Filling the Gaps in Your DDoS Mitigation Strategy

Editor's Notes

• #2: Thanks for the introduction Erfi. Today's topic is
• #3: I'm a Cloudflare Solutions Engineer based in the APAC region.
• #5: First a quick poll, how many of you are currently using Cloudflare? https://www.cloudflare.com/plans/#compare-features
• #7: With new vulnerabilities now and then, the attack types haven't changed that much. Typical DDoS attack types that can target at the web applications. DNS Flood: by floooding the DNS service, one can bring down the entire web infrature relying on it. e.g. October 2016 Dyn attack by Mirai botnet TCP/UDP Port 53 L3/4: exhaustion of network resources: typical techniques reflection & amplification: using a NTP/DNS to amplify requests and overload yours server using 3rd party services e.g. Feb 2018 Memcache UDP Port 11211: amplification factors of up to 51,200x: a 1 byte request, a 51 kB response can be sent. L7: exhaustion of system and application resources: volumetric HTTP attack to bring down the application e.g. HTTP POST flood at one's Wordpress login page They can be used together; used a ransom as financial incentive
• #8: Same samples this year. Horizon frequency Vertical difficulty DNS & SSL: Less common; used to be a challenge. but the adoption of large scale DNS and SSL services like Cloudflare, it has become less frequent. L3/4: Bulk of traffic; Industry is getting better handling it L7: More frequent and more difficult to mitigate. https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/
• #9: Cloudflare introduced unmetered DDoS mitigation September 2017. SYN flood is L4 attack Things to note: 1. Since the introduction of Unmetered Mitigation large attacks continue but you can see they are more spaced out. https://blog.cloudflare.com/the-new-ddos-landscape/ 2. Cloudflare very frequently gets attacks greater than 300 Gbps and 400 Gbps; The large attacks still remain.
• #10: The L7 volume in HTTP requests per second by day. This doesn't show a slow down which seems to indicate what we've long suspected: as protection services like Cloudflare have got really good at handling L3/L4 attacks attackers have moved up the stack to focus on L7. https://blog.cloudflare.com/the-new-ddos-landscape/
• #11: This final chart shows the volume of DNS-based attacks in Mbps. It's notable that these are never very big, but the one big spike is the day after we announced Unmetered Mitigation. Almost as if someone had a go to see if they could cause us harm :-) They did not succeed, of course. https://blog.cloudflare.com/the-new-ddos-landscape/
• #13: Scrubbing centers: a few (<10) of data centers with huge bandwidth and powerful hardware; The architecture give rise to some disadvantages: Performance: Longer distances for ‘clean’ traffic to travel since Scrubbers are centralized or different from cache On-demand: Manually change DNS introduces latency in time-to-migration Reliability: Single location can easily get flooded, and either exceed capacity or result in high overage charges during attack
• #14: Cloudflare DDoS mitigation infrastructure lives in 152 data centers globally, instead of 10. The architecture advantages: Performance: improvement instead of degradation Always on: no monitoring required Reliability:
• #15: https://blog.cloudflare.com/unmetered-mitigation/ Cloudflare takes a multi-layerd approach. Step 1: Global Anycast means we’re high resilient, and absorb attack traffic as close to the source of the attack as possible Means we do not have to transport or add latency diverting traffic to scrubbing centers Step 2 : The origin is key, and usually the weakest point Cloudflare hides the Origin’s IP address so we will always take the brunt of any attacks Step 3: Attack vectors are never the same Dynamic fingerprinting on the fly lowers false positives and also decreases “leakage” - which is where some traffic will get through (NOTE: AKAM in their ENT SLA say they will leak up to x%) Step 4: Proactive protections for DDoS attacks seen at other customers means we can track attribution, meaning faster detection and more accurate mitigations Step 5: Low and slow attacks are difficult to track, especially at the scale Cloudflare is at today. We put the power back into our customer’s hands by providing solutions like Rate-Limiting, allowing them to define what they know is to be a good level of traffic, and for Cloudflare to block everything else. Rate-Limiting can be applied to APIs with JSON responses as well
• #17: Talking Points: Rate Limiting complements Cloudflare’s DDoS and Web Application Firewall (WAF) Services. Rate Limiting protects against layer 7 denial-of-service attacks, brute-force password attempts, and other types of abusive behavior targeting the application layer. It provides the ability to configure thresholds and define responses by IP. If traffic from a specific IP exceeds the threshold, than those requests get blocked and timed out for a defined period. Rate Limiting also provides customers to gain analytical insights into endpoints of the website, application, or API, and they can monitor their good and bad traffic. Demo Disconnect from VPN Open UI Check: https://cecilsflorist.cf/wp-login.php
• #19: Talk Track Historically, Cloudflare proxies web traffic only. With Spectrum, Cloudfalre now provides the same level of layer 3 and 4 volumetric DDoS mitigation expected, across all TCP protocols, including those which are proprietary. In addition, it protects said protocols from data snooping and theft by encrypting traffic with Universal SSL / TLS. Demo: Open UI dig ssh.cecilsflorist.cf ssh root@ssh.cecilsflorist.cf
• #23: link to the Sheets form with the graph data is in the notes (also here: https://docs.google.com/spreadsheets/d/11NffR-jEWaSEi8CUUTk6IiWKoX3luOr-e1vQKwOYJMc/edit?zx=ochdtwfluz0u#gid=0) everything is mutable if you'd like to update the wording! Cloudflare mitigates DDoS attacks, including those that target UDP and ICMP protocols, SYN/ACK, DNS and NTP amplification and Layer 7 attacks. Our global network has defended against sustained attacks over 400Gbps. If you're under DDoS attack, we can get your site back online within minutes. https://docs.google.com/spreadsheets/d/11NffR-jEWaSEi8CUUTk6IiWKoX3luOr-e1vQKwOYJMc/edit?zx=ochdtwfluz0u#gid=0 Slide that discusses the fact that our customers never see attacks Which is why it is hard for us to find references to show process on how we mitigated an attack…. Our customers don’t even know we did it Which is why we don’t have many numbers on largest attack seen… And then tell story on why this is….. Customer’s Set it and Forget it!!
• #24: Because of the wide surface area CF has today we are able to build a sustainable behavioral analysis on clients allowing us to identify a baseline of what is considered normal activity across the entire cloudflare network. I'm not sure the current design captures and punches up the 3 ways we are attacking this problem. We dive right down to the features. Instead, I think we need to frame our approach: AI, Client challenge, Finer grain controls. Also, we are missing our current capabilities (see notes) When we asked this group, #1 desire = bot mitigation Bots make up more than 50% of the world’s internet traffic today, that’s huge… The challenge is determining what’s a good bot and a bad bot. Today we challenge bots through our Browser Integrity Checks, JavaScript challenge, and Captchas. Our current Bot Management provisions blocked over 144m requests. But we know you need more specific protections. In the next year, we’re going to be launching aggressive protection against Account Takeover and Web Scraping, all powered through our new Machine Learning and Client Identification platforms which have been delivering some amazing preliminary results.
• #25: address growing threats on new platforms and device , which calls for a broader breadth of services to meet demand (Access, Bot Mitigation, custom rules on the edge)
• #26: What is driving the exponential growth in traffic here? Insecure devices and increased connectivity and increasing connected devices If you return to attack sizes over time Have 10 gbps - fast cnx to internet 2007 - 24 gbps would have overwhelemd See peek sizes growing Huge attacks, easily Can’t fight these on your own - Animate from smallest to largest – one circle at a time Side bar info = home internet connection https://www.youtube.com/watch?v=Sp6bnvbrJb8&t=364s 9.45 min 1