Distributed Denial of Service Attacks

Август 7, 2022

Главная
Разное
Distributed Denial of Service Attacks

Содержание

2. What Are DDoS Tools? Clog victim’s network. Use many sources (“daemons”) for attacking traffic. Use “master”
3. How They Work Victim Daemon Daemon Daemon Daemon Daemon Master Real Attacker
4. How They Talk Trinoo: attacker uses TCP; masters and daemons use UDP; password authentication. TFN: attacker
5. Deploying DDOS Attackers seem to use standard, well-known holes (i.e., rpc.ttdbserver, amd, rpc.cmsd, rpc.mountd, rpc.statd). They
6. Detecting DDOS Tools Most current IDS’s detect the current generation of tools. They work by looking
7. What are the Strong Defenses? There aren’t any…
8. What Can ISPs Do? Deploy source address anti-spoof filters (very important!). Turn off directed broadcasts. Develop
9. Traffic Volume Monitoring Look for too much traffic to a particular destination. Learn to look for
10. Can We Do Better Some Day? ICMP Traceback message. Enhance newer congestion control techniques, i.e., RED.
11. ICMP Traceback For a very few packets (about 1 in 20,000), each router will send the
12. Enhanced Congestion Control Define an attack as “too many packets drops on a particular access line”.
14. Скачать презентацию

Слайд 2

What Are DDoS Tools?
Clog victim’s network.
Use many sources (“daemons”) for attacking

traffic.
Use “master” machines to control the daemon attackers.
At least 4 different versions in use: TFN, TFN2K, Trinoo, Stacheldraht.

Слайд 3

How They Work
Victim
Daemon
Daemon
Daemon
Daemon
Daemon
Master
Real Attacker

Слайд 4

How They Talk
Trinoo: attacker uses TCP; masters and daemons use UDP;

password authentication.
TFN: attacker uses shell to invoke master; masters and daemons use ICMP ECHOREPLY.
Stacheldraht: attacker uses encrypted TCP connection to master; masters and daemons use TCP and ICMP ECHO REPLY; rcp used for auto-update.

Слайд 5

Deploying DDOS
Attackers seem to use standard, well-known holes (i.e., rpc.ttdbserver, amd,

rpc.cmsd, rpc.mountd, rpc.statd).
They appear to have “auto-hack” tools – point, click, and invade.
Lesson: practice good computer hygiene.

Слайд 6

Detecting DDOS Tools
Most current IDS’s detect the current generation of tools.
They

work by looking for DDOS control messages.
Naturally, these will change over time; in particular, more such messages will be properly encrypted. (A hacker PKI?)

Слайд 7

What are the Strong Defenses?
There aren’t any…

Слайд 8

What Can ISPs Do?
Deploy source address anti-spoof filters (very important!).
Turn off

directed broadcasts.
Develop security relationships with neighbor ISPs.
Set up mechanism for handling customer security complaints.
Develop traffic volume monitoring techniques.

Слайд 9

Traffic Volume Monitoring
Look for too much traffic to a particular destination.
Learn

to look for traffic to that destination at your border routers (access routers, peers, exchange points, etc.).
Can we automate the tools – too many queue drops on an access router will trigger source detection?

Слайд 10

Can We Do Better Some Day?
ICMP Traceback message.
Enhance newer congestion control

techniques, i.e., RED.
Warning – both of these are untested ideas. The second is a research topic.

Слайд 11

ICMP Traceback
For a very few packets (about 1 in 20,000), each

router will send the destination a new ICMP message indicating the previous hop for that packet.
Net traffic increase at endpoint is about .1% -- probably acceptable.
Issues: authentication, loss of traceback packets, load on routers.

Слайд 12

Enhanced Congestion Control
Define an attack as “too many packets drops on

a particular access line”.
Send upstream node a message telling it to drop more packets for this destination.
Traditional RED+penalty box works on flows; this works on destination alone.
Issues: authentication, fairness, effect on legitimate traffic, implementability, etc.

Distributed Denial of Service Attacks

Содержание

What Are DDoS Tools?Clog victim’s network.Use many sources (“daemons”) for attacking

How They WorkVictimDaemonDaemonDaemonDaemonDaemonMasterReal Attacker

How They TalkTrinoo: attacker uses TCP; masters and daemons use UDP;

Deploying DDOSAttackers seem to use standard, well-known holes (i.e., rpc.ttdbserver, amd,

Detecting DDOS ToolsMost current IDS’s detect the current generation of tools.They

What are the Strong Defenses?There aren’t any…

What Can ISPs Do?Deploy source address anti-spoof filters (very important!).Turn off

Traffic Volume MonitoringLook for too much traffic to a particular destination.Learn

Can We Do Better Some Day?ICMP Traceback message.Enhance newer congestion control

ICMP TracebackFor a very few packets (about 1 in 20,000), each

Enhanced Congestion ControlDefine an attack as “too many packets drops on

Похожие презентации