1. 1 Distributed Denial of Service Attacks

2. Potential Damage of DDoS Attacks l The Problem: Massive distributed DoS attacks have the potential to severely decrease backbone availability and can virtually detach a network from the Internet. 2

3. Motives for DDoS Attacks l Cyber warfare: Prevent information exchange l A means to blackmail a company or even country and cause image and money loss l Youthful mischief and desire to feel the power “to rule the world“ l Proof of technical excellence to “the world“ and oneself l Outbreak of worms from Internet security research ;-) l ?? 3

4. 4 What Are DDoS Tools? l Clog victim’s network. l Use many sources (“daemons”) for attacking traffic. l Use “master” machines to control the daemon attackers. l At least 4 different versions in use: TFN, TFN2K, Trinoo, Stacheldraht.

5. 5 How They Work Victim Daemon Master Real Attacker

6. 6 How They Talk l Trinoo: attacker uses TCP; masters and daemons use UDP; password authentication l TFN(Tribe Flood Network): attacker uses shell to invoke master; masters and daemons use ICMP ECHOREPLY, TCP SYN flood, ICMP Broadcast (smurf) l Stacheldraht: attacker uses encrypted TCP connection to master; masters and daemons use TCP and ICMP ECHO REPLY; rcp used for auto-update and generation

7. 7 Deploying DDOS l Attackers seem to use standard, well- known holes (i.e., rpc.ttdbserver, amd, rpc.cmsd, rpc.mountd, rpc.statd). – attacks on flaws of remote buffer overflows l They appear to have “auto-hack” tools – point, click, and invade. l Lesson: practice good computer hygiene.

8. 8 Detecting DDOS Tools l Most current IDS’s detect the current generation of tools. l They work by looking for DDoS control messages. l Naturally, these will change over time; in particular, more such messages will be properly encrypted. (A hacker PKI?)

9. 9 What Can ISPs Do? l Deploy source address anti-spoof filters (very important!). l Turn off directed broadcasts. l Develop security relationships with neighbor ISPs. l Set up mechanism for handling customer security complaints. l Develop traffic volume monitoring techniques.

10. 10 Traffic Volume Monitoring – an example l Look for too much traffic to a particular destination. l Learn to look for traffic to that destination at your border routers (access routers, peers, exchange points, etc.). l Can we automate the tools – too many queue drops on an access router will trigger source detection?

11. 11 References l http://www.cert.org/reports/dsit_workshop.pdf http://www.cert.org/reports/dsit_workshop.pdf l Dave Dittrich’s analyses: –http://staff.washington.edu/dittrich/misc/trinoo.analy sishttp://staff.washington.edu/dittrich/misc/trinoo.analy sis –http://staff.washington.edu/dittrich/misc/tfn.analysishttp://staff.washington.edu/dittrich/misc/tfn.analysis –http://staff.washington.edu/dittrich/misc/stacheldraht.analysishttp://staff.washington.edu/dittrich/misc/stacheldraht.analysis l Scanning tool: http://www.fbi.gov/nipc/trinoo.htm http://www.fbi.gov/nipc/trinoo.htm