2019년 AWS Summit에서 DDoS 공격 동향 변화에 대해 발표한 자료입니다. 주로 보이는 DDoS 공격의 크기 변화, 패턴 변화, 공격 성공 사례(?)와 방어 성공 사례, 실전 방어 전략 등을 담았습니다. 업무에 도움이 되시길 바랍니다.

1. S U M M I T
S E O U L
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

2. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Modern DDoS Trends
유지영
Solutions Engineer
Cloudflare

3. 발표자료 다운로드
발표자료 및 녹화 동영상은 AWS
Korea 공식 소셜 채널에서
확인하실 수 있습니다.
© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

4. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

5. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

6. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

7. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The Internet is for everyone
(to get attacked on).

8. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

9. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

10. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
집에 전기 모터를 몇 개나 갖고 계신가요?

11. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
블렌더, 착즙기, 토스터, 에어컨, 선풍기,
헤어드라이어, 전화기, 핸드폰, 세탁기, 드라이어,
식기세척기, 면도기, 진동 칫솔, 진동 파운데이션,
기타 등등...

12. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
집에 컴퓨터를 몇 대 갖고 계신가요?

13. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
사물에 컴퓨터를 더한다는 것은
컴퓨터의 모든 문제도 더한다는 뜻입니다

14. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

15. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

16. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

17. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

18. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

19. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Github
1.3 terabits / second

20. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.

21. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
The old techniques still work

22. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Map of the Internet

23. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attack samples

24. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attack samples

25. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attack samples

26. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attack samples

27. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attack samples

28. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attack samples

29. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
반사 / 증폭 공격
Reflection / Amplification

30. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
3774 udp 123 NTP
1692 udp 1900 SSDP
253 udp 53 DNS
42 udp 27015 SRCDS
20 udp 19 Chargen
19 udp 20800 Gaming
16 udp 161 SNMP
12 udp 389 CLDAP
11 udp 111 Sunrpc
10 udp 137 Netbios

31. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
작은 요청으로 큰 응답을 끌어내기

32. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
작은 요청으로 큰 응답을 끌어내기

33. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.© 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
OSI Model

34. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Attackers Moving Up The Stack - mpps to mrps

35. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
2019 – SSDP의 감소 추세
Simple Service Discovery Protocol
Protocol used by UPnP on port 1900
Average attack lasted 24 minutes
Longest lasted 4 hours
Average attack is 12 Gbps
Largest was 112 Gbps

36. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
2019 – memcached의 감소 추세
UDP 11211 amplification
87K+ public vulnerable servers were found
15B request can cause 750+KB response (51,200x amplification)
the industry reacted rapidly and cleaned up the vulnerable servers

37. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
2019 – Multi Vector 공격

38. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
미국 대선 DDoS 사례

39. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
트럼프 외 후보자 사이트의 총 요청 차단 건수
Blocked requests against US presidential candidates other than Donald Trump

40. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
donaldjtrump.com 의 일별 요청 차단 건수
Blocked requests against donaldjtrump.com by day

41. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
donaldjtrump.com 과 타 후보 10인 사이트의 공격 건수 비교
Attacks against donaldjtrump.com, trump.com and the ten others

42. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
donaldjtrump.com 공격 추세와 미 대선 타임라인
donaldjtrump.com 공격 추세와 미 대선 타임라인

43. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
donaldjtrump.com 공격 추세와 미 대선 타임라인
donaldjtrump.com 공격 추세와 미 대선 타임라인

44. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
trump.com 의 WAF 차단 추이
donaldjtrump.com 공격 추세와 미 대선 타임라인
54.4% 워드프레스 취약점 이용

45. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
한국 DDoS 사례

46. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Global Request Count over Time

47. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Request Repartition over the Planet

48. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Bandwidth over Time/Status Code Repartition

49. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Pattern Matching

50. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Rule Deployment 1-match;then drop

51. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Rule Deployment 2-rate limit
allow
drop

52. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
DDoS 방어 서비스 사용; 호스팅 사업자 혹은 외부 솔루션
HTTP rate limiting; 외부 서비스 혹은 NGINX 모듈
충분한 대역폭 확보
firewall/iptables 에서 미사용 포트를 모두 차단
4가지 방어 전략

53. © 2019, Amazon Web Services, Inc. or its affiliates. All rights reserved.
감사합니다!