DoS/DDoS attack and defense Nguyen Tien Thanh

Outline Countermeasures to DoS/DDoS Tools for DoS/DDoS Denial of Service attack Introduction Impact of DoS attack DoS attack types (ping flood, UDP flood, buffer overflow, ping of death, teardrop, SYN flood) Distributed Denial of Service attack Handler-Agent model IRC based model Countermeasures to DoS/DDoS Tools for DoS/DDoS

DoS Introduction Denial of Service attack is an attack which can render a system service slow or unusable for legitimate users, by consuming system resources

DoS Impact of DoS attack Financial loss Reputation damage Disabled network Disabled organization

DoS attack types Smurf attack (ping flood) The attacker generates a large amount of ICMP echo (ping) traffic to the network broadcast address with a spoofed source IP address of the victim The result will be a lot of ping replies flooding the victim host, severely impact the victim’s network connection

DoS attack types Fraggle attack (UDP flood) The attacker sends UDP packets to the random ports on the victim host. The victim will check for application listening on the port and reply with the “ICMP destination unreachable” packet The attacker can spoof the IP address of the UDP packets so that no one can trace back

DoS attack types Buffer overflow Buffer overflow occurs when a program writes data into the buffer and overruns the buffer boundary, overwrites the adjacent memory location. The attacker can use this to crash the victim machine

DoS attack types Ping of death The IP protocol allows the maximum IP packet size of 65,535 bytes. The attacker sends an IP packet larger than that. The fragmentation allows IP packets to be divided into smaller fragments The fragments can be combined up to more than the allowed size. The Operating system cannot handle the oversized packet and crash.

DoS attack types Teardrop attack The fragmentation allows IP packets to be divided into smaller fragments The attacker puts the confusing offset value into the second or later fragment The target machine cannot reassemble the packets and crash

DoS attack types SYN flooding SYN flooding exploits a flaw in TCP three-way handshake

DoS attack types SYN flooding (cont.) When a host receives the SYN request it must keep track of the partially opened connection in a "listen queue“ for at least 75 seconds The attacker can fill up the listen queue by sending multiple SYN requests to the host, but never reply to the SYN&ACK

DDoS Introduction (video) Distributed Denial of Service attack is carried out by using multiple compromised systems to attack a target to deny the service to the legitimate users The service under attack is the “primary victim,” while the compromised systems used to launch the attack are often called the “secondary victims” The sheer volume of sources involved in DDoS attacks make it nearly impossible to stop

DDoS Handler-Agent model

DDoS DDoS IRC based model

DoS/DDoS Countermeasures Smurf attacks (ping flood) Disable IP-directed broadcasts at routers. Most of the time, this function is not needed (defend against outside attack) Configure your operating system to prevent the machine from responding to ICMP packets sent to IP broadcast addresses (defend against inside attack) Fraggle attack (UDP flood) Disable UDP echo UDP is not very important, the negative impact is low.

DoS/DDoS Countermeasures (cont.) Buffer Overflow attack Operating system and software vendors often employ countermeasures in their products to prevent Buffer Overflow Attacks; particularly call stack and virtual memory randomization. Buffer Overflow Attacks have been rendered more difficult, although still possible to carry out. Ping of death does not affect modern Operating Systems Teardrop attack does not affect modern Operating Systems

DoS/DDoS Countermeasures (cont.) SYN flooding attack prevention: using firewall/proxy The firewall spoofs the ACK to prevent the listener TCB (transmission control block) from staying in the SYN-RECEIVED state, and thus maintains free space in the backlog. The firewall waits for sometime. If a legitimate ACK from the initiator is not observed, then it can signal the listener to free the TCB using a spoofed TCP RST segment. For legitimate connections, packet flow can continue, with no interference from the firewall/ proxy

DoS/DDoS Countermeasures (cont.) SYN flood attack countermeasure: Packet Exchanges through an ACK-spoofing Firewall/Proxy.

DoS/DDoS Countermeasures (cont.) There is no absolute solution to prevent DDoS, we only try to reduce the impact of the attack DoS countermeasures can be used also Based on the Handler-Agent model, we deduce the countermeasures in 3 components Prevent secondary victim; detect and neutralize handlers Detect and mitigate the attack Post-attack forensic

Improve awareness of internet users Install antivirus software DoS/DDoS Countermeasures (cont.) Prevent secondary victim; detect and neutralize handlers Improve awareness of internet users Install antivirus software Detect and neutralize handlers Study the communication protocol and traffic pattern between handlers and agents to locate the handler Handler-agent model suffers from single point of failure

DoS/DDoS Countermeasures (cont.) Detect and mitigate the attack Scan packets’ IP addresses when they leave the network. The spoofed source address of DDoS attack packets will not represent the valid source address of the specific network Load balancing: Increase bandwidth to prevent connection going down when under attack Balancing the load to each server in multi-server architecture Honeypot: Systems that are set up with low security act as a lure for an attacker Used to learn the attacker’s activities

DoS/DDoS Countermeasures (cont.) Post-attack forensics Analyze data to find specific pattern of the attacking traffic. This can help network admin to develop new filtering techniques Packet traceback: Can help identify the attacker Event logs: It keeps logs of DDoS attack information to do a forensic analysis

Tools for DoS/DDoS http://resources.infosecinstitute.com/dos-attacks-free-dos-attacking-tools/

References Certified Ethical Hacker ver.6 module 14 Denial of Service Tools for DoS and DDoS. Retrieved 1-Nov-2015 http://resources.infosecinstitute.com/dos-attacks-free-dos-attacking-tools/ DDoSpedia. Retrieved 1-Nov-2015 http://security.radware.com/knowledge-center/DDoSPedia Smurf attack prevention. Retrieved 1-Nov-2015 http://www.cert.org/historical/advisories/CA-1998-01.cfm SYN flood attack prevention. Retrieved 1-Nov-2015 http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_9-4/syn_flooding_attacks.html Video. Retrieved 1-Nov-2015 https://www.youtube.com/watch?v=OhA9PAfkJ10