20140313_tu_delft
•
1 like•228 views
Presentation about Booters to the research group of Prof.dr. Michel van Eeten at TU Delft (The Netherlands).
![The DDoS-as-a-Service Phenomenon
[Jair Santanna]
Design and Analysis of
Communication Systems
Less than 5 Dollars to attack everyone
Internet Management
and Measurement (IMM)
—](https://image.slidesharecdn.com/20140313tudelft-160310011332/85/20140313_tu_delft-1-320.jpg)
Recommended
Recommended
More Related Content
What's hot
What's hot (17)
Viewers also liked
Viewers also liked (8)
Similar to 20140313_tu_delft
Similar to 20140313_tu_delft (20)
More from University of Twente
More from University of Twente (11)
Recently uploaded
Recently uploaded (16)
20140313_tu_delft
- 1. The DDoS-as-a-Service Phenomenon [Jair Santanna] Design and Analysis of Communication Systems Less than 5 Dollars to attack everyone Internet Management and Measurement (IMM) —
- 2. Denial of Service "1 against 1"
- 3. Application layer Infrastructure layer Group of attacks
- 4. ApplicationInfrastructure time resourcescomputingpackets X XDifficult to Stop Ease to Detect Difficult to Detect Ease to Stop
- 5. Type of Attacks SYN [Prolexic Global DDoS attack report]s GET SSL GET Slowloris ICMP ACK IGMP RIPUDP UDP Fragmented TCP Fragmented HTTP Head RESET FIN PUSH POST SSL POST DNS NTP SNMPv2 NetBIOS SSDP CharGEN QOTD BitTorrent Kad Quake Network Protocol Steam Protocol
- 6. Type of Attacks per Group SYN GET SSL GET SlowlorisICMP ACK IGMP RIP UDP UDP Fragmented TCP Fragmented HTTP HeadRESET FIN PUSH POST SSL POSTDNS NTP SNMPv2 NetBIOS SSDP CharGEN QOTD BitTorrent Kad Quake Network Protocol Steam Protocol Applicationlayer Infrastructurelayer
- 7. Type of Attacks per Group SYN GET SSL GET SlowlorisICMP ACK IGMP RIP UDP UDP Fragmented TCP Fragmented HTTP HeadRESET F PUSH POST SSL POSTDNS NTP SNMPv2 NetBIOS SSDP CharGEN QOTD BitTorrent Kad Quake Network Protocol Steam Protocol Applicationlayer Infrastructurelayer
- 8. Spoofed requestresponse Reflection Attacks DNS NTP SNMPv2 NetBIOSSSDP CharGEN QOTD BitTorrentKad Quake Network Protocol Steam Protocol normal situation
- 9. Denial of Service "1 against 1"
- 10. Denial of ServiceDISTRIBUTED "∞" against 1
- 11. - Services been misused - Compromised systems
- 12. worse than this!
- 13. *Amplification Factor DNS NTP SNMPv2 NetBIOSSSDP CharGEN QOTD BitTorrentKad Quake Network Protocol Steam Protocol 54x 556.9x 6.3x3.8x 30.8x 358.8x 140.3x 3.8x 16.3x 63.9x 5.5x [Cert.us: TA14-017A] maximun
- 16. 2013-300Gbps 2014-400Gbps 2020-1TbpsRight? … NO!2014 1Tbps OR higher DNS NTP [or not] [4,529] [30,956]-> ~28 million -> 94,534 IC measured 20 million
- 17. lets change a little bit the topic...
- 19. DDoS Attack The DDoS-as-a-Service Phenomenon Less than 5 Dollars to attack everyone
- 20. DDoS Attack The DDoS-as-a-Service Phenomenon Less than 5 Dollars to attack everyone No more opponents!! No more ONLINE exams!! More attention to your presentation!!! why not?
- 21. DDoS Attack The DDoS-as-a-Service Phenomenon Less than 5 Dollars to attack everyone Economic Impact!!
- 22. Booters Online Tools that offer DDoS-as-a-$ervice. ~U$ 5 "Booter" "Stresser" "DDoSer" "DDoS-as-a Service" "DDoS-for-hire"
- 23. Front-end Customer Booter Target Back-end DNS Server charGEN Server Bot (from botnet) How Booters work?
- 24. Characterise and Mitigate The DDoS-as-a-Service Phenomenon MeasurementsCrawler & Classifier Measurements Survey Measurements My goal as a Ph.D:
- 26. Some Results...
- 27. 59 Booters listed since July 2013 [Crawler] 14 Booters hired and tested
- 28. # DDoS as a $ervice Offer [Gbps] 1 http://booter.tw ? 2 http://restricted-stresser.info 5 3 http://anonymous-stresser.net 5 4 http://destressbooter.com 25 5 http://flashstresser.net ? 6 http://dejabooter.com 10 7 http://rebel-security.com Up to 3 8 http://grimboot.com 6 9 http://quantumbooter.net 1,5 10 http://olympusstresser.org Up to 3 11 http://ebooter.5gbfree.com ? 12 http://vdoss.net ? 13 http://respawn.ca 8 14 http://onionstresser.com ? price [€] 10,90 1,95 3,12 3,89 3,89 3,89 3,00 3,90 8,00 4,90 free 3,11 3,90 3,90 €58,35 14 Booters hired and tested
- 29. http://respawn.ca http://onionstresser.com 14 Booters hired and tested
- 30. 3 1 93.174.93.114:80 NL-ECATEL Netherlands, Europe http://olympusstresser.org http://vdoss.net http://ebooter.5gbfree.com 1 190.231.55.202:5900 ->VNC Apolo -Gold-Telecom-Per Telecom Argentina S.A. 14 Booters hired and tested
- 31. # DDoS as a $ervice Offer [Gbps] 1 http://booter.tw ? 2 http://restricted-stresser.info 5 3 http://anonymous-stresser.net 5 4 http://destressbooter.com 25 5 http://flashstresser.net ? 6 http://dejabooter.com 10 7 http://rebel-security.com Up to 3 8 http://grimboot.com 6 9 http://quantumbooter.net 1,5 10 http://olympusstresser.org Up to 3 11 http://ebooter.5gbfree.com ? 12 http://vdoss.net ? 13 http://respawn.ca 8 14 http://onionstresser.com ? UT [Gbps] 0,07 1,22 0,38 0,72 3,0 1,1 1,0 0,37 0,37 SURFnet [Gbps] 0,112 1,952 0,608 1,152 4,8 1,76 1,6 0,592 0,592 IPs involved * 8,28 7,369 6,075 4,486 3,779 2,97 281 78 54 Attacks based on *DNS *DNS *DNS *DNS *Chargen *DNS *Chargen *DNS *DNS price [€] 10,90 1,95 3,12 3,89 3,89 3,89 3,00 3,90 8,00 4,90 free 3,11 3,90 3,90 €58,35 33.372 14 Booters hired and tested
- 33. http://booter.tw http://restricted-stresser.info http://anonymous-stresser.net http://destressbooter.com http://flashstresser.net http://dejabooter.com http://rebel-security.com http://grimboot.com http://quantumbooter.net **Traffic[bytes]pertime[s]
- 34. http://booter.tw http://restricted-stresser.info http://anonymous-stresser.net http://destressbooter.com http://flashstresser.net http://dejabooter.com http://rebel-security.com http://grimboot.com http://quantumbooter.net **#PacketssendperIP
- 35. Current Step...
- 36. Current Step... Crawler & Classifier Measurements Survey Popularity and Characteristics of Booters
- 37. Thanks for your attention!