Re: DoS/DDoS Attack

From: Erik A. Onnen (eonnen_at_entessa.com)
Date: 01/15/05

  • Next message: Steven: "Re: DoS/DDoS Attack" 
    Date: Sat, 15 Jan 2005 12:19:05 -0600
To: <pen-test@securityfocus.com>

    Faisal Khan wrote:
    >
    > Well I agree we are not helpless, we personally use the Top Layer box
    > and its worked wonders.....have a half a dozen of them deployed (the IPS
    > 100 that is). We are now looking into a HA/LB setup of the IPS 5500.
    >
    > The only thing that gets to me is when large DDoS attacks come in - even
    > with GigaE connectivity, sometimes the setup rates are so high - the
    > boxes have a hard time keeping up with it. In this respect the Foundry's
    > ServerIron 850 is amazing. It has something called the Transaction Rate
    > Limiting, which we have configured for Port 80. If too many transactions
    > from a specific IP happen in a defined period (all parameters are set by
    > us), the device will instantly block the IP. For inquiring minds - the
    > maximum we've experienced in a DDoS attack was about 240Mbps sustained
    > coming in from what seemed to be a gazillion IPs. The attack lasted
    > about 2-3 days. Thank God for Foundry, which saved the day.
    >
    > What is truly frustrating is that the defences are at our perimeter -
    > getting to the source I guess is just a Herculean task - I read
    > somewhere that there are between 60 Million to 120 Million zombies out
    > there - cannot recall the source, but that's what I read.
    >
    > There are still many features that all the DDoS mitigation OEM have not
    > applied, that we have experienced and passed on as comments or as
    > "wish-list" to the OEMs - I guess sooner or later someone will take care
    > of them.
    >

    A sophisticated DDoS attempts to starve resources at two levels, network
    *and* server.

    The first level attempts to starve your upstream network bandwidth such
    that incoming traffic can't make it to the destination. This is the
    level that everyone has been looking so far and in general I agree with
    the appliance approach as a tool but it's just that, not a solution.

    Be careful with your policies for instantly blocking the incoming
    traffic based on simple rate rules. If an attacker is able to derive
    your rules (say they use one of their zombies to syn flood you and
    realize that they stop getting syn-acks), it would be trivial for them
    to use your rules against you by forging the source address of millions
    of machines thereby cutting off legitimate IPs and depending on the
    purposes of that web site you mention, cutting off customers. As long as
    an attacker can forge a source IP, it's nearly impossible to pinpoint
    the true origin of your attack. Even of you find a machine that is
    generating spoofed packets working with ISPs, it's likely just a node,
    then you need to find where it's getting instructions from which is
    likely an anonymous IRC channel and a dead end.

    Depending on budget, another tool to combat starvation of network
    resources is increasing the size of the upstream pipe to your servers.
    This one of the reasons that one of the largest pipes in the world flows
    into Redmond, to make it difficult to clog the pipe and prevent
    legitimate traffic from getting in.

    The best way to combat spoofed IP-based DDoS attacks is not something
    you have control over. The most effective way to fight these types of
    attacks is to prevent spoofing of source IPs all together through
    enforcing egress routing policies thereby making it possible to pinpoint
    and ban actual offenders. This needs to happen at the ISP and SAs level.
    Unfortunately few do enforce these policies, even less so on a global
    scale. If, in an ideal world all ISPs and SAs did enforce egress routing
    (I'm sure everyone on this list has implemented such a policy as a
    responsible security professional, right? :) ), you could then ban
    offending machines based on IPs knowing that traffic was coming from
    where it advertises and not a spoofed source. Microsoft attempted to
    mitigate this at the host level with XP2 by not allowing you direct
    socket access, but attackers can get around this easily by directly
    writing ethernet frames and skipping sockets all together.

    I haven't seen anyone mention host starvation on this thread which is
    also important. Some DDoS attacks can still deny legitimate users access
    to your service by SYN flooding you at a low transfer rate (bypassing
    rate rules on devices) from a myriad of spoofed IPs eating up all the
    available sockets on a server. You can guard against this by increasing
    the number of possible open sockets or even better by using SYN cookies
    if your host OS supports it. There are limits to their effectiveness but
    basically they allow you to have a half open TCP handshake without using
    as many system resources and starving the number of open sockets. Some
    firewalls can do this as well, it depends on your network configuration
    whether or not this another tool for you to look at.

    -erik

  • Next message: Steven: "Re: DoS/DDoS Attack"

    Relevant Pages

    • [fw-wiz] ***SPAM*** Re: Firewalls that generate new packets..
      ... stopping DDOS attacks directed AT you, from multiple sources, is something few firewalls can do if the attack is large/amplified/sustained. ... If someone really wants you badly and has the "connections" he can make life pretty miserable for you irregardless of the firewall you use. ... My experience is that many firewall admins worry about more than in part because DDOS attacks are familiar to the culture and the effects of a DDOS attack directed at your organization often has a financial and reputational impact. ... CAN prevent most DOS attacks. ...
      (Firewall-Wizards)
    • Re: new mimail variant
      ... Spammers release virus to attack Spamhaus.org ... Spamhaus.org's web server, www.spamhaus.org, and also attacks the web ... Spamhaus itself was subjected to the same intense dDoS attacks for 3 ...
      (comp.security.misc)
    • Re: Lets hear from the pros
      ... There is not a lot you can do to stop a DoS, ... this traffic DDoS attacks would be a thing of the past). ... I have seen DDoS attacks bad enough to make an ISP unstable (these are ...
      (alt.computer.security)
    • Re: PING : Bill / Stacey etc
      ... I'd be careful to judge anyone based on forums _without_ hearing the ... | was tightened a little to keep the DDoS attacks out. ... | incident, ...
      (alt.internet.search-engines)
    • Re: Hacking to Xp box
      ... Raw sockets can't be reenabled via command ... Firewall servicewe have to decide whether we need to stop or start ... Windows XP>restricts most of the attacks that use anonymous connections. ...
      (Pen-Test)