[Guest lecturer] Place: University of Twente Course: Cybercrime & Cybersecurity [Minor] Consortium: University of Twente, European Research Center for Information (ERCIS), Westfälische Wilhelms - Univerität Münster, Universität Innsbruck, University of Leicester

1. DDoS Attacks
&&
Booters
[Guest Lecture]
Jair Santanna
jairsantanna.com
j.j.santanna@utwente.nl
09/09/2015

2. To whom is addressed this presentation…

3. First of all…

4. My Goal…

5. Requirement…
What do you think is a Sniffer?

6. WIRESHARK

7. https://www.wireshark.org/download.html
*sudo apt-get install tcpdump
*sudo port install tcpdump

8. "Promiscuous Mode"

9. Ethernet
InternetProtocol(IP)
TransportProtocol(TCP,UDP)
Application(ex.HTTP)
Some basic concepts…
Content!!!!

10. Steps:
1) Start sniffing
2) Open a website
3) Discover the IP
address using a
CMD or a terminal
(host “website”)
4) Create a filter
on Wireshark
(ip.addr == “website_IP")
Example…

11. zoom-in…

12. Denial of Service
DoS

14. Time to make hands dirty!!!

15. http://sourceforge.net/projects/loic/files/latest/download
http://sourceforge.net/projects/javaloic/files/latest/download
OR
PLUS!

16. Distributed Denial of Service
DDoS

19. Direct Attacks

20. Indirect Attacks

21. Reflected Attacks

22. Request
ResponseServer Client
J
Amplification
=A x
Client-Server

23. ResponseServer Client
J
Request
Spoofed
Reflection and Amplification
Client
“J"

24. How much traffic can be generated using my
home connection and 100 BitTorrent servers?
[theoretically]
https://en.wikipedia.org/wiki/Denial-of-service_attack
http://www.speedtest.net/

25. 4,14 Mbps * [4 ; 54,3] * 100
[1.656 ; 22.480,2] Mbps
[1,6 ; 22] Gbps
(÷1024)

26. 2014: 400Gbps (NTP)
2013: 300Gbps (DNS)
2020:
.
.
.
1Tbps!?

28. Hacker
Who?

30. Anyone!

34. Booter (Black)List

35. 284 Booter domain names
111 online Booters

37. Attack Analyses

38. 14 Booters
Hired, Collected, and Analysed
UDP-based

39. # Booter URL
Offer
[Gbps]
1 boo ?
2 res 5
3 ano 5
4 des 25
5 fla ?
6 dej 10
7 reb Up to 3
8 gri 6
9 qua 1,5
10 oly Up to 3
11 ebo ?
12 vdo ?
13 resp 8
14 oni ?
Price [€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
€58,35

42. 3 reasons!

43. res oni

44. 3 1
oly vdo ebo
1

46. Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

47. # Booter URL
Offer
[Gbps]
1 boo ?
2 res 5
3 ano 5
4 des 25
5 fla ?
6 dej 10
7 reb Up to 3
8 gri 6
9 qua 1,5
10 oly Up to 3
11 ebo ?
12 vdo ?
13 resp 8
14 oni ?
Price [€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS
Request
ddostheinter.net
anonsc.com
anonsc.com
root-server.net
-
packetdevil.com
-
root-server.net
root-server.net
dig @8.8.8.8 -t ANY packetdevil.com
dig @8.8.8.8 -t ANY root-server.net
Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

48. DNS-based attacks
root-server.net
anonsc.com
ddostheinter.net
packetdevil.com
dig @8.8.8.8 -t ANY packetdevil.com
dig -t ANY packetdevil.com
dig @8.8.8.8 -t ANY root-server.netVRS
Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

49. CharGen-based attacks
Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

50. # Booter URL
Offer
[Gbps]
1 http://booter.tw ?
2 http://restricted-stresser.info 5
3 http://anonymous-stresser.net 5
4 http://destressbooter.com 25
5 http://flashstresser.net ?
6 http://dejabooter.com 10
7 http://rebel-security.com Up to 3
8 http://grimboot.com 6
9 http://quantumbooter.net 1,5
10 http://olympusstresser.org Up to 3
11 http://ebooter.5gbfree.com ?
12 http://vdoss.net ?
13 http://respawn.ca 8
14 http://onionstresser.com ?
Price [€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
€58,35
Unique IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS
Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

