ddos. methods – syn flood – icmp flood – udp common amplification vectors – ntp 557 –...

20

DDOS

Upload: shanon-woods

Post on 03-Jan-2016

221 views

Category:

Documents

2 download

Report

Download

Tags:

Embed Size (px):

TRANSCRIPT

Page 1: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

DDOS

Page 2: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

DDOS• Methods

– Syn flood– Icmp flood– udp

• Common amplification vectors– NTP 557 – CharGen 359 – DNS 179– QOTD 140– Quake 64 – SSDP 31– Portmap 28– mDNS 10– SNMPv2 6

Volumetric

vs

Overwhelming a service

Page 3: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Infrastructure vulnerable to Volumetric Attack

• Campus Network “last mile”

• Firewalls, other traffic-impeding middleboxes

• Monitoring

• uwsys.net upstream transit

• Etc.

Page 4: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Don’t be a participant

• Filter– Block or rate-limit known vectors– Deprecate open recursive resolvers– Anti-spoofing

• uRPF, ACLs

• Monitor. Can you detect DDoS in your traffic?

• UWSys has some monitoring and aggressive filters where plausible. (more from Michael later)

Page 5: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Example (volumetric) Motivations

• On-line gaming / forums– Take a specific user offline– Revenge

• Avoid exams– Disrupt online services

• Create a distraction– Then hack machines while monitoring/staff is overwhelmed

• Wreak havoc– Happened to Rutgers

Page 6: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Economics

Page 7: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Page 8: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

But, I have a DR plan

Page 9: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

But, I have a DR plan

• Example: Resilient web hosting

• Oh, so you want to make a change to DNS?– Where is your SOA?– Where are the authoritative servers?

Page 10: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

• Of the 15 major UW domains,– 3 do not have any NS records off-site at all. Really.– 9 still share fate with uwsys network– Only 3 have off-site (non uw-system) resiliency– Zero have SOA off-site.

Page 11: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

DDOS Solution Space

Needed: a holistic approach

• Cloud (me)• Network (Dan D., Michael H.)• Appliance (Greg P., Scott B.)

Page 12: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Pat

• People• Processes • Technology

Page 13: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

DDOS Detection

Page 14: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Page 15: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

The Movies

Page 16: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Reality

Page 17: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Cloud Mitigation

• CDN hosting– Typically a dns redirect

• DR Load balancing

• “web application firewall”(Reverse proxy)

• Scrubbing

Recall, (2) types of DDOS:

Application / Overwhelm a service

--------------------------Volumetric Attack:

Page 18: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Scrubbing

• Contract in place with a provider• Pre-configured GRE tunnel to scrubbing provider• Process netflow, Alert a human to look at it• Tell provider to scrub for a prefix (via BGP)• Scrubber announces more-specific prefixes (up

to /24) to Internet, processes traffic, sends legitimate traffic back via GRE

• Pricing models vary– amount of scrubbing capacity under contract– What the data rate of the clean traffic should be– Incidental overage vs long-duration

Page 19: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

The era of unsolicited packets is over...

• Can’t we just turn off / rate limit UDP?

• QUIC– Google’s experiment to replace TCP+TLS+SPDY

Page 20: DDOS. Methods – Syn flood – Icmp flood – udp Common amplification vectors – NTP 557 – CharGen 359 – DNS 179 – QOTD 140 – Quake 64 – SSDP 31 – Portmap28

Flood Estimation following the Flood Studies Report - … Estimation FSR... · Flood Estimation following the Flood Studies Report ... flood estimation methods ... (Some important

QotD Make a list of what types of forces we have on Earth?

