Transcript FRANOG - frnog

Boaz Elgar Product Manager
November, 2002
1
Agenda
Some known DDoS attacks
Types of DDoS attacks
Current measures for blocking DDoS
Riverhead Solution overview
Confidential, © Riverhead Networks, Inc., 2002
2
Riverhead Profile
 Solution:
Secure internet availability against crippling
DDoS cyber-attacks
 Customers: Large enterprises, new media companies, service
providers and government organizations
 Investors:
 HQ:
Cupertino, California
 Products:
Riverhead Guard and Detector - infrastructure
security devices
Confidential, © Riverhead Networks, Inc., 2002
3
Overview of DDoS attacks
Confidential, © Riverhead Networks, Inc., 2002
4
DDoS Incidents Around The Globe
 Global
World Economic Forum's, CERT
 Europe
Deutsche Bank, Lufthansa, Firenet, Tiscali, edNET,
TheDogmaGroup, DonHost, British telecom, Cloud9
 US
Amazon, Yahoo, CNN, e-Bay, e-Trade, Microsoft, White
House NY Times, NASA, OZ.Net
 ROW
200 small corporations, 30 educational organizations
and 20 government systems (Korea),
St George Bank (Australia)
Confidential, © Riverhead Networks, Inc., 2002
5
Distributed Denial of Service
An Upstream Issue
Zombies on
innocent
computers
Infrastructure-level DDoS
attacks
Server-level DDoS attacks
Bandwidth-level DDoS
attacks
Confidential, © Riverhead Networks, Inc., 2002
6
Server-level DDoS attacks
DST SRC prtcl CRC Port Port SYN FIN SSL GET URL CGI www.victim.com….
Layer 4 attacks



SYN receive
Establish
FIN_WAIT_1
Confidential, © Riverhead Networks, Inc., 2002
Application layer attacks
404
File Not Found Flood
SSL
CGI
DNS
7
Bogus requests attack
TCP Level DDoS attacks
Confidential, © Riverhead Networks, Inc., 2002
8
TCP SYN flood
SYN RQST
server
SYN ACK
client
victim
zombie
Zombies
SYN ACK
Spoofed SYN RQST
• One of the first CERT DDoS advisories issued – 9/1996
• http://www.cert.org/advisories/CA-1996-21.html
Confidential, © Riverhead Networks, Inc., 2002
9
Waiting
buffer
overflows
TCP SYN Flood
News - February 3,2002
Firenet ISP Suffers DoS
Attack
Firenet MD Mr Castle also stated:
"The list of attacks were Syn Flood attacks, Ip Spoofing the Lan
interfaces, and Total Denial of service attacks. We had taken
down the servers for 4 nights in a row, from 11oclock till 6.00
am daily and worked all through the night with BT fighting this
hacker or hackers, and had stopped the problems on
Wednesday night Thursday morning".
Confidential, © Riverhead Networks, Inc., 2002
10
NAPHTA: TCP connections
SYN RQST
server
SYN ACK
ACK
clients
HTTP request
FIN
 Repeatedly establishing a connection and then
abandoning it, an attacker can tie up resources. Fill up
the TCP connections buffer.
 Multiple FIN_WAIT_1 state in the servers
 http://people.internet2.edu/~shalunov/netkill
Confidential, © Riverhead Networks, Inc., 2002
11
Half open Connections
syn rqst
server
synack
clients
 Repeatedly establishing a connection
 Requesting a unfinished request GE. (GET)
 Server waits for the end of request
 Application layer saturation
Confidential, © Riverhead Networks, Inc., 2002
12
HTTP attack tool
Click to get
latest victim
Where to attack
www.victim.com
Control how
fast to attack
www.proxyserver.com
First came out in January 1999!
Confidential, © Riverhead Networks, Inc., 2002
13
Client attack
 URL attacks
Repeated request
 Repeated REFRESH
 Random URL

