Identifying the scan and attack infrastructures behind amplification DDoS attacks Authors – Johannes Krupp, Michael Backes, and Christian Rossow(2016) Presented by - Aditya Walanj

Motivation Amplification DDoS attacks have become serious threat to Internet users. Attack bandwidths can be several 100’s of Gbit/s Attackers can spoof source IP of requests sent to Open Internet Services. Victims don’t know who to contact to prevent these attacks. Goal is to render a network unusable by flooding target network with huge traffic.

Background All amplification attacks are UDP based since it’s a connection-less protocol. Four parties: Attacker: Sends requests with spoofed IP Amplifiers: Servers which act as reflectors Victim: Source IP specified in request Scanner: Used to find amplifiers by sending requests and recording responses. Attacker leverages the amplification vectors in Network Protocols

Problem A little is known about origin of attack Revealing attack sources is a significant problem Spoofed nature of traffic makes it difficult False source address provided to hide identity or impersonate another system Solution: Attributing attacks to Scan infrastructures using honeypot techniques. Mapping Scan infrastructure to attackers using TTL trilateration techniques.

Solution Background Method fulfils three important goals: Works at real time so we can attribute attacks on the fly Attribution does not require cooperation between ISP’s Provides probabilistic guarantees showing confidence levels of attribution outcomes. A honeypot is computer security mechanism that contains valuable data which is monitored to detect unauthorised use. AMPPOT emulates a server offering 7 different UDP protocols that are abused. E.g. NTP, DNS Selective response scheme AMPPOT only selectively replies to requests Each scanner will see a different set of deployed honeypots  Distinct attribution feature Implement by fixing fraction of network to respond to scan  fraction set to 0.5

Solution Background (cont) Three /28 Networks  48 Honeypot IPs Each Scanner scans all 48 Honeypot IPs and has unique reply set of 24 IPs In real world, may not query with one source but with multiple sources Confidence levels determine how robust attribution is in real world conditions Two sets: Query set and Reply set Find probability p to falsely accuse a scanner Confidence = 1- p

Methodology: Step 1 Potential Scanner behind attack In attack set Attack: A stream of at least 100 packets from same source to same port within 1 hour. Amplifier set depends greatly on scan prior to attack. For every honeypot IP, maintain all aware sources (scanners). Potential Scanner behind attack In attack set

Results Three cases: Zero candidates: No scanner was aware of amplifiers  Non Attributable (2.5 %) Exactly one candidate: Single scanner was aware of amplifiers  Attributable (79.9 %) More than one candidate: Multiple scanners were aware of amplifiers  Non Unique (17.6 %) Most attributed attacks and scanners were from US, Netherlands, and Lithuania.

Methodology: Step 2 Were the infrastructure used to perform scans also used to launch attacks ? Distance (source, receiver) = TTL at source (Attacker) – TTL at receiver (Honeypot) Assumption: Initial TTL is fixed and equal hop distance from same source to same honeypot. Compare hop distances to identify if two packets originate from same source. Validate TTL metric using RIPE Atlas: Select 200 random probes to send packets to 11 most prominent honeypots Honeypots record TTL values Compute minimal distance from every pair of source using recorded TTL values Derive thresholds from distances

Methodology: Step 2 (cont) Measurements < threshold  same source Measurements > threshold  different sources True Positive: 1 Probe had two measurements below threshold False Positive: 2 different Probes have two measurements below threshold Apply methodology to dataset of scanners by comparing TTL vectors of scan event and attributed attacks. 34 out of 286 scanner were found malicious with 99.9 % confidence.

Criticism Limitations Improvements Amplifier set used in attack was scanned with single public IP Attackers may identify AMPPOT by its behaviour Initial TTL is fixed  Randomization is possible. All networks considered Scanner doesn’t spoof source address during scanning Increase Network size and decrease response ratio Run AMPPOT in “proxy” mode Better approach  IP traceback (marking packets) Ignore Networks provided by ISP that prevent spoofing Extend method to further validate scan infrastructures before mapping

Thankyou for listening