Ryuutama Advanced Chargen

Flood Estimation flood routing - Water Infotechwaterinfotech.com/surfwater/les_ 9 Flood Estimation .pdf · Flood Estimation flood Control • Physical indications of past floods-

Flood and Flash Flood

Introduction to Cybercrime - CriminologieStresser Advertised Launched Correct Cost Stresser Advertised Launched Correct Cost 1 PORT MAP RPC 71.00% $14 10 CHARGEN NONE 36.00% $15 2

1. QOTD: Examining the “best answer”

Flood Mitigation and Flood Insurancedls.virginia.gov/groups/flooding/fihr joint sub-committe on flooding... · FLOOD INSURANCE Hampton Roads Flood Mitigation and Flood Insurance By

QOTD Write down the first thing that comes to your mind when you hear the word Muslim

Evaluation of flood damage and flood risk · flood damage ex post: damage figures calculated after a flood event expected flood damage: flood damage figures estimated before a flood

Flood Protection Doors - The Flood Companythefloodcompany.co.uk/.../02/TFC-Flood-PVC-Door... · Flood Protection Doors [email protected] Voted the uk’s No.1 total flood

Flood Estimation flood Control

FLOOD MAP MODERNIZATION Flood Map Modernization · FLOOD MAP MODERNIZATION FLOOD MAPPING Flood Map Modernization (Map Mod) is based on a solid foundation. The National Flood Insurance

Focus - Ecophon · LEISTUNGSERKLÄRUNG (Ref: Verordnung (EU) Nr. 305/2011 ) No. 001DOP-SST-20190510 1. Eindeutiger Kenncode des Produkttyps: Ecophon Focus 2. Typen-, Chargen- …

QOTD What is a population?. Parts of Ecosystems Mr. Dunnum

1/28/13 - QOTD In the picture below, where is the oldest rock? A B

An Analysis of DrDoS SNMP-NTP-CHARGEN Reflection Attacks White Paper A4 042913

Flood Hazard Mapping and its Utilization for Flood ... · PDF fileUtilization for Flood Disaster Mitigation ... Session “Flood control and mitigation measures ... Flood mapping of

QOTD ► President Franklin Roosevelt established the Tennessee Valley Authority in order to: ► A build railroads, renovate cities, and improve schools in

QOTD - NO MARK QUIZ

CHARGEN-Based DrDoS Attacks: A Growing Marketplace and DDoS Threat

FLOOD BARRIERS • FLOOD GATES • FLOOD DOORS •

QOTD What is an ecosystem? What is an ecosystem? 3-5 sentences 3-5 sentences

Declaration of performance · Ecophon Solo 2. Typen-, Chargen- oder Seriennummer oder ein anderes Kennzeichen zur Identifikation des Bauprodukts: Ecophon Solo Ecophon Solo Baffle

QOTD Name the four phases of matter.. States of Matter Mr. Dunnum

Flood risk and Flood zones

QOTD What is a predator?. PREDATION and PARASITISM Mr.Dunnum

COUNTY ADMINISTRATOR: C.H. Huckelberry FLOOD CONTROL FLOOD ...webcms.pima.gov/UserFiles/Servers/Server_6/File... · FLOOD CONTROL FLOOD CONTROL FLOOD CONTROL FLOOD CONTROL FLOOD CONTROL

Improving Flood Hazard Identification & Flood Risk ... · Improving Flood Hazard Identification & Flood Risk Communication: ... • Flood Insurance Studies ... FEMA Flood Project

Motivation. QOTD Taylor Kugler What do you think motivation is mainly driven by? A) Drives B) Incentive C) Needs

Flood Waal and Flood Embankment

Protecting Websites from Attack with Secure Delivery Networksxia/resources/Documents/gillman_ieee15.pdf · 7.42% SSDP, 7.31% NTP, 4.56% CHARGEN, 3.92% ACK, 3.81% TCP RESET, 0.64%

QOTD What does democracy mean to you? Does it effect your life in any way? Copyright 2009 Prentice Hall

QOTD 10/22/13 1.Come grab a copy of the pennium “lab” activity from the front counter 2.HW check: please get out the HW assignment (p 60-64) 3. QOTD: work

QOTD 9/5/14 NO QOTD today. Instead, please come grab the lab safety quiz (will not be graded, though questions like these may appear on our first test)