• Avoids proxy
• Works hard
• Large log file

victim
cgi, long forms, heavy search requests
 http://all.net/journal/netsec/9512.html
Confidential, © Riverhead Networks, Inc., 2002
14
Client attack on Lufthansa
Computerworld 6/21/01
“Wednesday morning, in a planned attack, demonstrators began
accessing Lufthansa's Web site. Although demonstrators claim
they knocked the site off-line for about 10 minutes, Lufthansa
said the claim was untrue.”
“Lufthansa's servers got 67,004 hits per second at one point in
the two-hour Web attack”
“The attack was planned to protest Lufthansa's contract with the
German government to fly people who are denied asylum in
Germany out of the country.”
Confidential, © Riverhead Networks, Inc., 2002
15
Client attack on WTO
Confidential, © Riverhead Networks, Inc., 2002
16
DNS attack
 DNS request
www.bogus.com
www.bla-bla.com
Spoofing
 Random requests
 Reflectors

www.!@$$.com
 DNS recursive requests

DNS Server
Amplifications
www.*&^.com
UDP spoofed traffic
Reply to recursive
Confidential, © Riverhead Networks, Inc., 2002
17
Bandwidth-level DDoS attacks
 ICMP echo, unreachable
 UDP Flood
 Reflectors
 Smurf Flood
Bandwidth-level DDoS
attacks
Confidential, © Riverhead Networks, Inc., 2002
18
Reflectors
Sock proxy
zombie
Proxy
List:
Reflector-1
Reflector-2
Reflector-3
Reflector-4
….
Web server
…
DNS server
Router
victim
Confidential, © Riverhead Networks, Inc., 2002
19
Reflectors
Sock proxy
zombie
Proxy
zombie
zombie
Web server
zombie
DNS server
Router
victim
Confidential, © Riverhead Networks, Inc., 2002
20
Reflectors -> Bandwidth attack
 Reflectors= returns a packet if one is sent

Web servers, DNS servers and routers
• Returns SYNACK or RST in response to a SYN or
other TCP packets with ACK
• ICMP Time Exceeded or Host Unreachable in
response to particular IP packets
• Amplification if knowing the sequence number (FTP,
streaming…)
• DNS replies


http://grc.com/dos/drdos.htm
http://www.aciri.org/vern/papers/reflectors.CCR.01.pdf
Confidential, © Riverhead Networks, Inc., 2002
21
Smurf Amplification
Direct broadcast address
dst
src
victim
zombie
amp.255
ping.rqst
1
•Jan 1998
•http://www.cert.org/advisor
ies/CA-1998-01.html
amp/255.255.255.0
500
500
500
500
500victim
Confidential, © Riverhead Networks, Inc., 2002
22
Smurf Tool
Set packet size from 10 to
1300 octets
Came out in March 1999!
Confidential, © Riverhead Networks, Inc., 2002
23
Smurf attack
Internet attack slows Web to a crawl Assault on
Oz.net affects entire area
Tuesday, January 18, 2000
an ISP serving 7,000 subscribers, is known to have been targeted in
the so-called smurf attack in Seattle, the assault affected many,
perhaps even most, of the Internet users in the Seattle area, said
experts.
“… all the corporate or academic networks the smurf attacker used in
the assault -- as many as 2,000 nationwide”
“The Seattle attack was most likely launched by a single person…”
Confidential, © Riverhead Networks, Inc., 2002
24
Cisco – stopping Smurf
 no ip directed-broadcast
Translation of directed broadcast to physical
MAC broadcasts is disabled
 As of 12.0 this is the default

Confidential, © Riverhead Networks, Inc., 2002
25
Infrastructure-level DDoS attacks
 BGP / OSPF / … attacks
 SYN flood TCP 179, SSH
 ICMP attack
 DNS attacks
Confidential, © Riverhead Networks, Inc., 2002
Infrastructure-level DDoS
attacks
26
Attacks directly on routers
 Attacks directed at routers can have
broader impact than attacks directed at
hosts
 Packets directed at a router may be more
CPU (slow path) consuming then packets
transiting a router
Confidential, © Riverhead Networks, Inc., 2002
27
October 2002
Massive attack on 13 DNS root servers
 ICMP floods 150K PPS (primitive attack)
 Took down 7 root servers (two hours)
AS y
AS 56
AS x
DNS root servers
Confidential, © Riverhead Networks, Inc., 2002
28
October 2002
Massive attack on 13 DNS root servers
 ICMP floods 150K PPS (primitive attack)
 Took down 7 root servers (two hours)
AS y
AS 56
AS x
DNS root servers
Confidential, © Riverhead Networks, Inc., 2002
29
Attacks & Attack Tools examples
 TFN
 Spoofed SYN Flood
 non-Spoofed SYN Flood
 UDP Flood
 FIN, SYNACK Flood
(Spoofed and nonspoofed)
 Ping Flood
 Smurf Flood
 Combined UDP/TCP/ICMP
 Fragmentation Attack
 IP/UDP (jolt2)
 IP/ICMP (trash, and
fawx)
 IP/TCP
 HTTP
 Targa3 Attack
 DNS attacks



