Distributed Denial of Service Attacks

Slides:

Advertisements

Similar presentations

Module VIII Denial Of Service

Advertisements

A Brief History of Distributed Denial of Service Attacks Uniforum Chicago August 22, 2000 Viki Navratilova Security Architect, BlueMeteor, Inc.

Network and Application Attacks Contributed by- Chandra Prakash Suryawanshi CISSP, CEH, SANS-GSEC, CISA, ISO 27001LI, BS 25999LA, ERM (ISB) June 2006.

 Dynamic policies o Change as system security state/load changes o GAA architecture  Extended access control lists  Pre-, mid- and post-conditions,

Denial of Service & Session Hijacking.  Rendering a system unusable to those who deserve it  Consume bandwidth or disk space  Overwhelming amount of.

Distributed Denial-of-Services (DDoS) Ho Jeong AN CSE 525 – Adv. Networking Reading Group #8.

Overview of Distributed Denial of Service (DDoS) Wei Zhou.

Distributed Denial of Service Attacks: Characterization and Defense Will Lefevers CS522 UCCS.

Lecture slides prepared for “Computer Security: Principles and Practice”, 2/e, by William Stallings and Lawrie Brown, Chapter 7 “Denial-of-Service-Attacks”.

Computer Security Fundamentals by Chuck Easttom Chapter 4 Denial of Service Attacks.

Network-Based Denial of Service Attacks Trends, Descriptions, and How to Protect Your Network Craig A. Huegen Cisco Systems, Inc. NANOG 12 Interprovider.

Defensive Measures for DDoS By Farhan Mirza. Contents Survey Topics Survey Topics Introduction Introduction Common Target of DoS Attacks Common Target.

Computer Security and Penetration Testing

Distributed Denial of Service Attacks CMPT Distributed Denial of Service Attacks Darius Law.

Security Awareness: Applying Practical Security in Your World

UNCLASSIFIED Secure Indirect Routing and An Autonomous Enterprise Intrusion Defense System Applied to Mobile ad hoc Networks J. Leland Langston, Raytheon.

DDoS Attack Prevention by Rate Limiting and Filtering d’Artagnan de Anda CS239 Network Security 26 Apr 04.

Review for Exam 4 School of Business Eastern Illinois University © Abdou Illia, Fall 2006.

John Kristoff DePaul Security Forum Network Defenses to Denial of Service Attacks John Kristoff

Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 7: Denial-of-Service Attacks.

Defending Against Flooding Based DoS Attacks : A tutorial - Rocky K.C. Chang, The Hong Kong Polytechnic University Presented by – Ashish Samant.

DDos Distributed Denial of Service Attacks by Mark Schuchter.

Lecture 15 Denial of Service Attacks

Chapter 9 Phase 3: Denial-of-Service Attacks. Fig 9.1 Denial-of-Service attack categories.

Denial of Service attacks. Types of DoS attacks Bandwidth consumption attackers have more bandwidth than victim, e.g T3 (45Mpbs) attacks T1 (1.544 Mbps).

Bandwidth DoS Attacks and Defenses Robert Morris Frans Kaashoek, Hari Balakrishnan, Students MIT LCS.

Denial of Service Attacks: Methods, Tools, and Defenses Authors: Milutinovic, Veljko, Savic, Milan, Milic, Bratislav,

DDoS Attack and Its Defense1 CSE 5473: Network Security Prof. Dong Xuan.

Lecture 22 Page 1 Advanced Network Security Other Types of DDoS Attacks Advanced Network Security Peter Reiher August, 2014.

1Federal Network Systems, LLC CIS Network Security Instructor Professor Mort Anvair Notice: Use and Disclosure of Data. Limited Data Rights. This proposal.

Week 8-1 Week 8: Denial of Service (DoS) What is Denial of Service Attack? –Any attack that causes a system to be unavailability. This is a violation of.

Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 8 – Denial of Service.

Being an Intermediary for Another Attack Prepared By : Muhammad Majali Supervised By : Dr. Lo’ai Tawalbeh New York Institute of Technology (winter 2007)

Overview Network communications exposes one to many different types of risks: No protection of the privacy, integrity, or authenticity of messages Traffic.

Network security Further protocols and issues. Protocols: recap There are a few main protocols that govern the internet: – Internet Protocol: IP – Transmission.

1 CHAPTER 3 CLASSES OF ATTACK. 2 Denial of Service (DoS) Takes place when availability to resource is intentionally blocked or degraded Takes place when.

Lecture 18 Page 1 Advanced Network Security Distributed Denial of Service Attacks Advanced Network Security Peter Reiher August, 2014.

1 Countering DoS Through Filtering Omar Bashir Communications Enabling Technologies

Distributed Denial of Service Attacks Shankar Saxena Veer Vivek Kaushik.

Lecture 22 Network Security CS 450/650 Fundamentals of Integrated Computer Security Slides are modified from Hesham El-Rewini.

Denial of Service Sharmistha Roy Adversarial challenges in Web Based Services.

Denial of Service Attacks Dr. John R. Durrett ISQS 6342 Spring 2003 Dipen Joshi.

1 SOS: Secure Overlay Services A. D. Keromytis V. Misra D. Runbenstein Columbia University.

Denial of Service Attacks

Chapter 7 Denial-of-Service Attacks Denial-of-Service (DoS) Attack The NIST Computer Security Incident Handling Guide defines a DoS attack as: “An action.

