Weapons of Mass Disruption by Roman Lara for OWASP San Antonio Chapter meetup
Report
michaelxin2015Follow
Oct. 6, 2018•0 likes•366 views
Weapons of Mass Disruption by Roman Lara for OWASP San Antonio Chapter meetup
Oct. 6, 2018•0 likes•366 views
Download to read offline
Report
Technology
We now live in a world where individuals or groups of individuals hold the same destructive power that only nation states once held. For as little as a couple of dollars an hour, fortune 500 companies and even nation states have been wiped off the Internet. The emergence of professional DDoS services is changing the threat landscape of the Internet once again. We'll take a look at DDoS tools and services and what we can do to combat them.
michaelxin2015Follow
More Related Content
Slideshows for you
How to launch and defend against a DDoSjgrahamc
Umbrella for MSPs: Enterprise Grade Malware Protection & ContainmentOpenDNS
Angler talkArtsiom Holub
Death of Web App FirewallBrian A. McHenry
Death of WAF - GoSec '15Brian A. McHenry
Мобильная связь небезопасна. Аргументы, подкрепленные фактамиPositive Hack Days
Similar to Weapons of Mass Disruption by Roman Lara for OWASP San Antonio Chapter meetup
DDoS Threat Landscape - Ron Winward CHINOG16Radware
Denial of Service - Service Provider OverviewMarketingArrowECS_CZ
What You Should Know Before The Next DDoS AttackCloudflare
Denial of services : limiting the threatSensePost
FS-ISAC 2014 Troubleshooting Network Threats: DDoS Attacks, DNS Poisoning and...ThousandEyes
DDoS Attacks - Scenery, Evolution and MitigationWilson Rogerio Lopes
Recently uploaded
FewShotExamples.pptxAlok Ranjan
AI and ML Series - Introduction to Generative AI and LLMs - Session 1DianaGray10
NTGapps DTB Platform.pdfMustafa Kuğu
Carrom Pool Mod APK.docxRayJ12
AI and ML Series - Leveraging Generative AI and LLMs Using the UiPath Platfor...DianaGray10
INASLA_AI and Landscape Architecture.pptxJonathon Geels
![[KCD GT 2023] Demystifying etcd failure scenarios for Kubernetes.pdf](https://cdn.slidesharecdn.com/ss_thumbnails/wc-kcdgt2023demystifyingetcdfailurescenariosforkubernetes-230819210453-e911a262-thumbnail.jpg?width=2048&height=1162&fit=bounds)
Weapons of Mass Disruption by Roman Lara for OWASP San Antonio Chapter meetup
- DDoS Weapons of Mass Disruption Created by: Roman Lara Sr. DDoS Security Engineer Modified Date: September 28, 2018 Classification: TLP Green
- 2 DoS vs DDoS www.rackspace.com DoS DDoS
- Targets 3www.rackspace.com Alcoy, P. (n.d.). 13th worldwide infrastructure Security Report [PDF]
- DDoS Evolution 4www.rackspace.com
- DDoS Tools
- 6 Rent-a-DDoS
- Firewall / Web-Application Firewall (WAF) • Application Vulnerability Threats - ✭✭✭ • Network Transmission Protocol Threats - ✭✭✭ • DoS Mitigation Capability - ✭✭ Ratings ✭ Weak ✭✭ Good ✭✭✭ Superior ✭✭✭✭ Best
- Load-Balancer • Internet Security Threats - ✭✭ • Network Protocol Threats - ✭✭✭ • DoS Mitigation Capability - ✭✭ Ratings ✭ Weak ✭✭ Good ✭✭✭ Superior ✭✭✭✭ Best
- IDS/IPS • Application Vulnerability Threats - ✭✭✭✭ • Network Protocol Threats - ✭✭ • DoS Mitigation Capability - ✭✭ Ratings ✭ Weak ✭✭ Good ✭✭✭ Superior ✭✭✭✭ Best
- Volumetric Attack 10www.rackspace.com • Easy to create attack mostly UDP traffic • ICMP and TCP SYN-ACK • Designed to saturate and overwhelm network resources, circuits etc by brute force • Small request that generates a significantly-larger response/reply • Widespread collateral damage • Common Names NTP/DNS/SSDP/, Chargen Attacks, Memcached, Ping Attack, Smurf Attack, reflection attacks, UDP flood, Reflection/Amplification Attack
- Volumetric Attack 11www.rackspace.com Warbot attack tool
- Volumetric Attack UDP/80 – UDP/123, ~50 bytes/packet Spoofed Spoofed Source: 172.19.234.6 Destinations: Multiple NTP servers NTP query: monlist UDP/123 – UDP/80, ~468 bytes/packet Non-Spoofed Sources: Multiple NTP Servers Destinations : 172.19.234.6 Reply: Up to 500 packets of monlist replies Internet accessible Servers, Routers Home CPE devices, etc. DDoS 12www.rackspace.com Impact Impact Impact Impact Impact 172.19.234.6/32
- State-exhaustion 13www.rackspace.com • Flood, TCP SYN, and Protocol Attacks • Flood of traffic for one or more IP protocol and protocol ports • Designed to look like normal traffic • Reflection attacks • May use spoofed source addresses or non-spoofed • Common Names • TCP Idle attacks, Challenge Collapsar (CC) attack, SYN Flood Connection Attacks
- State-exhaustion 14www.rackspace.com Low Orbit Ion Cannon (LOIC)
- State-exhaustion 15www.rackspace.com 172.19.234.6/32 SYN SYN-ACK ACK Connection Establish Down Available Connections TCP/*** – TCP/80 (e.g.), 64 bytes/packet Spoofed Sources Destination: 172.19.234.6
- Application Attacks 16www.rackspace.com • Designed to overwhelm applications • Targeted at a particular software component • Common attack targets HTTP servers, DNS resolvers, and SIP gateways • Low packet rate and very stealthy • Common Names • LOIC (Low Orbit Ion Cannon), HOIC (High Orbit Ion Cannon), HTTP GET floods, SIP Invite floods, DNS amplification attacks, R-U-Dead-Yet?
- Application Attacks 17www.rackspace.com Slowloris Attack tool
- Application Attacks Single Host 18www.rackspace.com 172.19.234.6/32 SYN SYN-ACK ACK Connection Establish Down Connection Pool TCP/*** – TCP/80 (e.g.), 64 bytes/packet Non Spoofed Sources Destination: 172.19.234.6 Slowloris Attack Methodology
- Application Attacks 19www.rackspace.com Dirt Jumper
- Attacks Botnet 20www.rackspace.com 172.19.234.6/32 SYN SYN-ACK ACK Connection Establish Down System Resources HTTP GET /index.php HTTP GET /index.php VERY LARGE FILE HTTP GET /index.php VERY LARGE FILE HTTP GET /index.php VERY LARGE FILE HTTP G ET /index.php VERY LARGE FILE HTTP G ET /index.php VERY LARGE FILE HTTP GET /index.php VERY LARGE FILE HTTPGET/index.phpVERYLARGEFILE HTTPGET/index.phpVERYLARGEFILE HTTPGET/index.phpVERYLARGEFILE HTTPGET/index.phpVERYLARGEFILE Malicious Signature: (Dirt Jumper) GET / HTTP/1.0 <-- randomized variable Host: [domain name] Keep-Alive: 300 Connection: keep-alive User-Agent: Opera/9.00 (Nintendo Wii; U; ; 1309-9; en) <-- randomized variable
- Question