ENOG 12, 4 October 2016. Speaker: Alexander Azimov, CTO at Qrator Labs

1. qrator.net 2016
DDOS ATTACKS IN 2017:
BEYOND PACKET FILTERING
Artyom Gavrichenkov
Qrator Labs
ag@qrator.net

2. qrator.net 2016
PARENTAL ADVISORY

3. qrator.net 2016
3
786
1038
1993
477
370
845
_2012_ _2013_ _2014_ _2015_
Volumetric
TCP-based
HERE BE
DRAGONS

4. qrator.net 2016
4
786
1038
1993
477
370
845
_2012_ _2013_ _2014_ _2015_
Volumetric
TCP-based
HERE BE
DRAGONS

5. qrator.net 2016
5
786
1038
1993
477
370
845
_2012_ _2013_ _2014_ _2015_
Volumetric
TCP-based
HERE BE
DRAGONS

6. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources

7. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth

8. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth:
ICMP flood, UDP flood, SYN flood…

9. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth:
ICMP flood, UDP flood, SYN flood…
Amplification: NTP, DNS, SNMP, SSDP, ICMP, NetBIOS,
RIPv1, PORTMAP, CHARGEN, QOTD...

10. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth:
ICMP flood, UDP flood, SYN flood…
Amplification: NTP, DNS, SNMP, SSDP, ICMP, NetBIOS,
RIPv1, PORTMAP, CHARGEN, QOTD...
• TCP finite state machine implementation attacks

11. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth:
ICMP flood, UDP flood, SYN flood…
Amplification: NTP, DNS, SNMP, SSDP, ICMP, NetBIOS,
RIPv1, PORTMAP, CHARGEN, QOTD...
• TCP finite state machine implementation attacks:
SYN flood, ACK flood, TCP connection flood…

12. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth:
ICMP flood, UDP flood, SYN flood…
Amplification: NTP, DNS, SNMP, SSDP, ICMP, NetBIOS,
RIPv1, PORTMAP, CHARGEN, QOTD...
• TCP finite state machine implementation attacks:
SYN flood, ACK flood, TCP connection flood…

13. qrator.net 2016
Distributed Denial-of-Service attack
• An attempt to make a network resource unavailable
by exhausting its resources:
• Bandwidth:
ICMP flood, UDP flood, SYN flood…
Amplification: NTP, DNS, SNMP, SSDP, ICMP, NetBIOS,
RIPv1, PORTMAP, CHARGEN, QOTD...
• TCP finite state machine implementation attacks:
SYN flood, ACK flood, TCP connection flood…
• Application-specific bottlenecks (HTTP server, DBMS, caches, etc)

14. qrator.net 2016
Packet-based DDoS
Target
Ping*

15. qrator.net 2016
Packet-based DDoS
Target
Ping*
Ping*

16. qrator.net 2016
Packet-based DDoS
Target
Ping*
Ping*
Ping*
Ping*

17. qrator.net 2016
Packet-based DDoS
Target
Ping*
Ping*
Ping*
Ping*
Ping*
Ping*
Ping*

18. qrator.net 2016
L7 DDoS
Target
GET*

19. qrator.net 2016
L7 DDoS
Target
GET*
GET*

20. qrator.net 2016
L7 DDoS
Target
GET*
GET*
GET*
GET*

21. qrator.net 2016
L7 DDoS
Target
GET*
GET*
GET*
GET*
GET*
GET*
GET*

22. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication

23. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!

24. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!
• Amp-vulnerable server may be identified by source port
=> Flow Spec solves problems!

25. qrator.net 2016
BGP Flow Spec?

26. qrator.net 2016
BGP Flow Spec!

27. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!
• Amp-vulnerable server may be identified by source port
=> Flow Spec solves problems!

28. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!
• Amp-vulnerable server may be identified by source port
=> Flow Spec solves problems!

29. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!
• Amp-vulnerable server may be identified by source port
=> Flow Spec solves problems!

30. qrator.net 2016
Wordpress Pingback
GET /whatever
User-Agent: WordPress/3.9.2;
http://example.com/;
verifying pingback
from 192.0.2.150
• 150-170 vulnerable servers
at once
• SSL/TLS-enabled

31. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers

32. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers
Drupal?

33. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers
Joomla?
Drupal?

34. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers
Joomla?
Drupal?
Mediawiki?

35. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers
Joomla?
Drupal?
Sharepoint?
Mediawiki?

36. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers
Joomla?
TinyCMS?
Drupal?
ModX?
Sharepoint?
Mediawiki?

37. qrator.net 2016
Wordpress Pingback
• Millions of vulnerable servers
Joomla?
TinyCMS?
Drupal?
ModX?
Sharepoint?
Mediawiki?

38. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!
• Amp-vulnerable server may be identified by source port
=> Flow Spec solves problems!

39. qrator.net 2016
Packet vs Request
• 3-way handshake
=> SYN cookies
=> IP Authentication
• IP Authentication not available in most* UDP-based protocols
=> Spoofing
=> UDP Amplification!
• Amp-vulnerable server may be identified by source port
=> Flow Spec solves problems!

40. qrator.net 2016
40
300 Mbps
30 Gbps
Amplification

41. qrator.net 2016
41
2000 Mbps
200 Gbps
Amplification

42. qrator.net 2016
42

43. qrator.net 2016
43
2000 Mbps
200 Gbps
Amplification

44. qrator.net 2016
44
?
500 Gbps
Amplification

45. qrator.net 2016
Pure TCP-based attack today

46. qrator.net 2016
The Void
• To survive TCP- and HTTPS-based attacks,
one needs a session-capable and TLS-capable DPI
• To survive large botnets,
one needs a behavioral analysis and
correlation analysis built into that DPI
• That’s extremely expensive for a large network

47. qrator.net 2016
The Void
• Any service offering SLA must do all of this
• A service lacking any of those features is best effort
• No one likes best effort services

48. qrator.net 2016
The Cure
• BCP 38 is no cure*
• IPv6 is no cure
• Time to fight for yourselves
• Care about other customers
• It’s every man for himself now

49. qrator.net 2016
The Future

50. qrator.net 2016
Thank you, and good luck!
mailto: Artyom Gavrichenkov <ag@qrator.net>