Connection Flood (Client
attack)
http errors 404 etc.
http half connections
 BGP attacks on routers
Partial list of covered tools: JOLT, WINNUKE,
TRINOO, TFN, Targa3, Naphta, Trash…
Confidential, © Riverhead Networks, Inc., 2002
30
How are DDoS handled?
Confidential, © Riverhead Networks, Inc., 2002
31
Router
Filtering
Built-in and distributed but…
• Blocks good with bad
• Ineffective against random spoofing
R4
R5
and application level attacks
peering
• Potential performance degradation
R2
• Manually intensive process
1000
R3
1
ACLs, CARs
1000
R1
100
R
R
FE
R
.. ..
.. ..
Server1
Confidential, © Riverhead Networks, Inc., 2002
Victim32
Server2
Cisco ACLs - 1
 Use ACL to determine which interface is being
attacked and characteristics of attack
 Initial ACL to
access-list 101
access-list 101
access-list 101
access-list 101
access-list 101
determine what type of attack
permit
permit
permit
permit
permit
icmp any any echo
icmp any any echo-reply log-input
udp any any
tcp any any
ip any any
interface serial 1/1
ip access-group 101 out
! Wait 10 seconds
no ip access-group 101 out
Confidential, © Riverhead Networks, Inc., 2002
33
Cisco ACLs - 2
 sh access-l 101
Extended
permit
permit
permit
permit
permit
IP access list 101
icmp any any echo (2 matches)
icmp any any echo-reply (21374 matches)
udp any any (18 matches)
tcp any any (123 matches)
ip any any (5 matches)
• Indications are that there is some sort of
ICMP attack
• Need to place ACL on each successive router
in upstream path
Confidential, © Riverhead Networks, Inc., 2002
34
Cisco ACLs - 3
 Next use ‘log-input’ to determine from
where – via ‘sho logging’:
%SEC-6-IPACCESSLOGDP: list 101 permit icmp 192.168.1.1
(Serial1/1) -> 128.139.19.5 (0/0), 1 packet
%SEC-6-IPACCESSLOGDP: list 101 permit icmp 172.17.3.34
(Serial1/1) -> 128.139.11.2 (0/0), 1 packet
%SEC-6-IPACCESSLOGDP: list 101 permit icmp 192.168.2.15
(FastEthernet1/0/0) -> 128.139.6.1 (0/0), 1 packet
%SEC-6-IPACCESSLOGDP: list 101 permit icmp 192.168.3.4
(Serial1/1) -> 128.139.6.1 (0/0), 1 packet
Serial 1/1 is our prime suspect!
Link: http://www.cisco.com/warp/public/707/22.html
Confidential, © Riverhead Networks, Inc., 2002
35
Cisco CAR
 CAR – Committed Access Rate
b/w
Normal
Burst in
bytes
Max
Burst in
bytes
interface ATM1/1/0.21 point-to-point
rate-limit input access-group 180 96000 24000 32000
conform-action continue exceed-action drop
rate-limit input access-group 190 128000 30000
30000 conform-action transmit exceed-action drop
!
access-list 180 deny
icmp 128.139.252.0 0.0.0.255
any
access-list 180 permit icmp any any
access-list 190 deny
tcp any any established
access-list 190 permit tcp any any
No one really understands “burst” – best to read:
http://www.nanog.org/mtg-9811/ppt/witt/index.htm
Confidential, © Riverhead Networks, Inc., 2002
36
Cisco uRPF
Router A
Router B
Pkt w/ source comes in
Path back on this line?
Accept pkt
Check source in
routing table
Path via different interface?
Reject pkt
Does routing back to the source go
through same interface ?
Confidential, © Riverhead Networks, Inc., 2002
37
Cisco uRPF - 1
 Unicast Reverse Path Forwarding
Requires CEF
 Available starting in 11.1(17)CC, and 12.0

• Not available in 11.2 or 11.3 images
 Cisco interface command:
ip verify unicast rpf
Confidential, © Riverhead Networks, Inc., 2002
38
Blackholing
= Disconnecting the
R4
R5
customer
R2
peering
R3
1000
1000
R1
100
R
R
FE
R
.. ..
.. ..
Server1
Confidential, © Riverhead Networks, Inc., 2002
Victim39
Server2
Null0 routing
 Works only on destination addresses
 Simple blackhole:
ip route 191.1.1.1 255.255.255.255
null0
Caveat: routers can forward faster than they
can drop packets
 Blackholes good packets with bad packets

