Denial of Service Attacks Understanding to Denial

Denial of Service Attacks

Understanding to Denial of Services

How can a service be denied? Using up resources is the most common approach Several ways. . Crash the machine Put it into an infinite loop Crash routers on the path to the machine Use up a machine resource Use up a network resource Deny another service needed for this one (e. g. DNS)

What is Denial of Service? Denial of Service (Do. S) Attack to disrupt the authorized use of networks, systems, or applications Distributed Denial of Service (DDo. S) Employ multiple compromised computers to perform a coordinated and widely distributed Do. S attack

Do. S Single Source

DDo. S Collateral damage points

DDo. S Attack Traffic (1) One Day Traffic Graph

DDo. S Attack Traffic (2) One Week Traffic Graph

DDo. S Attack Traffic (3) One Year Traffic Graph

How Severe?

DDo. S Botnets Botnet: Collection of compromised computers that are controlled for the purposes of carrying out DDo. S attacks or other activities Can be large in number Systems join a botnet when they become infected by certain types of malware Like a virus, but instead of harming the system, it wants to take it over and control it Through email attachments, website links, or IM links Through unpatched operating system vulnerabilities

Botnets Modus Operandi multi-tier design Zombies

Bot: Direct control 13

Bot: Indirect control 14

Cost of DDo. S Attacks Victims of (D)Do. S attacks Service-providers (in terms of time, money, resources, good will) Legitimate users (deprived of availability of service) Hard to quantify Incomplete data – Companies reluctant to admit they have been victimized Lost business Lost productivity

Why? Who? Several motives Earlier attacks were proofs of concepts Pseudo-supremacy feeling Eye-for-eye attitude Political issues Competition Hired Levels of attackers Highly proficient attackers who are rarely identified or caught Script-kiddies 16

The DDo. S Landscape

DDo. S Timeline

Do. S Attacks Fast Facts Early 1990 s: Individual Attacks single source. First Do. S Tools Late 1990 s: Botnets, First DDo. S Tools Feb 2000: First Large-Scale DDo. S Attack CNN, Yahoo, E*Trade, e. Bay, Amazon. com, Buy. com 2001: Microsoft’s name sever infrastructure was disabled 2002: DDo. D attack Root DNS 2004: DDo. S for hire and Extortion 2007: DDo. S against Estonia 2008: DDo. S against Georgia during military conflict with Russia 2009: Ddos on Twitter and Facebook 2010: Ddos on VISA and Master Card

2000 Do. S Attacks In Feb 2000, series of massive Do. S attacks Yahoo, Amazon, e. Bay, CNN, E*Trade, ZDNet, Datek and Buy. com all hit Attacks allegedly perpetrated by teenagers Used compromised systems at UCSB Yahoo : 3 hours down with $500, 000 lost revenue Amazon: 10 hours down with $600, 000 lost revenue

2002 DNS Do. S Attacks l ICMP floods 150 Kpps (primitive attack) l Took down 7 root servers (two hours) DNS root servers

2009 DDo. S on Twitter Hours-long service outage 44 million users affected At the same time Facebook, Live. Journal, and You. Tube were under attacked some users experienced an outage Real target: a Georgian blogger

DDo. S on Mastercard and Visa December 2010 Targets: Master. Card, Visa, Amazon, Paypal, Swiss Postal Finance, and more Attack launched by a group of vigilantes called Anonymous (~5000 people) DDo. S tool is called LOIC or “Low Orbit Ion Cannon” Bots recruited through social engineering Directed to download DDo. S software and take instructions from a master Motivation: Payback, due to cut support of Wiki. Leaks after their founder was arrested on unrelated charges

The new DDo. S tool by Anonymous New operation is beginning A successor of LOIC Using SQL and. js vulnerability, remotely deface page May be available in this September 2011 V for Vendetta

Operation Facebook Announcement on You. Tube to bomb Facebook on Nov. 5 2011 Facebook’s privacy reveals issues Remember poem Why Nov. 5? V Remember remember the fifth of November
Gunpowder, treason and plot. 
I see no reason why gunpowder, treason
Should ever be forgot. . .

DDo. S Attack Classification

DOS attack list Flood attack TCP SYN flood UDP flood ICMP (PING) flood Amplification (Smurf, Fraggle since 1998) Vulnerability attack Ping of Death (since 1990) Tear Drop (since 1997) Land (since 1997)

Flooding attack Commonly used DDo. S attack Sending a vast number of messages whose processing consumes some key resource at the target The strength lies in the volume, rather than the content Implications : The traffic look legitimate Large traffic flow large enough to consume victim’s resources High packet rate sending 28

Vulnerability Do. S attack Vulnerability : a bug in implementation or a bug in a default configuration of a service Malicious messages (exploits) : unexpected input that utilize the vulnerability are sent Consequences : The system slows down or crashes or freezes or reboots Target application goes into infinite loop Consumes a vast amount of memory 29

TCP SYN flood SYN RQST server client SYN ACK victim zombie Zombies Spoofed SYN RQST SYN ACK Waiting queue overflows

Smurf attack Amplification attack Sends ICMP ECHO to network Amplified network flood widespread pings with faked return address (broadcast address) Network sends response to victim system The "smurf" attack's cousin is called "fraggle", which uses UDP echo packets in the same fashion 31

