The last several years have seen a dramatic surge in the effective use of Distributed Denial of Service (DDoS) as a weapon of cyber attack. These attacks have grown from humble beginnings as an occasional nuisance to one of the biggest threats to network stability and security. No longer only the domain of elite attackers, today’s DDoS attacks can be easily launched by those with limited technical skills, and the results can seriously impair the operations of the victim.

1. DDOS — Nuisance or Threat?
© Norse
Harold Teunissen & Roland van Rijswijk-Deij
TECHEX14, Indianapolis, October 2014

2. Serving Dutch research & education
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
2

3. SURF as umbrella
• All ICT activities for Higher Education and Research in the
Netherlands are under the SURF umbrella
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
3
Scientific Computing
& Big Data
Commercial ICT
Products & Services
National Research &
Education Network
eScience Collaboration
and Tools

4. Absolute awareness
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
4

5. We take security serious
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
5

6. Vision
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
6

7. Immunity
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
7

8. Level of protection
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
8

9. Security & Privacy Program
SAFE AND SECURE ENVIRONMENT
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
9
AWARENESS
STANDARDS
FREE
INTERNET
COMMUNITIES SERVICES

10. What do we see?
FAIR SHARE?
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
10
Universities Attacks
Attacks
Vocational
Education
High Attacks
Schools

11. Regular user
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
11
DUTCH PUBLIC BROADCASTER

12. Regular user
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
12
DUTCH PUBLIC BROADCASTER
Winter
Olympics
World Cup
Soccer

13. Regular user
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
13
DUTCH PUBLIC BROADCASTER
MH17

14. Not every spike is an attack
A Large University
DDOS Astronomers
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
14

15. What do we see?
• DDoS attacks mostly directed against schools
• Majority are Bandwidth Denial-of-Service attacks
- Usually some form of amplification, mostly NTP, DNS,
CharGen, we also now see some UPnP based stuff
• Not every traffic spike is an attack
- Monitor for anomalous events (e.g. excess UDP/ICMP
traffic)
- Manual analysis by our CSIRT
• Attacks in Tens-of-Gigabits order of magnitude
• Many attacks rely on “DDoS-for-Hire” a.k.a.
Booters and are often inside jobs
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
15

16. Keep your friends close...
•We were monitoring for a particular attack
(because it abused some of our infrastructure)
•One of our customers appeared in a list of
spoofed IP addresses for this particular attack
•And was the victim of a number of DDoS attacks
•The timing of the attacks was rather suggestive...
Always during school hours!
•Let’s have a look at what the school found
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
16

17. Let’s see what happens if...
•The external NAT IP address is changed
–Will the attack follow?
•We look at the time lines
–Comparing attack times against class schedule
•We ask teachers about suspicious behaviour
–Are there signs that the culprit is among the students?
•Policy-Based Routing (PBR)
–Giving a suspected class a different external IP address
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
17

18. Caught after bragging
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
Courtesy: Graafschap College
18

19. Is this a problem?
• If an attack originates from our network that is
very bad — we have big pipes…
• The example inside job caused 1000s of students
and 100s of staff to go home because they could
no longer work
• Students need to learn that they are committing
a criminal offense
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
19

20. What do we do?
• Our CSIRT keeps vigil 24x7
• We constantly monitor our and our
constituency’s infrastructure for abuse
- Concerted efforts to combat e.g. open DNS resolvers and
vulnerable NTP servers
• We report criminal offenses to the authorities and
encourage our constituency to do so too
- We collaborate with law enforcement and the public
prosecutor’s office
• We (pre-)wash traffic
- using rate limiting, filters, …
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
20

21. Cybersave Yourself
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
21

22. Research
• We actively collaborate with academic groups
and non-profit organisations on DDoS research
• Study on “DDoS-for-Hire” services
• Support DDoS Defense research
• Legal expert opinions on e.g. botnet
take-downs
• Share operational network data with researchers
and develop policy for ethical data sharing
• Software Defined Security
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
22

23. Upcoming Services
• Protection as a Service a.k.a. DIY Cyber Laundry
• Centralised firewall
• Pentesting
• Maturity scans and auditing (ISO2700x)
• Security games
DDOS Nuisance or Threat — TECHEX14— Indianapolis, IN — October 2014
23

24. harold.teunissen@surfnet.nl haroldteunissen