1. Disruption Baseline, Monitor, Detect, Analyze, Respond, & Recover
Hervey Allen
Chris Evans
Phil Regnauld
September 3 – 4, 2009
Santiago, Chile

2. Overview Disruption Hands-on Cyber Attack
Concepts, Examples, Motivations
Hands-on Cyber Attack
Concept
Establishing a Baseline
Demonstration of the Attack
Monitoring & Detection
Analyzing the Attack
Response & Recovery
Enacting Mitigation Actions
Router Re-config
DoS via DNS Queries

3. Disruption
Disruption is the act of denying, degrading, or otherwise limiting the availability of services provided by a system or application

4. Disruption Some Examples:
Network Denial of Service – using the network protocols against themselves to saturate or overwhelm services or the links required to access them (e.g. SYN flood, DNS query flood)
Hardware Denial of Service – making a change to the hardware which prevents the device from operating correctly (e.g. BIOS flashing)
Service Reconfiguration – changing configurations or operating requirements such that the service, application or system no longer functions as intended (e.g. changing sshd_config to an unexpected port, disabling Windows services, overwriting system boot files)

5. Disruption
Disruption can be done without any access to the systems affected
DoS, DDoS, Traffic Floods, Amplification Attacks, …
Disruption is also possible (and easier) with access to the system
Rebooting hosts, router configuration changes, …

6. Disruption
Network disruption attacks are a battle between attacker’s and defender’s provisioning capabilities.
The one with more bandwidth, servers, capability, etc wins.
They are typically done with BotNets since they offer an easy method of provisioning more than the defender can muster
They take many, many forms – bandwidth saturation, malformed packets, server overload, etc

7. A Brief Aside – BotNets
BotNet – “A collection of software robots, or bots, which run autonomously and automatically”
Compromised Hosts (Zombies) are Centrally Controlled by a Single Entity (a Bot Herder)
Typically Used for Malicious Purposes
DDoS, spam, Non-attribution Attacks
Simply said, a BotNet is a bunch of hosts which are controlled by a malicious entity. These hosts can be used for a variety of activities, but most commonly, are used for distributed denial of service attacks. Its important to note that BotNets present a method for an attacker to mask his identity (non-attribution) as the attack appear to be coming from hosts not related to the attacker.

8. A Brief Aside – BotNets Bot Herder Establishes a Presence
Step 1 – The Bot Herder (BotNet controller) decides he is going to setup a BotNet.
Bot Herder Establishes a Presence

9. A Brief Aside – BotNets Bot Herder Creates a Delivery System
Step 2 – the Bot Herder establishes a server somewhere on the internet that is capable of delivering the BotNet software. This server can be used to deliver exploits, updates, host malicious webpages, etc.
Bot Herder Creates a Delivery System
- Delivers “BotNet” Payload to Hosts

10. A Brief Aside – BotNets Bot Herder Creates DNS Control Server
Step 3 – the Bot Herder establishes a command and control server for controlling the operation of the hosts in the BotNet. This server can use any protocol, and most often, they use IRC. For this example, we say the server uses DNS, but the protocol is entirely arbitrary. The selection of a protocol for BotNet control depends on the needs of the Bot Herder (i.e. IRC because its easily programmed, HTTP because it appears like normal web traffic, DNS because its guaranteed to be allowed through a firewall, etc)
Bot Herder Creates DNS Control Server
Issues Commands to Bots
Receives Data From Bots

11. A Brief Aside – BotNets Bot Herder Identifies Candidate Hosts
Step 4 – the Bot Herder identifies hosts to be added to the BotNet. This can be done through vulnerability scanning, social engineering s, etc.
In this example, we chose to use a socially engineering which results in a host downloading the BotNet software from the delivery server. The host runs this software, which turns the host into a “zombie” as it joins the BotNet.
Bot Herder Identifies Candidate Hosts
Sends Baited to Hosts
Hosts Download Bot Malware from Server
Hosts Become Zombies

12. A Brief Aside – BotNets Bot Herder Identifies Target01 01 01
Step 5 – Using his new zombies, the Bot Herder decides to launch an attack.
Controlling his zombies through the control server, he instructs the zombies to perform port scans looking for a target
The zombies scan and report back the results through the control server 01
Bot Herder Identifies Target
Issues Command via Control Server
Zombies Receive Command from Server
Zombies Locate Target
Zombies Report Back to Server

