Upload File

three generations of dos - def con€¦ · •primitive ddos attack, controlled via irc •sends...

  • Home
  • Documents
  • Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
63
Three Generations of DoS Attacks (with Audience Participation, as Victims) Defcon, 2011

Upload: others

Post on 07-Aug-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Three Generations of DoS Attacks

(with Audience Participation, as Victims)

Defcon, 2011

Page 2: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Bio

Page 3: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Summary

• The DoS Circus

• Layer 4 DDoS: Thousands of attackers

bring down one site

• Layer 7 DoS: One attacker brings

down one site

• Link-Local DoS: IPv6 RA Attack: One

attacker brings down a whole network

Page 4: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

The DoS Circus

Characters

Page 5: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Wikileaks

• Published <1000 US Gov't diplomatic cables from a leak of 250,000

• Distributed an encrypted "Insurance" file by BitTorrent • Widely assumed to contain the complete,

uncensored leaked data • Encrypted with AES-256--no one is ever getting in

there without the key • Key to be released if Assange is jailed or killed,

but he is in UK now resisting extradition to Sweden and the key has not been released

Page 6: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Anonymous

Page 7: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Operation Payback

• 4chan's Anonymous group

• Attacked Scientology websites in 2008

• Attacked the RIAA and other copyright defenders

• Using the Low Orbit Ion Cannon with HiveMind (DDoS)

• "Opt-in Botnet"

Page 8: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

HB Gary Federal

• Aaron Barr • Developed a questionable

way to track people down online

• By correlating Twitter, Facebook, and other postings

• Announced in Financial Times that he had located the “leaders” of Anonymous and would reveal them in a few days

Page 9: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
Page 10: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Social Engineering & SQLi

• http://tinyurl.com/4gesrcj

Page 11: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Leaked HB Gary Emails

• For Bank of America

– Discredit Wikileaks

– Intimidate Journalist Glenn Greenwald

• For the Chamber of Commerce

– Discredit the watchdog group US Chamber

Watch

– Using fake social media accounts

• For the US Air Force

• Spread propaganda with fake accounts

• http://tinyurl.com/4anofw8

Page 12: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Drupal Exploit

Page 13: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Th3j35t3r

• "Hacktivist for Good"

• Claims to be ex-military

• Originally performed DoS attacks on Jihadist sites

• Bringing them down for brief periods, such as 30 minutes

• Announces his attacks on Twitter, discusses them on a blog and live on irc.2600.net

Page 14: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Jester's Tweets from Dec 2010

Page 15: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Th3j35t3r v. Wikileaks

• He brought down Wikileaks single-handed

for more than a day

– I was chatting with him in IRC while he

did it, and he proved it was him by

briefly pausing the attack

Page 16: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Wikileaks Outage

• One attacker, no botnet

Page 17: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Th3j35t3r

• After his Wikileaks attack

• He battled Anonymous

• He claims to have trojaned a tool the Anons downloaded

• He claims to pwn Anon insiders now

Page 18: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Jester's Tweets

Page 19: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Westboro Baptist Outage

• 4 sites held down for 8 weeks

• From a single 3G cell phone – http://tinyurl.com/4vggluu

Page 20: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

LulzSec

• The skilled group of Anons who hacked H B Gary Federal

• Hacked

– US Senate

– Pron.com

– Sony

– FBI

– PBS

– Fox News

Page 21: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
Page 22: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
Page 23: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

LulzSec Attacks on Government Sites

• FBI, CIA, US Senate

• UK's National Health Service

• SOCA, the UK's Serious Organised Crime Agency taken down 6-20-2011

Page 24: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
Page 25: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Two Factor Authentication

• First factor: what user knows

• Second factor: what user has

– Password token

– USB key

– Digital certificate

– Smart card

• Without the second factor, user

cannot log in

– Defeats password guessing / cracking

Page 26: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

RSA was Hacked, and their Customers Too

• http://samsclass.info/RSA-alternatives.html

Page 27: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
Page 28: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Layer 4 DDoS Many Attackers – One Target

Bandwidth Consumption

Page 29: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Companies that Refused Service to Wikileaks

• Amazon

• Paypal

• Mastercard

• Visa

• Many others

Page 30: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Low Orbit Ion Cannon

• Primitive DDoS Attack, controlled via IRC

• Sends thousands of packets per second from the attacker directly to the target

• Like throwing a brick through a window

• Takes thousands of participants to bring down a large site

• They tried but failed to bring down Amazon

Page 31: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Low Orbit Ion Cannon

Page 32: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Operation Payback v. Mastercard

• Brought down Visa, Mastercard, and many

other sites

– Easily tracked, and easily blocked

– High bandwidth, cannot be run through

anonymizer

– Dutch police have already arrested two

participants

Page 33: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Mastercard Outage

3,000 to 30,000 attackers working together

Page 34: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing
Page 35: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Layer 7 DoS

