DDoS: practical survival
Download as PPTX, PDF1 like1,844 views
This document discusses DDoS attacks and various techniques for mitigating them. It provides statistics on DDoS attacks from 2012, including the number of incidents and average/maximum botnet sizes. It then evaluates several approaches for detecting and blocking DDoS traffic, such as mod_evasive, iptables, Nginx testcookie module, and neural networks. The key message is that while many solutions can help, none are perfect, and maintaining system uptime requires a layered defense-in-depth approach along with protecting the underlying TCP stack. The homework suggested is to configure Nginx with ipset, harden the TCP stack, use dedicated IPs, and test blackholing capabilities.
![Neuron network PyBrain
Request:
0.0.0.0 - - [20/Dec/2011:15:00:03 +0400] "GET /forum/rss.php?topic=347425 HTTP/1.0" 200 1685 "-" "Mozilla/5.0
(Windows; U; Windows NT 5.1; pl; rv:1.9) Gecko/2008052906 Firefox/3.0»
Dictionary:
['__UA___OS_U', '__UA_EMPTY', '__REQ___METHOD_POST', '__REQ___HTTP_VER_HTTP/1.0', '__REQ___URL_
__NETLOC_', '__REQ___URL___PATH_/forum/rss.php', '__REQ___URL___PATH_/forum/index.php', '__REQ___URL
___SCHEME_', '__REQ___HTTP_VER_HTTP/1.1', '__UA___VER_Firefox/3.0', '__REFER___NETLOC_www.mozilla-
europe.org', '__UA___OS_Windows', '__UA___BASE_Mozilla/5.0', '__CODE_503', '__UA___OS_pl', '__REFER___PA
TH_/', '__REFER___SCHEME_http', '__NO_REFER__', '__REQ___METHOD_GET', '__UA___OS_Windows NT
5.1', '__UA___OS_rv:1.9', '__REQ___URL___QS_topic', '__UA___VER_Gecko/2008052906’
Further reading: http://habrahabr.ru/post/136237/](https://image.slidesharecdn.com/phdays2012-lyamin-120619030005-phpapp01/85/DDoS-practical-survival-23-320.jpg)
![tcpdump
tcpdump -v -n -w attack.log dst port 80 -c 250
tcpdump -nr attack.log |awk '{print $3}' |grep -oE '[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0-
9]{1,}' |sort |uniq -c |sort -rn](https://image.slidesharecdn.com/phdays2012-lyamin-120619030005-phpapp01/85/DDoS-practical-survival-26-320.jpg)
DDoS: practical survival
- 1. DDoS: practical survival guide Alexander Lyamin <la@highloadlab.com>
- 2. Q1 2012 • Incidents: 365 • Daily max: 12 • Avg. botnet size: 2637 • Max botnet size: 37834
- 3. 2012: 1 Jan – 30 May • Incidents: 728 • Daily max: 51 • Avg. botnet size: 3288 • Max botnet size: 116265
- 4. Daily 55 Jan 50 Feb 45 Mar 40 Apr 35 May 30 25 20 15 10 5 0
- 5. Weekday distribution 20% 18.82% 18% 15.93% 15.52% 16% 13.60% 14% 12.77% 12.50% 12% 10.85% 10% 8% 6% 4% 2% 0% Monday Tuesday Wednesday Thursday Friday Saturday Sunday
- 6. High speed attacks 3.16% >=1Gbps 96.84% <1Gbps
- 7. Spoofed source attacks 29.67% Spoofed Full connect 70.33%
- 8. Scary stuff • DNS: NIC, Masterhost, FastVPS. • DataCenters: CROC, WAhome. • “Invisible” russian elections botnets. • Minerbot.
- 9. New reality • 1k botnet - 100-160 USD. • Readily available botnet toolkits. • Fall of prices - 20 USD/day.
