Who is Arbor Networksarchivos.usuaria.org.ar/documentos/DDoS.pdf · Arbor Networks Overview . DDoS . Advanced Threats Arbor Cloud . Cloud Signaling +140 Tbps Visibility . Good traffic
Post on 30-Sep-2020
4 Views
Preview:
Transcript
DDoS Introduction We see things others can’t
Pablo Grande pgrande@arbor.net
DoS & DDoS…. Unavailability! Interruption!
• Denial of Service (DoS) attack is an attempt to make a machine or network resource unavailable to its intended users, such as to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet
• A Distributed Denial of Service (DDoS) is where the attack source is more than one, often thousands of, unique IP addresses. It is analogous to a group of people crowding the entry door or gate to a shop or business, and not letting legitimate parties enter into the shop or business, disrupting normal operations.
DDoS type of Attacks
3
1. Volumetric Attacks Also known as “floods,” the goal of this type of attack is to cause congestion and send so much traffic that it overwhelms the bandwidth of the site. Attacks are typically executed using botnets, an army of computers infected with malicious software and controlled as a group by the hacker 2. TCP State-Exhaustion Attacks (Statefull devices) This type of attack focuses on actual web servers, firewalls and load balancers to disrupt connections, resulting in exhausting their finite number of concurrent connections the device can support 3. Application Layer Attacks This type of attack, also known as Layer 7 attacks, specifically targets weaknesses in an application or server with the goal of establishing a connection and exhausting it by monopolizing processes and transactions. These sophisticated threats are harder to detect because not many machines are required to attack, generating a low traffic rate that appears to be legitimate.
DDoS 10 years Timeline
4
On New Year’s eve, the BBC website and iPlayer service went down due to a massive Distributed Denial of Service (DDoS) attack. The attack peaked up to 602 Gbps, according to the claims made by the New World Hacking group, who took the responsibility of the attack. In another recent attack, the Republican presidential candidate Donald Trump’s main campaign website was also targeted by the same group.
DDoS Facts
5
FREQUENT & COMPLEX by COMBINATION
DDoS Drivers/Motivators
6
30%
25% 20%
13%
12%
BotNets
Loud Quiet
ATTACK SPECTRUM
The New Breed of Advanced Threats
Arbor Networks Overview
DDoS Advanced Threats Arbor Cloud Cloud Signaling
+140 Tbps Visibility
Good traffic Malicious traffic & malware
Public Clouds
Corporate Networks
Mobile Carrier
Private Clouds
Service Provider
User / Attacker
Internal Employee
Spectrum Peakflow MNA
Peakflow SP/TMS ATLAS
Peakflow SP/TMS
PravailAPS
PravailAPS
Arbor Network-Wide Product Portfolio
Spectrum
90% of Gartner Cloud and Web Hoster MQ Providers
100% of Tier 1 and 60% of Tier 2 Service Providers
9/10 of Top Online Brands
Arbor: Securing the World’s Largest Networks
100% Percentage of world’s Tier 1 service providers who are Arbor customers
130 Number of countries with Arbor products deployed
+140 Tbps
Amount of global traffic monitored by the ATLAS security intelligence initiative right now – 330+ ISPs sharing real-time data Very Significant portion of global Internet traffic!
#1
Arbor market position in Carrier, Enterprise and Mobile DDoS equipment market segments – 67% of total market [Infonetics Research]
Number of years Arbor has been delivering innovative security and network visibility technologies & products
16
9
ATLAS: Active Threat Level Analysis System
ATLAS sensors are deployed in global internet darknet space to discover and classify attack activity
The information is sent to an ATLAS central repository where it is combined with Arbor, third-party, and vulnerability data
ASERT analyzes combined data and converts into actionable intelligence which is posted on the ATLAS public portal and updated to customer’s devices
Peakflow SP Pravail NSI
ISP Network DARKNET
ATLAS SENSOR
Peakflow SP Pravail NSI
ISP Network DARKNET
ATLAS SENSOR
Peakflow SP Pravail NSI
ISP Network DARKNET
ATLAS SENSOR
ATLAS DATA CENTER
Monitoring of worldwide
infrastructure for network-borne
threats.