13. A Brief Aside – BotNets Bot Herder Launches Attack at Target01 01 01
Step 6 – having identified a target for a DDoS, the BotHerder starts his attack
Using the control server again, he instructs the zombies to attack the target (SYN Floods, pings, web requests, DNS resolutions, etc).
The zombies continue to attack the target until they are blocked or the BotHerder issues a stop command through the control server 01
Bot Herder Launches Attack at Target
Issues Command via Control Server
Zombies Attack Target
Bot Herder Issues Stop Command

14. Disruption
Hardware disruption attacks can be done remotely, but are easier to pull off with physical access
Ease of system administration = vectors for attack
Some hardware manufacturers allow remote flashing of system BIOS
Physical access = complete control
Don’t forget the obvious hammer to the PC trick

15. Disruption
Service reconfiguration attacks can be done remotely or locally, but almost always require some sort of access (recall privilege escalation)
Overwrite boot files
Delete critical OS files
Modify or create a hosts file
Modify application configuration files
Stop or disable MS Windows services
System administration tasks can turn into service reconfiguration attacks in the blink of an eye
This could be malicious or accidental!

16. Disruption Why are these attacks important to you?
They keep you from offering services to your customers
Potentially tarnish your reputation as a service provider
These attacks may coincide with other attacks
The “loudest” attack usually receives administrator attention
Be sure to watch the bigger picture - this may be a smoke screen
These attacks will definitely affect your network
The intent of the attack is to disrupt your operations

17. - Router Re-Configuration -
Disruption
Cyber Attack
- Router Re-Configuration -

18. Disruption Cyber Attack – Router Re-Config
Your routers perform a critical service to your operation
If they don’t work – you can’t provide service to your customers
We will assume that you have a malicious user (an administrator) operating on the inside of your network who wants to disrupt the gateway router
They have the credentials to conduct this attack

19. Disruption Cyber Attack – Router Re-Config
Malicious actors might target your gateway routers:
Because they are central points in the network
Affecting one usually has broader effects
Why?
The obvious one: deny service
Political statements
Demonstrations of “power”
Cyber “Riot”

20. Disruption Cyber Attack – Router Re-Config
The components needed for this attack
Target IP address, credentials

21. Disruption Cyber Attack – Router Re-Config
Recall Our Secure Operations Framework
Monitor
Detect
Respond
Recover
Analyze
Baseline

22. Disruption Cyber Attack – Router Re-Config
Establish a Baseline for What’s Normal for Your Network:
What are your current router configurations?
Are your external links up? (silly question – but you may have authorized outages from your provider)
Do you see fluctuations in your links over time? (e.g. poor service quality, satellite link outages, rainstorms, etc)
Use this baseline to compare what you currently see to what you expect
The key is expectation, if you aren’t expecting it, analyze it!

23. Disruption Cyber Attack – Router Re-Config
Attack Demonstration

24. Disruption Cyber Attack – Router Re-Config
Monitoring & Detection
External Service Availability
Router Configuration Monitoring
CVS
RANCID

25. Disruption Cyber Attack – Router Re-Config
Monitoring & Detection
Configure your network to monitor service availability and router configuration changes
Monitor your detection tool(s)
Establish a Baseline
EX:
Detecting Changes with SWATCH
EX:
Configuring RANCID

26. Disruption Cyber Attack – Router Re-Config
Attack Demonstration
(This time you can see how your network views the attack)

27. Disruption Cyber Attack – Router Re-Config
Analysis - what did your detection tools report? Is this really an attack?
External service availability
Router configuration changes
Where is the attack coming from?
Was your external service availability affected?

28. Disruption Cyber Attack – Router Re-Config
Response Actions
aka “I’m Under Attack – What Do I Do Now?!”
Prioritize – is anything else happening?
Reload configuration from known good copy
The actions you take:
Should focus on restoring service – punish the guilty afterwards!

29. Disruption Cyber Attack – Router Re-Config
BUT WAIT – Dr. Evil has changed your router again – what has he done??
Attack Demonstration

30. Disruption Cyber Attack – Router Re-Config
Analysis - what did your detection tools report?
External service availability
Router configuration changes
Where is the attack coming from?
Was your external service availability affected?
Are there other indications of what occurred?
Multi-Source Analysis – what else occurred about the same time as the configuration change?

31. Disruption Cyber Attack – Router Re-Config
Response Actions
aka “I’m Under Attack – What Do I Do Now?!”
Prioritize – is anything else happening?
Reload configuration from known good copy
Make changes by hand?!

