Layer one 2011-sam-bowne-layer-7-dos
- 1. Layer 7 DoS Attacks and Defenses LayerOne, 2011
- 2. Bio
- 3. Summary • The DoS Circus • Layer 4 DDoS: Thousands of attackers bring down one site • Layer 7 DoS: One attacker brings down one site • Link-Local DoS: IPv6 RA Attack: One attacker brings down a whole network
- 4. The DoS Circus Characters
- 5. Wikileaks • Published <1000 US Gov't diplomatic cables from a leak of 250,000 • Distributed an encrypted "Insurance" file by BitTorrent • Widely assumed to contain the complete, uncensored leaked data • Encrypted with AES-256--no one is ever getting in there without the key • Key to be released if Assange is jailed or killed, but he is in UK now resisting extradition to Sweden and the key has not been released
- 6. Anonymous
- 7. Operation Payback • 4chan's Anonymous group • Attacked Scientology websites in 2008 • Attacked the RIAA and other copyright defenders • Using the Low Orbit Ion Cannon with HiveMind (DDoS) • "Opt-in Botnet"
- 8. HB Gary Federal • Aaron Barr • Developed a questionable way to track people down online • By correlating Twitter, Facebook, and other postings • Announced in Financial Times that he had located the “leaders” of Anonymous and would reveal them in a few days
- 10. Social Engineering & SQLi • http://tinyurl.com/4gesrcj
- 11. Leaked HB Gary Emails • For Bank of America • Discredit Wikileaks • Intimidate Journalist Glenn Greenwald • For the Chamber of Commerce • Discredit the watchdog group US Chamber Watch • Using fake social media accounts • For the US Air Force • Spread propaganda with fake accounts • http://tinyurl.com/4anofw8
- 12. Drupal Exploit
- 13. Th3j35t3r • "Hacktivist for Good" • Claims to be ex-military • Originally performed DoS attacks on Jihadist sites • Bringing them down for brief periods, such as 30 minutes • Announces his attacks on Twitter, discusses them on a blog and live on irc.2600.net
- 14. Jester's Tweets from Dec 2010
- 15. Th3j35t3r v. Wikileaks • He brought down Wikileaks single-handed for more than a day – I was chatting with him in IRC while he did it, and he proved it was him by briefly pausing the attack
- 16. Wikileaks Outage • One attacker, no botnet
- 17. Th3j35t3r • After his Wikileaks attack • He battled Anonymous • He claims to have trojaned a tool the Anons downloaded • He claims to pwn Anon insiders now
- 18. Jester's Tweets
- 19. Westboro Baptist Outage • 4 sites held down for 8 weeks • From a single 3G cell phone – http://tinyurl.com/4vggluu
- 20. Layer 4 DDoS Many Attackers – One Target Bandwidth Consumption
- 21. Companies that Refused Service to Wikileaks • Amazon • Paypal • Mastercard • Visa • Many others
- 22. Low Orbit Ion Cannon • Primitive DDoS Attack, controlled via IRC • Sends thousands of packets per second from the attacker directly to the target • Like throwing a brick through a window • Takes thousands of participants to bring down a large site • They tried but failed to bring down Amazon
- 23. Low Orbit Ion Cannon
- 24. Operation Payback v. Mastercard • Brought down Visa, Mastercard, and many other sites – Easily tracked, and easily blocked – High bandwidth, cannot be run through anonymizer – Dutch police have already arrested two participants
- 25. Mastercard Outage 3,000 to 30,000 attackers working together
- 27. Layer 7 DoS One Attacker – One Target Exhausts Server Resources
- 28. Layer 7 DoS • Subtle, concealable attack • Can be routed through proxies • Low bandwidth • Can be very difficult to distinguish from normal traffic
- 29. HTTP GET
- 30. SlowLoris • Send incomplete GET requests • Freezes Apache with one packet per second
- 31. R-U-Dead-Yet • Incomplete HTTP POSTs • Stops IIS, but requires thousands of packets per second
- 32. Keep-Alive DoS • HTTP Keep-Alive allows 100 requests in a single connection • HEAD method saves resources on the attacker • Target a page that is expensive for the server to create, like a search – http://www.esrun.co.uk/blog/keep-alive-dos-script/ • A php script – pkp keep-dead.php
- 33. keep-dead
- 34. XerXes • Th3j35t3r's DoS Tool • Routed through proxies like Tor to hide the attacker's origin • No one knows exactly what it does • Layer 7 DoS?
- 35. XerXes
- 36. Link-Local DoS IPv6 Router Advertisements
- 37. IPv4: DHCP PULL process Client requests an IP Router provides one I need an IP Use this IP Host Router
- 38. IPv6: Router Advertisements PUSH process Router announces its presence Every client on the LAN creates an address and joins the network JOIN MY NETWORK Yes, SIR Host Router
- 40. RA Flood
- 41. Windows Vulnerability • It takes a LOT of CPU for Windows to process those Router Advertisements • 5 packets per second drives the CPU to 100% • And they are sent to every machine in the LAN (ff02::1 is Link-Local All Nodes Multicast) • One attacker kills all the Windows machines on a LAN
- 42. Responsible Disclosure • Microsoft was alerted by Marc Heuse on July 10, 2010 • Microsoft does not plan to patch this • Juniper and Cisco devices are also vulnerable • Cisco has released a patch, Juniper has not
- 43. Defenses from RA Floods • Disable IPv6 • Turn off Router Discovery • Block rogue RAs with a firewall • Get a switch with RA Guard
- 44. RA Guard Evasion • Add "Fragmentation Headers" to the RA Packets – http://samsclass.info/ipv6/proj/RA-evasion.html
- 47. Attack > Defense • Right now, your website is only up because – Not even one person hates you, or – All the people that hate you are ignorant about network security
- 48. Defense • Mod Security--free open-source defense tool • Latest version has some protections against Layer 7 DoS • Akamai has good defense solutions • Caching • DNS Redirection • Javascript second-request trick
- 49. Load Balancer
- 50. Counterattacks • Reflecting attacks back to the command & control server • Effective against dumb attackers like Anonymous' LOIC – Will lose effect if they ever learn about Layer 7 DoS, which is happening now
- 51. References
- 52. References Anonymous Takes Down U.S. Chamber Of Commerce And Supporter Websites http://goo.gl/Mue9k Slowloris HTTP DoS http://ha.ckers.org/slowloris/ OWASP HTTP DoS Tool http://code.google.com/p/owasp-dos-http-post/ Mitigating Slow HTTP DoS Attacks http://blog.spiderlabs.com/2010/11/advanced-topic-of-the- week-mitigating-slow-http-dos-attacks.html ‘Tis the Season of DDoS – WikiLeaks Edition (Outage charts) http://goo.gl/V5jZc
- 53. References ModSecurity http://goo.gl/56hbl Akamai DDoS Report http://baythreat.org/MichaelSmith_DDoS.pdf How Secure Is Julian Assange's "Thermonuclear" Insurance File? http://goo.gl/sY6Nn Overview of Anonymous and their attack on MasterCard: http://goo.gl/lVsCD Operation Payback Toolkit: LOIC and HiveMind http://pastehtml.com/view/1c8i33u.html
- 54. References r-u-dead-yet http://code.google.com/p/r-u-dead-yet/ Keep-Alive DoS Script http://www.esrun.co.uk/blog/keep-alive-dos-script/ Router Advertisement DoS in Windows http://samsclass.info/ipv6/proj/flood-router6a.htm RA Guard Evasion http://samsclass.info/ipv6/proj/RA-evasion.html XerXes Attack Video http://goo.gl/j8NQE