Malware Botnets Phishing
P2P
Behavioral Fingerprint
Identify Analyze Protect
1
2
3
1
2
3
10
DDoS and Risk Planning
12
Solution Overview DDoS Defense
DDoS Attack? It will never happen to me…
14
DDoS Attack, It will happen…
15
More Attack Motivations Greater Availability of Botnets
Increased Volume Increased Complexity Increased Frequency
Largest volumetric DDoS has grown from8 to 600
Gbps in 10 years
Over 25% of attacks are now application-based DDoS mostly targeting
HTTP, DNS, SMTP
>50% of data center operators experience >10
attacks per month
DDoS is an Exploding & Evolving Trend
more attacks
Geopolitical “Burma taken offline by DDOS attack”
Protests “Visa, PayPal, and MasterCard attacked”
Extortion “Techwatch weathers DDoS extortion attack”
Better Bots More infected PCs with faster connections
Easy Access Using web 2.0 tools to control botnets
Commoditized Cloud-based botnets, cheaper
DDoS Misconceptions
“My firewall/IPS provides DDoS protection”
“I have enough bandwidth to absorb DDoS attacks”
“No one would want to attack my business.”
38% 49%
13%
Did Your Firewall/IPS Fail Due to DDoS Within
Last 12 Months?
No
Yes
Not Deployed
0,14 1,2 2,5 10 17 24 40 49
100
60
0
50
100
150 Largest Attack in
Gbps
Source: Arbor Worldwide Infrastructure Security Report
Rent a botnet for as little as $50 per day
FACT FACT FACT
Most large data center operators have seen their
firewalls/IPS fail due to DDoS
Multigigabit attacks are common and can overwhelm
the largest networks
Most data centers suffer downtime every year
due to DDoS.
17
Botnet is a Business
• A large number of Botnet tools is available for purchase for you to create your own Botnet
• Botnet Tools today are an industry of its own
• You can – Buy software to create your own Botnet or – Hire Botnets to generate attacks
18
Commercial DDoS Botnets - Darkness
• Popular bot, still in use. Many leaked versions. • Widely mentioned in underground forums, competitive
19
Darkness – Control Panel
• 45,000 bots, 6900 online
20
DirtJumper
• Popular. 20,000 bots attacked Brian Krebs, Nov 2011. • 70,446 bots total – 668 active
21
Dirt Jumper 2
• HTTP flood, Synchronous flood, Download flood, POST flood options
22
Dirt Jumper 3
• 2 HTTP GET attacks, HTTP POST attack • Increased randomization of attack header
23
DDoS Services using Dirt Jumper 3
• Version 3 featured prominently in underground advertisement • Also mentions Optima (Darkness) and G-Bot • Anti-DDoS attacks mentioned
24
Dirt Jumper 5
• New features, anti-DDoS protection evasion
25
Pandora
• $800, cracked for $100 • Attacks look just like Dirt Jumper 5 and Khan bots • March 2012
26
Di BoTNet
• Re-uses Dirt Jumper code, adds “bot killer” feature • March 2012
27
Armageddon
• Very popular bot, active competitor to other Russian bots • Involved in politically motivated attacks in Russia • Observed attacking HTTP and other various ports • Features “Anti-DDoS” attack style and increased attack diversity
28
Commercial DDoS Services
• March 2012, claims private version of Dirt Jumper 5 • $200/week • Five minute test can account for very short attacks
29
microsoftDDoS
• March 2012. $800/month. 15 minute test • Money returned if site comes back online • Anonymous logo used, yet competitive ideology
30
Killer-G
• March 2012. $600/month. 10 minute test • G-bot (AKA Piranha, Drooptroop)
31
DDoS Service Marketing
32
Commercial DDoS Services
33
Commercial DDoS services
34
Commercial DDoS Services
35
Distributed Denial of Service (DDoS)
Targeting your Network, Services and
Customers
36
Volumetric, Brute Force Attacks
• Traffic Floods – Exhaust resources by
creating high bps or pps volumes
– Overwhelm the infrastructure – links, routers, switches, servers
DDoS Attack Categories
Layer 4-7, Smarter and Slow Attacks
• TCP resource exhaustion – Exhaust resources in
servers, load balancers, firewalls or routers
• Application Layer – Take out specific services
or applications
37
DDoS Attacks: Volumetric
Volumetric DDoS attacks are designed to saturate and overwhelm network resources, circuits etc by brute force
Attack Traffic
Good Traffic
ISP 2
ISP 1
ISP n
ISP
SATURATION
Target Applications &
Services
Firewall IPS Load
Balancer
DATA CENTER
38
Distributed Denial of Service (DDoS) Volumetric Attack - Filling up your network capacity
39
Stopping Volumetric Attacks
Cloud-based: Volumetric DDoS mitigation must be done up stream, before traffic gets to Data Center
Activated “on demand”: only active when an attack is detected or reported
Cloud-based DDoS Protection
ISP 2
ISP 1
ISP n
ISP
Peakflow SP/TMS
SCRUBBING CENTER
DATA CENTER
Firewall IPS Load
Balancer
40
Layer 4-7, Smart DDoS Attacks
Use much less bandwidth; harder to detect; target applications where they slowly exhaust resources.
