BerlinSides - Denial as a Service

An analysis of different denial of service attacks vectors, the popularity of such attacks and why infrastructure needs to evolve.

Transcript

1. Denial as a Service
2. WHOAMI Greg Hill - Scottish Hacker - QA / Network Engineer @gregorydhill
3. Background It’s everywhere. 1
4. Everywhere One of the biggest threats: ◦ easy to attack, ◦ not easy to defend, ◦ and costly. Undeniable, large scale threat.
5. Let’s look at the numbers. Q4 2015 Threat Landscape (Incapsula) 2
6. 85% Increase Over Q4 2014 371 Hours Longest Attack 69 Targeted Countries
7. 3–6K # of Attacks 602 Gb/s Largest Attack 6.88 Gb/s Average Peak Size
8. $40,000 Financial Impact (Per Hour)
9. Who? Hacktivism 3
10. Groups Anonymous Lizard Squad Syrian Electronic Army Armada Collective Script Kiddies
11. A story… FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY AND CAN MAKE DECISION! We are Armada Collective. http://lmgtfy.com/?q=Armada+Collective Your network will be DDoS-ed starting [date] if you don't pay protection fee - 10 Bitcoins @ [Bitcoin Address]. If you don't pay by [date], attack will start, yours service going down permanently price to stop will increase to 20 BTC and will go up 10 BTC for every day of attack. This is not a joke. Our attacks are extremely powerful - sometimes over 1 Tbps per second. And we pass CloudFlare and others remote protections! So, no cheap protection will help. Prevent it all with just 10 BTC @ [Bitcoin Address] Do not reply, we will not read. Pay and we will know its you. AND YOU WILL NEVER AGAIN HEAR FROM US! Bitcoin is anonymous, nobody will ever know you cooperated.
12. What is a (D)DoS? Fundamentals 4
13. DDoS Distributed Denial of Service: ◦ Service Disruption ◦ Sourcing Vulns or Effort ◦ Via Surface Division
14. The Basics Denial of Service 5
15. 3 Categories Volumetric Saturate the bandwidth. Measured in bits per second (Bps). Protocol Consume server resources. Measured in packets per second. Layer 3 Application Victim vulnerabilities. Measured in requests per second. Layer 7
16. OSI Model Layer Name Example Protocols 7 Application HTTP, FTP, DNS, NTP, SNMP 6 Presentation SSL, TLS 5 Session NetBIOS, PPTP 4 Transport TCP, UDP 3 Network IP, ARP, ICMP, IPSec 2 Data Link PPP, ATM, Ethernet 1 Physical Ethernet, USB, Bluetooth, IEEE802.11
17. Analysis Let’s look at some examples… 6
18. Volume UDP Flood: ◦ Random Ports ◦ Variable IP Packets (Spoofed) ◦ ICMP Response
19. Volume ICMP Flood: ◦ ICMP ECHO ◦ Variable IP Packets (Spoofed) ◦ ICMP Response
20. Protocol SYN Flood: ◦ Exploits TCP ◦ Ignore SYN-ACK ◦ Half-Open Bind
21. Protocol Teardrop: ◦ Exploits TCP/IP Reassembly ◦ Overlapping Offsets ◦ Outdated Software
22. Application 0-Day: ◦ Buffer Overflow ◦ Permenance ◦ Direct
23. Application HTTP Flood: ◦ Processing / Retrieval ◦ Highly Targeted ◦ GET / POST …
24. Application DNS / NTP: Reflection: Request (Spoofed) Amplification: Small > Large
25. How difficult is it? Demo
26. Scripting Python 7
27. Automation Modules: ◦ Socket ◦ Thread ◦ Scapy ◦ HTTPLIB /2 ◦ URLLIB
28. Example 1 HTTP Flood (Stress)
29. Example 2 UDP Flood (Stress)
30. Example 3 Buffer Overflow (Directed)
31. Tools DDoS Made Simple 8
32. Tools LOIC OWASP ... Slowloris R-U-Dead-Yet … HPING3 NMAP …
33. Distribution So you have a botnet? 9
34. Distribution Division of Labour: ◦ Aware ◦ Ignorant
35. Example 4 SSH Botnet
36. Attacking Countries 11.7% 1.5% 39.8% 1.3% 1.5% 12.6% 5.8% 4.2% 2.9% 1.3%
37. Size Does size matter? 10
38. Statistics Net vs App by Bandwidth 0% 5% 10% 15% 20% 25% 30% 35% 40% 45% < 10 Mb/s 10 Mb/s - 100 Mb/s 100 Mb/s - 1 Gb/s 1 Gb/s - 5 Gb/s 5 Gb/s - 10 Gb/s 10 Gb/s > Application Network
39. Components Leveraging: ◦ # of Peers ◦ Network Connectivity ◦ Response Ratio ◦ Vs Content Delivery
40. Test Methodologies Stress / Load Testing 12
41. Methodology Exploit > Stress (Multi-Vector) Determine Solutions Identify Target
42. Mitigation Is defence an illusion? 12
43. Mitigation Techniques: ◦ Blackholing ◦ Firewalls (iptables) Connection Limiting Aggressive Aging Listing / Filtering ◦ IDS ◦ Multi-Layer ◦ CDN ◦ BC / DR
44. End Goal? Consistently growing. Infastructure has to evolve.
45. “ We Cannot Fight DDoS Attacks With Our Eyes Closed
46. Thanks! ANY QUESTIONS? You can contact me: @gregorydhill gregory@zenguard.org