CloudFlare DDoS attacks 101: what are they and how to protect your site?
1 like2,558 views
The document discusses Distributed Denial of Service (DDoS) attacks, highlighting their nature and impact on legitimate services. It provides examples of significant attacks and the mechanisms behind them, including amplification factors from DNS and NTP servers. Additionally, it emphasizes the importance of network security practices, such as implementing BCP38, to prevent becoming a source of such attacks.
CloudFlare DDoS attacks 101: what are they and how to protect your site?
- 1. Trey Guinn Solution Engineer, CloudFlare www.cloudflare.com DDoS 101
- 2. Distributed Denial of Service ! An attack coming from all many locations which overwhelms your resources and prevents you from serving legitimate customers.
- 4. Variety of Attacks Volumetric Protocol Attacks Application Attacks
- 8. Wednesday, March 20 ~75Gbps attack
- 9. 100Gbps Magic ceiling in DDoS attacks
- 10. March 24 – March 25 Peaks of the attack reached at least 309Gbps
- 11. dig ANY isc.org @63.217.84.76 +edns=0 +notcp +bufsize=4096
- 12. 64-byte query
- 13. $ dig ANY isc.org @63.217.84.76 +edns=0 +notcp +bufsize=4096
- 15. Amplification
- 17. Attack Amplification ! DNS - 50 x NTP - 200x Coming: SNMP - 650x
- 18. UDP = no handshake
- 19. Problem Ingredients: Networks that allows source IP spoofing + Servers that reply to “non-customers”
- 20. Good networks don’t let packets originate from IPs they don’t own (BCP38)
- 21. Not all networks are good
- 22. How common are these ingredients?
- 23. 28 million open resolvers
- 24. 24.6% networks allow spoofing
- 25. 10s of Millions Open NTP DNS servers
- 26. 1 attacker’s laptop controlling 5–7 compromised servers on 3 networks that allowed spoofing of 9Gbps DNS requests to 0.1% of open resolvers resulted in 300Gbps+ of DDoS attack traffic. + + + +
- 27. How did we stop it?
- 29. Anycast
- 32. 300Gbps 25 Anycasted PoPs 12 Gbps/PoP ÷
- 33. Make sure you’re not part of the problem…
- 34. Are you running open DNS resolvers?
- 35. Are you running open NTP servers?