Confidential, © Riverhead Networks, Inc., 2002
40
Router Capabilities
 ACLs
 Manual process
 Performance impact on some routers
 CAR
 Performance impact on some routers
 Also limits good traffic
Blocks good
along with the
bad
 uRPF
 Not enforced, limited attacks protection
Issue:
•Too coarse – affects good as well as bad traffic
•Router CPU/ASIC limitations – impacts performance
•Ineffective on several different attacks
Confidential, © Riverhead Networks, Inc., 2002
41
In-line Mitigation: Edge Device
Low cost and simple deployment, but…
• Upstream ingress still choked
R4 • Device itself becomes point of failure
R5
peering
• Doesn’t scale –requires many
R2
•Easy to overwhelm a FW
1000
R3
1000
R1
100
R
R
FE
R
.. ..
.. ..
Server1
Confidential, © Riverhead Networks, Inc., 2002
Victim42
Server2
Diversion and Precise Filtering
R4
R5
Guard
Guard
R2
R3
Protects all resources
1000
• No point of failure or latency on
1000
R1
critical path
• No router impact
100
• Scales via sharing
• Dynamic and precise filtering
R
R
R
.. ..
.. ..
Server1
Confidential, © Riverhead Networks, Inc., 2002
Victim
43
Server2
Solution Overview
Upstream = Not on the Critical Path
DDoS Protection=Riverhead Guard
DDoS Detection= Riverhead Detector
Victim
Non-victimized
servers
Confidential, © Riverhead Networks, Inc., 2002
44
Solution Overview
Riverhead
BGP announcement
Guard
3. Divert only victim’s traffic
2. Activate: Auto/Manual
Activate
1. Detect
Riverhead
Detector
Victim
Non-victimized
servers
Confidential, © Riverhead Networks, Inc., 2002
45
OR IDS system
Firewall
Health checks
Solution Overview
Hijack traffic = BGP
Riverhead
Guard
Traffic destined
to the victim
Legitimate traffic
to victim
Inject= GRE, VRF, VLAN,
FBF, PBR…
Victim
Non-victimized
servers
Confidential, © Riverhead Networks, Inc., 2002
46
“No Dynamic configuration”
Adaptive and Dynamic Filtering
1 to 100s
of dynamic
filters by
flow,
protocol, …
Static &
Dynamic
Filters
Anti spoofing
Confidential, © Riverhead Networks, Inc., 2002
Statistical
analysis
47
Layer 7
http
smtp
Per flow
queues and
aggregate
rates
Rate-limiting
& DDoS Traffic
Shaping
ISP Perimeter Protection
Confidential, © Riverhead Networks, Inc., 2002
48
ISP Perimeter Protection
Confidential, © Riverhead Networks, Inc., 2002
49
ISP Edge Protection
Confidential, © Riverhead Networks, Inc., 2002
50
IDC Enterprise Protection
Confidential, © Riverhead Networks, Inc., 2002
51
Actual Production Network
ISP 1
Juniper
GSR
12000
Foundry,
etc
ISP 2
CISCOSY TEM
CISCOSYSTEMS
PowerSupply0
PowerSupply1
owe Su pl 0
D
o erSu ply 1
SD
a l t
80
SE ES
Catalyst
8500
SERES
S
Switch
Processor
P
S
r py
Pw
p
S
Swi ch
P o e so
C ta ys
5 0
RI
I
t
rc s r
Cisco,Foundry
Catalyst
I CO SYS EM
GEthernet
I CO SYSTEM
CS
CS
T
S
S
Firewall
Catalyst
Alert
Riverhead,
IDS
Other
detectors
IDS
I CO SYS EM
I CO SYSTEM
Internal network
Customers’ Servers
Confidential, © Riverhead Networks, Inc., 2002
Riverhead Guard
53
Live Data Center Test
Victim & Guard:
Actual Hosting
Center
`
Attackers:
Mercury
Interactive
A
A
C
C
A
Confidential, © Riverhead Networks, Inc., 2002
User experience
Netax,
Philadelphia
54
Real World Results
Confidential, © Riverhead Networks, Inc., 2002
55
Detailed Effect
Victim vs Non-victim
normal
Attack
Attack + diversion
)
1000
(usec
Latency
usec
10000
100
time
Latency to Victim
Confidential, © Riverhead Networks, Inc., 2002
56
Latency to Non-Victim
Thank you!
Comments:
[email protected]
Confidential, © Riverhead Networks, Inc., 2002
57