ISP 2
ISP 1
ISP n
ISP
EXHAUSTION
Firewall IPS Load
Balancer
Target Applications &
Services
DATA CENTER EXHAUSTION
41
Distributed Denial of Service (DDoS) Slow Attacks - Taking down your services
42
Stopping Layer 4-7, Smart Attacks
CPE-based: L4-7 DDoS mitigation must be done at the Data Center Always ON: immediate mitigation Fine-tuned to the services behind it to minimize false positives and
false negatives
ISP 2
ISP 1
ISP n
ISP
Target Applications &
Services
CPE-based DDoS Protection
Firewall IPS Load
Balancer
DATA CENTER
43
CPE-based DDoS Defense
• Multifunctional Devices are
not good for DDoS – Security devices “enhanced”
with DDoS functionalities • Firewalls, IPSs, Load balancers
• Specialized Devices – IDMS appliances
• Pravail APS
Think about it: If Firewalls, which are present everywhere, could really handle DDoS attacks,
we would not hear so many stories of sites taken by DDoS, right?
Firewall IPS Load Balancer
44
CPE-Based DDoS Defense Comparison
Pravail APS IPS WAF FW
Application-Layer DDoS Protection
Flood Attack Protection via Cloud Signaling
Protected from State-Exhausting Attacks
Asymmetric DDoS Threat Protection
Easy Inline Deployment
Botnet Detection & Protection
Look for Security & Network Engineering Budgets for Funding
Excellent Good Fair Poor 45
The Evolving Threat Against Data Centers Attackers use a combination of techniques
ISP 2
ISP 1
ISP n
ISP
EXHAUSTION
Load Balancer
Target Applications &
Services
DATA CENTER
SATURATION
Exhaustion of Service
Layer 4-7, Smart DDoS Impact
Volumetric, Brute Force DDoS Impact
Firewall IPS Load
Balancer
46
DDoS Defense Offers in the Market
ISP 2
ISP 1
ISP n
ISP
SCRUBBING CENTER
Cloud Signaling
Cloud-based DDoS Protection
CPE-based DDoS Protection
Firewall IPS
Load Balancer
Target Applications &
Services
DATA CENTER
47
Cloud Signaling
• Immediate protection with seamless handoff to ISP’s DDoS filtration services
– “Clean Pipes”
Arbor Peakflow SP / TMS-based DDoS
Service
Arbor Pravail APS
Data
Cen
ter N
etw
ork
Firewall / IPS / WAF
Publ
ic F
acin
g Se
rver
s
Subscriber Network Subscriber Network
Internet Service Provider
Cloud Signaling Status
Gain full protection from a single console by signaling to the cloud Utilize Cloud Signaling Coalition for volumetric DDoS protection
1. Service Operating Normally
2. Attack Begins and Initially Blocked by Pravail APS
3. Attack Grows Exceeding Bandwidth
4. Cloud Signal Launched
5. Customer Fully Protected!
SATURATION
Subscriber Network Subscriber Network
48
Cloud Signaling Deployment Options • Cloud Signaling can work with two options of
Cloud-based DDoS Mitigation service offerings:
• Cloud Signaling is an advanced feature! – Reduce time to start Cloud-based mitigation,
increasing availability, with Cloud Signaling
LOCAL- ISP DDoS mitigation infrastructure directly upstream to the Data Center
Carrier- agnostic
Provider DDoS mitigation infrastructure is somewhere in the internet Cloud, even in a different country
49
Pravail APS + Arbor Cloud
ISP 2
ISP 1
ISP n
ISP Firewall
IPS Load
Balancer
Target Applications &
Services
DATA CENTER
SCRUBBING CENTER Cloud-based
DDoS Protection
On-premise DDoS Protection
Cloud Signaling
50
Comments? Questions?
Thank You !
top related