32. Disruption Cyber Attack – Router Re-Config
Recovery Actions
The attack is over – how do I prevent this again?
Ask yourself “What _could_ have happened here?”
Use your analysis tools to determine where attack originated from and who may have done it
Consider use of a management VLAN or otherwise restrict infrastructure administration to certain IPs
Setup automatic alerts for service availability and configuration changes

33. Disruption Cyber Attack – Router Re-Config
What Other Mitigation Steps Would You Take?
What is appropriate for your network & resources?
DISCUSSIONS

34. Disruption Cyber Attack – Router Re-Config
Attack Discussion
Everyone hopes their employees are trustworthy – but history tells us otherwise
Other Thoughts Before We Move On?
Trust But Verify

35. Disruption Cyber Attack - DoS via DNS Queries -
Full Disclosure – we do not (yet) have traffic generation capabilities to saturate all 8 student group 100 Mbps links – so we will throttle your upstream router connections to demonstrate this attack
Your backchannel connection will not be affected by the throttling (or the DoS) so you should be able to see the attack as it happens

36. Disruption Cyber Attack – DoS via DNS
Your authoritative DNS servers are open to the world and remotely accessible
They _have_ to be, otherwise, what’s the point?
We will generate large numbers of DNS queries to saturate your upstream link
Note that we are NOT targeting your DNS server!
The effect is that external users will not be able to resolve DNS queries to your domain

37. Disruption Cyber Attack – DoS via DNS
Malicious actors might target your DNS servers:
Because they are remotely accessible
You are guaranteed to have them
DNS queries are easy to generate
Why?
The obvious one: deny service
Political statements
Demonstrations of “power”
Cyber “Riot”

38. Disruption Cyber Attack – DoS via DNS
The components needed for this attack
Target IP address, DNS query generation

39. Disruption Cyber Attack – DoS via DNS
Recall Our Secure Operations Framework
Monitor
Detect
Respond
Recover
Analyze
Baseline

40. Disruption Cyber Attack – DoS via DNS
Establish a Baseline for What’s Normal for Your Network:
What is your current bandwidth?
How much of your bandwidth is normally in use?
How many queries do you normally see?
Do you see fluctuations over time? (e.g. more queries in the morning than in the evening)
Use this baseline to compare what you currently see to what you expect
A spike in queries might indicate undue “interest” in you!
You don’t want your first indication of an attack to be a customer calling you!

41. Disruption Cyber Attack – DoS via DNS
Attack Demonstration

42. Disruption Cyber Attack – DoS via DNS
Monitoring & Detection
Bandwidth Monitoring Tools
External Service Availability
Smoke
Ping
Net
Flow

43. Disruption Cyber Attack – DoS via DNS
Monitoring & Detection
Configure your network to monitor bandwidth and DNS queries
Monitor your detection tool(s)
Establish a Baseline
EX:
Configuring NFSen

44. Disruption Cyber Attack – DoS via DNS
Attack Demonstration
(This time you can see how your network views the attack)

45. Disruption Cyber Attack – DoS via DNS
Analysis - what did your detection tools report? Is this really an attack?
Bandwidth Usage
Queries per second
Where is the attack coming from?
Was your external service availability affected?

46. Disruption Cyber Attack – DoS via DNS
Response Actions
aka “I’m Under Attack – What Do I Do Now?!”
Prioritize – is anything else happening?
Filter at your gateways based on the attack traffic
Contact your upstream providers to filter
Provision more services (bandwidth, secondaries, etc)
The actions you take:
Should focus on restoring service to your customers
Depend on the extent of attack and where its originating from
Depend on your connectivity and where your customers are located
Recall establishing an architecture baseline – you don’t want to figure our where your links are while you are being attacked
You may determine that you can mitigate the attack by closing your servers to queries from outside your country – your in-country customers are OK

47. Disruption Cyber Attack – DoS via DNS
Recovery Actions
The attack is over – how do I prevent this again?
Ask yourself “What _could_ have happened here?”
Provision additional bandwidth over separate links
Provision geographically separated secondaries
Anycasting
Mutual Aid Agreements with other ccTLDs
Response procedures for contacting upstream providers
Procedures for determining customer priority

48. Disruption Cyber Attack – DoS via DNS
What Other Mitigation Steps Would You Take?
What is appropriate for your network & resources?
DISCUSSIONS

49. Disruption Cyber Attack – DoS via DNS
Attack Discussion
DoS attacks can take many forms; effective monitoring is the only way to detect them
External service monitoring (e.g. what does your network look like from the outside) can help too!
Other Thoughts Before We Move On?

50. ? Questions? Do you have any questions about … Disruption Attacks
Detecting This Type of Attack
Responding & Recovering From This Type of Attack ?