One Attacker – One Target

Exhausts Server Resources

Page 36: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Layer 7 DoS

• Subtle, concealable attack

• Can be routed through proxies

• Low bandwidth

• Can be very difficult to distinguish from

normal traffic

Page 37: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

HTTP GET

Page 38: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

SlowLoris • Send incomplete GET

requests

• Freezes Apache with one packet per second

Page 39: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

R-U-Dead-Yet

• Incomplete HTTP POSTs

• Stops IIS, but requires thousands of

packets per second

Page 40: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Keep-Alive DoS

• HTTP Keep-Alive allows 100 requests in a

single connection

• HEAD method saves resources on the

attacker

• Target a page that is expensive for the server

to create, like a search

– http://www.esrun.co.uk/blog/keep-alive-dos-script/

• A php script

– pkp keep-dead.php

Page 41: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

keep-dead

Page 42: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

XerXes

• Th3j35t3r's DoS Tool

• Routed through proxies like Tor to hide the attacker's origin

• No one knows exactly what it does

• Layer 7 DoS?

Page 43: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

XerXes

Page 44: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Link-Local DoS

IPv6 Router Advertisements

Page 45: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

IPv4: DHCP

PULL process

Client requests an IP

Router provides one

Host

Router

I need an IP

Use this IP

Page 46: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

IPv6: Router Advertisements

PUSH process

Router announces its presence

Every client on the LAN creates an address and joins the network

Host

Router

JOIN MY NETWORK

Yes, SIR

Page 47: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Router Advertisement Packet

Page 48: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

RA Flood

Page 49: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Windows Vulnerability

• It takes a LOT of CPU for Windows to process

those Router Advertisements

• 5 packets per second drives the CPU to 100%

• And they are sent to every machine in the LAN

(ff02::1 is Link-Local All Nodes Multicast)

• One attacker kills all the Windows machines on

a LAN

• FreeBSD is also vulnerable!

– But not OpenBSD, of course

Page 50: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Responsible Disclosure

• Microsoft was alerted by Marc Heuse on July 10, 2010

• Microsoft does not plan to patch this

• Juniper and Cisco devices are also vulnerable

• Cisco has released a patch, Juniper has not

Page 51: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Defenses from RA Floods

• Disable IPv6

• Turn off Router Discovery

• Block rogue RAs with a firewall

• Get a switch with RA Guard

Page 52: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

RA Guard Evasion

• Add "Fragmentation Headers" to the RA Packets

– http://samsclass.info/ipv6/proj/RA-evasion.html

Page 53: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Fragmentation Headers

Page 54: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Defending Websites

Page 55: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Attack > Defense

• Right now, your website is only up

because

– Not even one person hates you, or

– All the people that hate you are ignorant

about network security

Page 56: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Defense

• Mod Security--free open-source defense tool

• Latest version has some protections against Layer 7 DoS

• Akamai has good defense solutions

• Caching

• DNS Redirection

• Javascript second-request trick

Page 57: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Load Balancer

Page 58: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

• Proxy servers

• Conceals your server's IP address

• Blocks attacks using information from other attacks

• Free version

• Effective against th3j35t3r in real combat

Page 59: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

Counterattacks

• Reflecting attacks back to the command &

control server

• Effective against dumb attackers like

Anonymous' LOIC

– Will lose effect if they ever learn about

Layer 7 DoS, which is happening now

Page 60: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

References

Page 61: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

References

Anonymous Takes Down U.S. Chamber Of Commerce And Supporter Websites http://goo.gl/Mue9k

Slowloris HTTP DoS http://ha.ckers.org/slowloris/

OWASP HTTP DoS Tool http://code.google.com/p/owasp-dos-http-post/

Mitigating Slow HTTP DoS Attacks http://blog.spiderlabs.com/2010/11/advanced-topic-of-the-week-mitigating-slow-http-dos-attacks.html

‘Tis the Season of DDoS – WikiLeaks Edition (Outage charts) http://goo.gl/V5jZc

Page 62: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

References ModSecurity http://goo.gl/56hbl

Akamai DDoS Report http://baythreat.org/MichaelSmith_DDoS.pdf

How Secure Is Julian Assange's "Thermonuclear" Insurance File? http://goo.gl/sY6Nn

Overview of Anonymous and their attack on MasterCard: http://goo.gl/lVsCD

Operation Payback Toolkit: LOIC and HiveMind http://pastehtml.com/view/1c8i33u.html

Page 63: Three Generations of DoS - DEF CON€¦ · •Primitive DDoS Attack, controlled via IRC •Sends thousands of packets per second from the attacker directly to the target •Like throwing

References r-u-dead-yet http://code.google.com/p/r-u-dead-yet/

Keep-Alive DoS Script http://www.esrun.co.uk/blog/keep-alive-dos-script/

Router Advertisement DoS in Windows http://samsclass.info/ipv6/proj/flood-router6a.htm