Do. S : Smurf A Ping Broadcast Src Addr : B Dst Addr : Broadcast B

Do. S : Fraggle A Infinite Loop! UDP Broadcast src port : echo dest port: chargen port Src Addr : B Dst Addr : Broadcast Well known exploit Echo/Chargen B

Ping of Death Sending over size ping packet to victim >65535 bytes ping violates IP packet length Causes buffer overflow and system crash Problem in implementation, not protocol Has been fixed in modern OSes Was a problem in late 1990 s

Teardrop A bug in their TCP/IP fragment reassembly code Mangle IP fragments with overlapping, over-sized payloads to the target machine Crash various operating systems

LAND A LAND (Local Area Network Denial) attack First discovered in 1997 by “m 3 lt” Effect several OS : AIX 3. 0 Fress. BSD 2. 2. 5 IBM AS/400 OS 7400 3. 7 Mac OS 7. 6. 1 SUN OS 4. 1. 3, 4. 1. 4 Windows 95, NT and XP SP 2 IP packets where the source and destination address are set to address the same device The machine replies to itself continuously Published code land. c

LAND

Well known old DDo. S Tools Botnet Communication Type Attack Type Encrypted Communication? Trinoo or trin 00 TCP/UDP Flood No Tribe Flood Network (TFN) TCP/UDP/ICMP Multiple No TFN 2 K TCP/UDP/ICMP Randomized Multiple Randomized No Stacheldraht TCP/UDP/ICMP Randomized Multiple Randomized Yes

DDo. S Defense

Are we safe from DDo. S? My machine are well secured It does not matter. The problem is not your machine but everyone else I have a Firewall It does not matter. We slip with legitimate traffic or we bomb your firewall I use VPN It does not matter. We can fill your VPN pipe My system is very high provision It does not matter. We can get bigger resource than you have 40

Why Do. S Defense is difficult Conceptual difficulties Mostly random source packet Moving filtering upstream requires communication Practical difficulties Routers don’t have many spare cycles for analysis/filtering Networks must remain stable—bias against infrastructure change Attack tracking can cross administrative boundaries End-users/victims often see attack differently (more urgently) than network operators Nonetheless, need to: Maximize filtering of bad traffic Minimize “collateral damage”

Defenses against Do. S attacks cannot be prevented entirely Impractical to prevent the flash crowds without compromising network performance Three lines of defense against (D)Do. S attacks Attack prevention and preemption Attack detection and filtering Attack source traceback and identification 42

Attack prevention Limit ability of systems to send spoofed packets Filtering done as close to source as possible by routers/gateways Reverse-path filtering ensure that the path back to claimed source is same as the current packet’s path Ex: On Cisco router “ip verify unicast reverse-path” command Rate controls in upstream distribution nets On specific packet types Ex: Some ICMP, some UDP, TCP/SYN Block IP broadcasts 43

Responding to attacks Need good incident response plan With contacts for ISP Needed to impose traffic filtering upstream Details of response process Ideally have network monitors and IDS To detect and notify abnormal traffic patterns 44

Responding to attacks cont’d …. Identify the type of attack Capture and analyze packets Design filters to block attack traffic upstream Identify and correct system application bugs Have ISP trace packet flow back to source May be difficult and time consuming Necessary if legal action desired Implement contingency plan Update incident response plan 45

How are DDo. S practical handled? 46

Router Filtering R 4 R 5 peering R 2 R 3 1000 ACLs, CARs R 1 100 R R FE R . . . . Server 1 Victim Server 2 47

Cisco u. RPF Pkt w/ source comes in Router A Path back on this line? Accept pkt Router B Check source in routing table Path via different interface? Reject pkt Unicast Reverse Path Forwarding Does routing back to the source go through same interface ? Cisco interface command: ip verify unicast rpf 48

Black hole Routing R 4 R 5 peering ip route A. B. C. 0 255. 0 Null 0 R 2 R 3 1000 R 1 100 R R FE R . . . . Server 1 Victim Server 2 49

Blackhole in Practice (I) Upstream = Not on the Critical Path Guard Detector Victim Non-victimized servers 50

Blackhole in Practice (II) BGP announcement Guard 3. Divert only victim’s traffic 2. Activate: Auto/Manual Activate 1. Detector Victim Non-victimized servers 51

Blackhole in Practice (III) Hijack traffic = BGP Guard Traffic destined to the victim Legitimate traffic to victim Inject= GRE, VRF, VLAN, FBF, PBR… Detector Victim Non-victimized servers 52

DDo. S Epilogue 53

DDo. S Attack Trends Attackers follow defense approaches, adjust their code to bypass defenses Use of subnet spoofing defeats ingress filtering Use of encryption and decoy packets, IRC or P 2 P obscures master-slave communication Encryption of attack packets defeats traffic analysis and signature detection Pulsing attacks defeat slow defenses and traceback Flash-crowd attacks generate application traffic

Implications For the Future More complex attacks Recently seen trends: Larger networks of attack machines Rolling attacks from large number of machines Attacks at higher semantic levels Attacks on different types of network entities Attacks on DDo. S defense mechanisms Need flexible defenses that evolve with attacks