- 10. New competition
- 12. Apache mod_evasive <IfModule mod_evasive20.c> DOSHashTableSize 3097 DOSPageCount 8 DOSSiteCount 100 DOSPageInterval 2 DOSSiteInterval 2 DOSBlockingPeriod 600 DOSEmailNotify secure@adminmail.com </IfModule>
- 13. Apache mod_evasive Positive Negative It works! Apache
- 15. Iptables --string iptables -A INPUT -p tcp -m tcp --dport 80 -m string --string "GET / HTTP" --algo kmp --to 1024 -m recent --set --name httpddos --rsource iptables -A INPUT -p tcp -m tcp --dport 80 -m string --string "GET / HTTP" --algo kmp --to 1024 -m recent --update --seconds 10 --hitcount 2 --name httpddos --rsource -j DROP
- 16. Iptables --string Positive Negative It works. Not always works. (fragmentet packets) Its fast. Not always fast. (kmp matched packets) Orphaned sockets + retransmit. Requires conntrack(statefull is bad).
- 18. JS
- 19. Cookie/Redirect
- 20. NGINX testcookie_module testcookie_name BPC; testcookie_secret keepmescret; testcookie_session $remote_addr; testcookie_arg attempt; testcookie_max_attempts 3; testcookie_fallback /cookies.html?backurl=http://$host$request_uri; testcookie_get_only on; location / { testcookie on; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_pass http://127.0.0.1:8080; } Further reading: http://habrahabr.ru/post/139931/
- 21. NGINX testcookie_module Positive Negative It works. Doesn’t block traffic.* NGINX. Alternates UX. Its fast. Is not effective on FBS. Predictable. Expandable (Flash, QT checks). * That’s what ipset is for.
- 23. Neuron network PyBrain Request: 0.0.0.0 - - [20/Dec/2011:15:00:03 +0400] "GET /forum/rss.php?topic=347425 HTTP/1.0" 200 1685 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; pl; rv:1.9) Gecko/2008052906 Firefox/3.0» Dictionary: ['__UA___OS_U', '__UA_EMPTY', '__REQ___METHOD_POST', '__REQ___HTTP_VER_HTTP/1.0', '__REQ___URL_ __NETLOC_', '__REQ___URL___PATH_/forum/rss.php', '__REQ___URL___PATH_/forum/index.php', '__REQ___URL ___SCHEME_', '__REQ___HTTP_VER_HTTP/1.1', '__UA___VER_Firefox/3.0', '__REFER___NETLOC_www.mozilla- europe.org', '__UA___OS_Windows', '__UA___BASE_Mozilla/5.0', '__CODE_503', '__UA___OS_pl', '__REFER___PA TH_/', '__REFER___SCHEME_http', '__NO_REFER__', '__REQ___METHOD_GET', '__UA___OS_Windows NT 5.1', '__UA___OS_rv:1.9', '__REQ___URL___QS_topic', '__UA___VER_Gecko/2008052906’ Further reading: http://habrahabr.ru/post/136237/
- 24. Neuron network PyBrain Positive Negative It works. May not work. Nerd award! No historical analysis.
- 25. tcpdump
- 26. tcpdump tcpdump -v -n -w attack.log dst port 80 -c 250 tcpdump -nr attack.log |awk '{print $3}' |grep -oE '[0-9]{1,}.[0-9]{1,}.[0-9]{1,}.[0- 9]{1,}' |sort |uniq -c |sort -rn
- 27. tcpdump Positive Negative It works. why tcpdump? Ask kernel (nicely)!
- 28. Cisco ASA
- 29. Cisco ASA
- 30. Cisco ASA Positive Negative It works. Performance is theoretical. Expen$ive High Performance $olution. Fun is real.
- 31. More recipes
- 32. Recipes VS LOIC/HOIC • HTTP1.0 + Host header • Header order signatures • Leading space character signature • Mod_security • Snort More reading: http://blog.spiderlabs.com/2012/01/hoic-ddos-analysis-and-detection.html
- 33. Results? • Every solution works. • Not always. • Not for everyone. • UPTIME > DOWNTIME.
- 34. Definition of happiness • Minimal FALSE POSITIVES. • No vulnerabilities on lower levels. • Up to challenge.
- 36. One last thing… (protect your TCP stack) 29.67% 3.16% >=1Gbps Spoofed 96.84% <1Gbps Full connect 70.33%
- 37. Have a fun ride!
- 38. Homework. 1. NGINX/ipset pre-installed. 2. No stateful firewalls. 3. Fortified TCP stack. 4. Dedicated IP per critical published service. 5. Blackhole communities present and tested.