1. An Analysis of Using Reflectors for Distributed Denial-of- Service Attacks Paper by Vern Paxson

2. DDOS

3. Traceback ITRACE (Bellovin) – uses ICMP messages from routers to trace path back to source. However, these ICMP packets occur with low probability, so a high volume flow is needed to trace back all the routers. SPIE (Snoeren) – Source Path Isolation Engine records sets of hashes of packets traversing a given router. Can trace path even on low volume flows.

4. Reflectors A reflector is any IP host that returns a packet if sent a packet. Examples: SYN  SYN/ACK, ICMP, etc… Lots of reflectors on the internet. Attacker can program slaves to use millions of them. Hard to block since packets come from an extremely diffuse base.

5. DDOS with Reflectors

6. Tracing when reflectors are used Easy for victim to ID reflectors since SRC IP is real. However, hard to trace back to slaves since reflectors are given victim’s IP as the source. Also involves cooperation from the reflector’s operator for analysis. Hard to use ITRACE since flow is low-volume for any given reflector (flow is diffused through many reflectors). Can use SPIE.

7. Defenses Against Reflectors Ingress filtering. Can block all incoming packets except from known good IPs. (Not useful for public/commercial sites.) Timing or pattern match filtering (possible). Software on reflector to allow victim to trace back to slave. (Not practical, difficult/impossible to deploy.)

8. Filtering Techniques Stateless, since attack creates too much bogus state. Filtering done at ISP end (or sufficiently far enough away from victim to keep bandwidth available).

9. Filtering IP Packets Can filter IP SRC/DST if “bad” reflectors are known. IP TOS/DSCP possible if attack traffic non- premium. Fragments – possible to throw these out unless victim needs them (NFS, AFS, GRE, etc...) Conclusion: Too few headers to make filtering at the IP level very useful.

10. Filtering ICMP Can filter out echo requests/replies. Can stop smurf attacks. Harder to suppress other ICMP messages since these are needed for tearing down state (host unreachable), traceroute (time exceeded).

11. Filtering TCP Can block source port 80 to block most DDOS attacks that use web servers as reflectors. Downside: won’t be able to connect to any external web servers. Block RST. Causes victim to keep more state than usual (may be acceptable tradeoff). Block SYN/ACK. Causes victim to lose all remote services (may be acceptable if all traffic is outgoing).

12. Filtering TCP cont. Any other TCP packet type means slave must establish a connection with the reflector, so SRC address cannot be forged (thus slave is easily traceable). UNLESS... Reflector’s TCP stack has guessable sequence numbers. Can use ACK splitting to amplify traffic.

13. Filtering TCP summary Can be effective if victim is willing to endure loss of contact to external servers and doesn’t mind maintaining more state than usual. However, this won’t work if attacker can find a large number of reflectors with poorly implemented TCP stacks (guessable TCP sequence numbers).

14. Filtering UDP Attackers can use DNS as a reflector (send forged DNS queries so that reply goes to victim). Countermeasure: block DNS except from a small set of servers. Use internal DNS servers. However, if victim is a DNS server for a particular zone, then attacker can submit queries of the form bogus.victim.com, which causes recursive queries back to victim. Countermeasure: none!

15. Using proxies Attacker can use proxies (ex: http proxy) as a reflector. This would be effective except that it requires a non-spoofed source address, so slaves can be identified.

16. Gnutella Attacker can mount proxy attack without being traced. Using Gnutella “push” directive, request can propagate through Gnutella network being separated from client (slave). Victim can trace back to Gnutella server. Operator of Gnutella server can trace back to immediate neighbor, etc... Conclusion: virtually impossible to trace the chain of Gnutella servers back to slave.

17. Summary Reflectors make DDOS attacks much more diffuse and harder to prevent. Can guard against some DDOS reflector attacks if victim is willing to forgo some services. TCP guessable sequence numbers, recursive DNS queries, and Gnutella “push” directive present major threats (no known defenses).