu DNS servers umass.edu DNS servers yahoo.com DNS servers amazon.com

Monitor Windows DNS Server using DNS Analytics … · Monitor Windows DNS Server using DNS Analytics (Preview) ... analyzes and correlates Windows DNS analytic and audit logs and

Oral Surgeon San Diego - Randall Stettler, DDS (619) 463-4486

DDoSHideandSeek– On theEffectivnessofa BooterService … · Selected booter services. We select 4 popular booters (see Ta-ble 1) from the booter blacklist [46] based on their Alexa

Web Design & Development St. Catharines – White Shark Media | 289-271-4486

dns ile alakalı diyer kelimeler · dns failover 1300 0,36 17,75 euro dns 720 0,05 6,03 dns management 1300 0,5 7,92 dns registration 720 0,89 27,22 dns blacklist 1600 0,11 2,69 dns

Threat: DDoS Booter Shell Scripts - PRWebww1.prweb.com/prfiles/2012/04/24/9438887/Prolexic... · Threat: DDoS Booter Shell Scripts GSI ID - 1050 ... Booter Shell – A booter shell

Booter websites characterization: Towards a list of threats