RA Guard Evasion http://samsclass.info/ipv6/proj/RA-evasion.html

XerXes Attack Video http://goo.gl/j8NQE


Throwing Manual

Sketching it out throwing techniques€¦ · Three Great Pottery Throwing Techniques Tips on Throwing Complex Pottery Forms Using Basic Throwing Skills Full of great throwing tips,

Throwing Events

Defence Against Denial of Service in Self-Aware Networks · 1.1 DDoS: In a Distributed DoS attack (DDoS) the attacker compromises a few vulnerable computers (handlers) and through

Japanese Throwing Weapons Mastering Shuriken Throwing Techniques

1.Attacker targets workstations en masse 2.User running as local admin is compromised, attacker harvests credentials 3.Attacker uses credentials

IBM Cloud Academy Conference · Botnet A large number of bot-infected zombies. Under the control of an attacker (Bot master) Used to launch DDoS Send spam emails Stole users' banking

Evolving DDoS Threat and Standards Based Mitigation Techniques Evolving DDoS Thre… · Considerations For Determining Best DDoS Strategy DDoS protection strategy appropriate for

A Note on Analysing the Attacker Aims Behind DDoS Attacks · World Bank to study the aims behind DDoS attacks. They conclude that there is an ... We propose a hybrid strategy for

DDoS Threats Landscape : Countering Large-scale DDoS attacks

DDoS Threat Landscape - CHI-NOGchinog.org/.../2016/05/10.-DDoS-Threat-Landscape.pdf · DDoS Threat Landscape . DDoS Handbook • A history and overview of DDoS • Review of attack

AWS Best Practices for DDoS Resiliency - d0.awsstatic.com · Amazon Web Services – AWS Best Practices for DDoS Resiliency ... This can allow an attacker to spoof the ... an attacker

F5 Silverline DDoS Protection | F5 Product DatasheetLTM DNS ASM vCMP Physical Virtual LTM ASM DDoS Attacker DDoS Attacker Customer Partner DNS attacks: DNS amplification, query flood,

Throwing Phases

Throwing knives

DDoS hybrid protection - rsnog.rs · DDoS protection system –Hybrid solution •Telenor hybrid DDoS protection is based • Local netflow based DDoS protection segment • Cloud

Throwing Down

THROWING PROGRAM - Jeremy M. Burnham, MD … · 2 Complete Throwing Program Complete Throwing Program The Complete Throwing Program is a comprehensive, preventative, and systematic

Power Throwing

Prolexic DDoS Analytics & DDoS Mitigation In Real Time

Two Decades of DDoS Attacks and Defenses · attacker can exploit the controller-to-switch communication channel in SDN to launch a DoS attack [10, 22]. 2.2 DDoS Attack Taxonomy While

TURF AERATOR SPECIALISTSarchive.lib.msu.edu/tic/bigga/gki/page/1999apr61-70.pdf · E-mail: [email protected] GENESIS ATTACKER ATTACKER PVT Attacker has a unique positive

Mirai Botnet: How IoT Botnets Performed Massive DDoS ... · can be used to perform Distributed Denial Of Service Attack, steal data, send spam, allow the attacker access to ... harnessed

Evolution and Current State of DDoS Attacks · 2007-03-03 · DDoS via DNS Recursion + Process Attacker queries for a large, typically altered, DNS record Large response is sent to

Teaching Proper Throwing Mechanics. WSLL—Throwing Mechanics Importance of Teaching Proper Throwing Mechanics While Player is Young Throwing Muscle Memory

DDoS Protection Place For DDoS Attacks

Wheel Throwing

GAINING GROUND ON THE CYBER ATTACKER...using more sophisticated business models like ransomware-as-a-service and DDoS-for-Hire2 and monetizing these efforts through cryptocurrencies—security

Insider Attacker Detection

DDoS Testing Services - zencurity.com · DDoS Testing Services DOES YOUR BUSINESS HAVE AN OPTIMISED DDOS PROTECTION STRATEGY Our DDoS testing service exercises your infrastructure

Security Now! #653 - 03-06-18 “MemCrashed” DDoS Attacks · and between a user process and the kernel, can be created by the attacker in a controlled and robust manner. The collisions

(D)DOS DEMYSTIFIED - OARnet...DDoS Attack Customers DDoS Attack Volumetric Protection Cloud ISPa ISPb L3-4 DDoS mitigation DDoS Platform DDoS Platform L7 DDoS mitigation SSL Termination

Datasheet: DDoS Protection - Grayhats Datasheet DDoS...or OpenBSD vulnerabilities ... Datasheet: DDoS Protection DNS DDoS Protection ... DNS server. This protects your

Scalable DDoS mitigation · •Scalable DDoS Mitigation –BGP FlowSpec •Cloud DDoS Protection –F5 Silverline. DDoS Overview • Distributed denial-of‐service (DDoS) attacks

Throwing Athlete