Denial of Service DoS attacks try to deny legimate users access to services, networks, systems or to other resources. There are DoS tools available, thus.

1 Defense Strategies for DDoS Attacks Steven M. Bellovin

________________ CS3235, Nov 2002 (Distributed) Denial of Service Relatively new development. –Feb 2000 saw attacks on Yahoo, buy.com, ebay, Amazon, CNN.

CSE715 Presentation Project Fall 2004 by Michael Alexandrou and Rusty Coleman.

Denial of Service Attacks: Methods, Tools, and Defenses Prof. Mort Anvari Strayer University at Arlington.

Computer Science and Engineering Computer System Security CSE 5339/7339 Session 25 November 16, 2004.

TCP Security Vulnerabilities Phil Cayton CSE

1 Distributed Denial of Service Attacks. Potential Damage of DDoS Attacks l The Problem: Massive distributed DoS attacks have the potential to severely.

Attacking on IPv6 W.lilakiatsakun Ref: ipv6-attack-defense-33904http://

DoS/DDoS attack and defense

SEMINAR ON IP SPOOFING. IP spoofing is the creation of IP packets using forged (spoofed) source IP address. In the April 1989, AT & T Bell a lab was among.

An Analysis of Using Reflectors for Distributed Denial-of- Service Attacks Paper by Vern Paxson.

1 Figure 4-11: Denial-of-Service (DoS) Attacks Introduction  Attack on availability  Act of vandalism Single-Message DoS Attacks  Crash a host with.

ITP 457 Network Security Networking Technologies III IP, Subnets & NAT.

Denail of Service(Dos) Attacks & Distributed Denial of Service(DDos) Attacks Chun-Chung Chen.

Denial-of-Service Attacks

Comparison of Network Attacks COSC 356 Kyler Rhoades.

Presentation on ip spoofing BY

Distributed Denial of Service Attacks

Error and Control Messages in the Internet Protocol

Defending Against DDoS

Network Security: DoS Attacks, Smurf Attack, & Worms

Distributed Denial of Service Attacks

DDoS Attack and Its Defense

Distributed Denial of Service Attacks

Presentation transcript:

Distributed Denial of Service Attacks Steven M. Bellovin smb@research.att.com http://www.research.att.com/~smb

What Are DDoS Tools? Clog victim’s network. Use many sources (“daemons”) for attacking traffic. Use “master” machines to control the daemon attackers. At least 4 different versions in use: TFN, TFN2K, Trinoo, Stacheldraht.

How They Work Daemon Master Daemon Daemon Daemon Daemon Real Attacker Victim

Agile Attackers Attack daemons implement many different types of DoS. “Smurf” – use directed broadcast to ask many remote machines to contact victim. “SYN Flood” – block access to given port number. UDP and ICMP flood – simply clog link.

Source-Address Spoofing Every Internet packet carries a return address. These tools use forged return addresses, partly to hide and (in one case) to trick other machines into attacking the victim. Attacks from legal source addresses are relatively easy to block.

How They Talk Trinoo: attacker uses TCP; masters and daemons use UDP; password authentication. TFN: attacker uses shell to invoke master; masters and daemons use ICMP ECHOREPLY. Stacheldraht: attacker uses encrypted TCP connection to master; masters and daemons use TCP and ICMP ECHO REPLY; rcp used for auto-update.

Deploying DDOS Attackers seem to use standard, well-known holes (i.e., rpc.ttdbserver, amd, rpc.cmsd, rpc.mountd, rpc.statd, etc.). They appear to have “auto-hack” tools – point, click, and invade. Optional step: erase the log files; hide program. Lesson: practice good computer hygiene.

Detecting DDOS Tools Most current intrusion detection systems notice the current generation of tools. They work by looking for DDOS control messages. Naturally, these will change over time; in particular, more such messages will be properly encrypted. (A hacker PKI?)

What are the Strong Defenses? There aren’t any…

What Can ISPs Do? Deploy source address anti-spoof filters (very important!). Turn off directed broadcasts. Develop security relationships with neighbor ISPs. Set up mechanism for handling customer security complaints. Develop traffic volume monitoring techniques.

Traffic Volume Monitoring Look for too much traffic to a particular destination. Learn to look for traffic to that destination at your border routers (access routers, peers, exchange points, etc.). Can we automate the tools – too many queue drops on an access router will trigger source detection?

Can We Do Better Some Day? ICMP Traceback message. Enhance newer congestion control techniques, i.e., RED. Warning – both of these are untested ideas. The second is a research topic.

ICMP Traceback For a very few packets (about 1 in 20,000), each router will send the destination a new ICMP message indicating the previous hop for that packet. Net traffic increase at endpoint is about .1% -- probably acceptable. Issues: authentication, loss of traceback packets, load on routers.

Enhanced Congestion Control Define an attack as “too many packets drops on a particular access line”. Send upstream node a message telling it to drop more packets for this destination. Traditional RED+penalty box works on flows; this works on destination alone. Issues: authentication, fairness, effect on legitimate traffic, implementability, etc.

References From CERT: CA-99-17, CA-2000-01, IN-99-07. http://www.cert.org/reports/dsit_workshop.pdf Dave Dittrich’s analyses: http://staff.washington.edu/dittrich/misc/trinoo.analysis http://staff.washington.edu/dittrich/misc/tfn.analysis http://staff.washington.edu/dittrich/misc/stacheldraht.analysis Scanning tool: http://www.fbi.gov/nipc/trinoo.htm IDS vendors, ICSA, etc.