51. 8280
http://booter.tw http://restricted-stresser.info
7369
http://anonymous-stresser.net
6075
http://destressbooter.com
4486
http://flashstresser.net
3779
http://dejabooter.com
2970
http://rebel-security.com
281
http://grimboot.com
78
http://quantumbooter.net
*54
98%
Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

52. Santanna, J.J. et al. 2015. Booters - An Analysis of DDoS-as-a-Service Attacks. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

53. # Booter URL
Offer
[Gbps]
1 http://booter.tw ?
2 http://restricted-stresser.info 5
3 http://anonymous-stresser.net 5
4 http://destressbooter.com 25
5 http://flashstresser.net ?
6 http://dejabooter.com 10
7 http://rebel-security.com Up to 3
8 http://grimboot.com 6
9 http://quantumbooter.net 1,5
10 http://olympusstresser.org Up to 3
11 http://ebooter.5gbfree.com ?
12 http://vdoss.net ?
13 http://respawn.ca 8
14 http://onionstresser.com ?
Price [€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
€58,35
Unique IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS
29x

54. # Booter URL
Offer
[Gbps]
1 http://booter.tw ?
2 http://restricted-stresser.info 5
3 http://anonymous-stresser.net 5
4 http://destressbooter.com 25
5 http://flashstresser.net ?
6 http://dejabooter.com 10
7 http://rebel-security.com Up to 3
8 http://grimboot.com 6
9 http://quantumbooter.net 1,5
10 http://olympusstresser.org Up to 3
11 http://ebooter.5gbfree.com ?
12 http://vdoss.net ?
13 http://respawn.ca 8
14 http://onionstresser.com ?
Price [€]
10,90
1,95
3,12
3,89
3,89
3,89
3,00
3,90
8,00
4,90
free
3,11
3,90
3,90
€58,35
Unique IPs
8281
7369
6075
4486
3779
2970
281
78
54
Protocol
*DNS
*DNS
*DNS
*DNS
*Chargen
*DNS
*Chargen
*DNS
*DNS
9427x

56. Database Analyses

57. Example: http://pastebin.com/7CZBKXVL

58. 15 Databases

59. Trust??!!!

60. Timeline
Domain Registration
Domaintools
DNSDB
First attack
Passive DNS
Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

61. Generic schema
Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

62. User
Cu$tomer
Attacker

63. User

64. Cu$tomer

65. Attacker

66. User
Customer
Attacker
Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

67. PhD Life!

68. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

69. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

70. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

71. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

72. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

73. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

74. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

75. Santanna, J.J. et al. 2015. Inside Booters: An Analysis on Operational Databases. 14th IFIP/IEEE International Symposium on Integrated Network Management (IM) (2015).

76. Payment Systems

78. Mohammad Karami, Youngsam Park, Damon McCoy. Stress Testing the Booters: Understanding and Undermining the Business of DDoS Services. arXiv:1508.03410

79. DDoS Protection
Services

80. https://www.youtube.com/watch?v=Wr-
PrSqI16A&list=PLiq_fDYFoqMocM7ADQCTfGAdI9CXA-kUs 46:55-47:42

81. Showing [again] the
Matrix[if time]

82. DOWNLOAD…
+

84. DDoS Attacks
&&
Booters
[Guest Lecture]
Jair Santanna
jairsantanna.com
j.j.santanna@utwente.nl
09/09/2015

85. assignment:
How much network traffic a computer using your residential connection can
generate with 100 DNS servers as amplifiers?
- Print screen of your Internet SpeedTest;
- The amplification factor interval of DNS servers (considering DNSsec);
- The calculation and the result;
Who are the top 10 amplifier that sent more traffic?
- Choose on of the DNS-based attack available in http://www.simpleweb.org/
wiki/Traces#Booters_-_An_analysis_of_DDoS-as-a-Service_Attacks;
- Describe step-by-step how did you find the top 10 amplifiers using
Wireshark or TCPdump;
- Which DNS request was used in this attack;
- Where those top 10 amplifiers are located? (use https://
www.maxmind.com);