PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących ataki DDoS
•
0 likes•62 views
Przedstawiony zostanie zestaw ataków stosowanych obecnie w kampaniach DDoS. Jakie narzędzia są stosowane najczęściej, jakie sporadycznie. Pokazane zostanie, które elementy architektury sieciowej mogą zostać zaatakowane i z jakim skutkiem.
Recommended
Recommended
More Related Content
Similar to PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących ataki DDoS
Similar to PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących ataki DDoS (20)
Recently uploaded
Recently uploaded (20)
PLNOG19 - Sławomir Janukowicz - Zestaw uzbrojenia na wyposażeniu wykonujących ataki DDoS
- 1. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY Zestaw uzbrojenia na wyposażeniu wykonujących ataki DDoS Sławomir Janukowicz sjanukowicz@arbor.net +48734453354
- 2. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 2 INFORMATION SOURCE ARBOR ATLAS
- 3. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 3 Poland max pps 0 5 10 15 20 25 30 35 40 45 50 2016 September 2016 October 2016 November 2016 December 2017 January 2017 February 2017 March 2017 April 2017 May 2017 June 2017 July 2017 August MAX Mpps
- 4. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 4 Poland max bandwidth 0 20 40 60 80 100 120 140 160 180 200 2016 September 2016 October 2016 November 2016 December 2017 January 2017 February 2017 March 2017 April 2017 May 2017 June 2017 July 2017 August MAX Gbps
- 5. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 5 Poland UDP over 6 minutes and over 1Gbps 0 200 400 600 800 1000 1200 1400 1600 1800 2000 2016 September 2016 October 2016 November 2016 December 2017 January 2017 February 2017 March 2017 April 2017 May 2017 June 2017 July 2017 August events per month
- 6. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 6 Poland NTP or DNS amplification over 6 minutes and over 1Gbps 0 20 40 60 80 100 120 140 160 2016 September 2016 October 2016 November 2016 December 2017 January 2017 February 2017 March 2017 April 2017 May 2017 June 2017 July 2017 August events per month
- 7. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 7 Poland TCP SYN over 6 minutes and over 100kpps 0 50 100 150 200 250 300 2016 September 2016 October 2016 November 2016 December 2017 January 2017 February 2017 March 2017 April 2017 May 2017 June 2017 July 2017 August events per month
- 8. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 8 Poland TCP RST over 6 minutes over 100kpps 0 5 10 15 20 25 30 35 40 45 2016 September 2016 October 2016 November 2016 December 2017 January 2017 February 2017 March 2017 April 2017 May 2017 June 2017 July 2017 August events per month
- 9. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 9 WHY
- 10. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 10 Attacks reasons 63 42 38 32 30 29 26 25 24 24 19 19 13 11 0 10 20 30 40 50 60 70
- 11. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 11 TOOLS
- 12. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 12 Google and some cash • Magic world “Network stresser” • Sign for service and pick your target
- 13. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 13 str3ssed.me
- 14. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 14 Social network • Low Orbit Ion Cannon • High Orbit Ion Cannon
- 15. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 15 Advanced ones • TCP ACK attacks • For packets generator each packet type is the same processing power • For firewall (for example) dropping UDP with random ports or dropping TCP ACK for open service – big difference
- 16. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 16 Unprecedented DDoS attack sizes IoT: Mirai 2016 Mirai infections December 2016 • 1M login attempts from 11/29 to 12/12 from 92K unique IP addresses • More than 1 attempt per minute in some regions
- 17. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 17 https://hdwallsbox.com/army-undead-fantasy-art-armor-skeletons-artwork-warriors-wallpaper-122347/ Game of Thrones 2011 IoT: Mirai next gen • The Zombie horde A single infected Windows computer has now the capability to infect and subvert the ”innocent” IoT population into zombies, all under the control of the attacker. • The attackers weapon arsenal The attacker can now use the zombies to: 1. Infect other IoT devices. 2. Launch outbound attacks against external targets. 3. Perform reconnaissance on internal networks, followed by targeted attacks against internal targets.
- 18. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY 18 Call from inside the house • More attack options • Reflection attacks using UDP packets with spoofed source IP addresses • Application level attacks (HTTP/SIP attacks). • Pseudo random DNS label prefix attacks against DNS servers. • This attack traffic will quickly fill up any internal WAN links and will also will cause havoc with any stateful device on the path, including NGFWs.
- 19. ©2017 ARBOR® CONFIDENTIAL & PROPRIETARY Q&A / THANK YOU 19 Contact Information: Sławomir Janukowicz sjanukowicz@arbor.net +48734453354