Exit from Hell? Reducing the Impact of Amplifjcation DDoS Attacks - - PowerPoint PPT Presentation

Exit from Hell?

Reducing the Impact of Amplifjcation DDoS Attacks

Marc Kührer, Thomas Hupperich, Christian Rossow, and Thorsten Holz

Presented By : Richie Noble

Distributed Denial-of-Service (DDoS) Attacks

• Known problem for many

years

– Diffjcult to distinguish

between an attack and simple overloading (“Slashdot efgect”)

– Many solutions proposed

• Simple DDoS attacks

like SYN fmooding are well-understood

http://upload.wikimedia.org/wikip edia/commons/3/3f/Stachledraht_ DDos_Attack.svg

Evolving DDoS Attacks

• Many DDoS attacks now

employ amplifjcation attacks

– Abuse of UDP-based network

protocols via refmection

– Attacker sends spoofed

packets to a large number of refmectors who send responses to the intended victim

– Responses are often much

larger than the requests, leading to amplifjcation

https://www.cert.be/fjles/dnsbad- large.png

Understanding the Problem

• As this type of attack is relatively new, the

authors wish to learn more about it

– Performed Internet-wide scans to identify

potential amplifjers

– Fingerprinted and categorized these systems – Peformed a global security notifjcation campaign – Analyzed potential for TCP amplifjcation attacks – Deploy remote scanning technique for

identifying systems that allow IP spoofjng

Outline

• Introduction
• Threat Model and Scanning
• NTP Case Study
• TCP-based Amplifjcation
• IP Address Spoofjng

Threat Model

• Prior work has identifjed 14 vulnerable UDP-

based protocols

– Ofger severe amplifjcation rates, up to a factor of

4,670

• Authors performed Internet-wide scan for

systems using seven of these protocols

– DNS, SNMP, SSDP, CharGen, QOTD, NTP, and

NetBIOS

– All run server-side, implying better connectivity and

with less IP address churn

Scanning Setup

• Authors developed an effjcient scanner to

identify amplifjers, following practices suggested by Durumeric et al.

• Scans run on a weekly basis from Nov. 22, 2013 –
• Feb. 21, 2014

– Scans spread out over 48 hour periods to avoid being

blacklisted

• Set up a reverse DNS record of the scanner

pointing to a web server presenting the project and opt-out information

Scanning Setup

• Sent a request for each protocol that can be used

to amplify traffjc

– NTP version, SSDP search, DNS A lookups, etc.

• During course of scans, received 90 emails from

administrators

– Excluded 91 IP prefjxes and 30 individual IP addresses

(~3.7 million total)

– Such addresses excluded from analysis, even if they

were not blacklisted in the beginning

• Discovered nearly 46 million potential amplifjers

Scanning Results

Amplifjer Classifjcation

Amplifjer Churn

Amplifjer Churn

Outline

• Introduction
• Threat Model and Scanning
• NTP Case Study
• TCP-based Amplifjcation
• IP Address Spoofjng

NTP Case Study

• NTP promising for amplifjcation attack

– monlist feature can be amplifjed by a factor

• f 4,670

– Very minimal IP address churn – Multiple amplifjcation vectors

• version feature can be amplifjed by a factor of 24

– Attackers have already used NTP

• A French hosting provider sufgered a 400 Gbps

amplifjcation attack in February, 2014

NTP Notifjcation Campaign

• Defjned two datasets of NTP amplifjers

– NTPver and NTPmon representing NTP servers vulnerable

to version and monlist requests, respectively

• Collaborated with many security organizations

– T

echnical advisories from CERT-CC, MITRE, Cisco's PSIRT

• Describe how to disable monlist and version
• Distributed lists of IP addresses in NTPmon dataset

among trusted institutions

Analyzing Campaign Success

• At end of weekly scanning in February,

2014

– NTPver dropped from 7,364,792 to 4,802,212

(33.9%)

– NTPmon dropped from 1,651,199 to 126,080

(92.4%)

• Another scan performed in June, 2014

showed a further decrease in NTPmon by ~40,000

Analyzing Campain Success

Geographic Distribution

Lessons Learned

• Such security notifjcation campaigns can

be very efgective

– Could potentially be applied to other security-

critical issues (e.g., heartbleed)

• CERT

s not as well connected as they need to be

Outline

• Introduction
• Threat Model and Scanning
• NTP Case Study
• TCP-based Amplifjcation
• IP Address Spoofjng

TCP-based Amplifjcation Attacks

• Authors have shown it is potentially possible

to stop UDP-based amplifjcation attacks

• Attackers have shown they are capable of

evolving their attacks as this occurs

• Can TCP-based protocols be abused similarly?

– UDP works well due to its connectionless nature – TCP is connection-oriented, making it less

intuitively susceptible

TCP Three-way-handshake

• General Process

– Client sends SYN packet to server – Server responds with SYN/ACK packet – Client completes setup with fjnal ACK packet

• Does not seem to allow for amplifjcation

– At most, one SYN/ACK packet will be sent to

victim

• Traffjc not amplifjed

Handshake Problems

• TCP will retransmit

segments that are not acknowledged

– Many popular TCP

stacks will retransmit SYN/ACK packets until :

(i) an ACK is received (ii) the connection times out (iii) The connection is closed via a RST packet

Handshake Problems

• Victims may not be

able to send a RST packet

– Could be overloaded – Attacker could

target an unassigned IP Address within a network

TCP Scanning

• Performed two Internet-wide SYN scans

– First without RSTs and the second with RSTs – Performed for HTTP, T

elnet, and CUPS

• Reached 66,785,451 HTTP hosts,

23,519,493 T elnet hosts, and 1,845,346 CUPS hosts.

TCP Results

TCP Results

Outline

• Introduction
• Threat Model and Scanning
• NTP Case Study
• TCP-based Amplifjcation
• IP Address Spoofjng

IP Address Spoofjng

• IP address spoofjng is the root cause for

amplifjcation attacks

• Up to now, only way to check if a system

allows IP address spoofjng is for an admin to test it themselves

• Authors work to deploy a scanner that works

remotely

– Enables them to identify thousands of systems

that support IP address spoofjng

IP Spoofjng Scanner

IP Spoofjng Scanner

Finding Spoofjng-Enabled Networks

• Authors found 581,777 DNS proxies which

had mismatched source IP addresses

– Even with extremely conservative estimates,

this implies there are thousands of systems

• ut there that allow for spoofed IP addresses

Finding Spoofjng-Enabled Networks

• Authors found 581,777 DNS proxies which

had mismatched source IP addresses

– Even with extremely conservative estimates,

this implies there are thousands of systems

• ut there that allow for spoofed IP addresses
• Only tells us which networks allow

spoofjng, not if they actually are

– Left as future work

Conclusion

• Identifjed and organized UDP-based protocols

that can be used for amplifjcation DDoS attacks

• Performed a successful campaign notifying the

public of vulnerabilities within NTP

• Identifjed potential amplifjcation attacks from

TCP-based protocols

• Deployed a scanner capable of identifying IP

address spoofjng-enabled networks

Questions?