Top Banner
Universal DDoS Mitigation Bypass DDoS Mitigation Lab
44

Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Mar 16, 2019

Download

Documents

trinhxuyen
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Universal DDoS Mitigation Bypass

DDoS Mitigation Lab

Page 2: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

About Us

DDoS Mitigation Lab

Independent academic R&D division of Nexusguardbuilding next generation DDoS mitigation knowledge and collaborate with the defense community.

Industry body formed to foster synergy among stakeholders to promote advancement in DDoSdefense knowledge.

Page 3: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

• DDoS Attack Categories• DDoS Detection and Mitigation Techniques

– How they work?– How to bypass / take advantage?

• DDoS Mitigation Bypass– How to use our PoC tool?– PoC tool capability

• Next-Generation Mitigation

Outline

Page 4: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Financial Impact

Source: NTT Communications,“Successfully Combating DDoS Attacks”, Aug 2012

Page 5: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Volumetric Attacks

• Packet-Rate-Based• Bit-Rate-Based

Page 6: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Semantic Attacks

API attacksHash DoSApache KillerTeardrop

(old textbook example)

Slowloris / RUDYSYN Flood

(old textbook example)

Smurf(old textbook example)

Page 7: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Blended Attacks

Page 8: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Attack Quadrant

ComplexitySimple Sophisticated

Volu

me

xxx Gbps+

xxx Mbps+

Page 9: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

DDoS Mitigations

Traffic Policing

Proactive Resource Release

Black- / Whitelisting

xxx Gbps+

xxx Mbps+

ComplexitySimple Sophisticated

Volu

me

Page 10: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

DDoS Mitigation:Traffic Policing

Source: Cisco

Page 11: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

DDoS Mitigation:Proactive Resource Release

RST

1. Open lots of TCP connections

2. TCP connection pool starved3. Detect idle / slow TCP connections

4. Close idle / slow TCP connectionsWith RST

Example:Slowloris Attack

Page 12: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

B

Backend

(dropped)

DDoS Mitigation:Black- / Whitelisting

Black List

White List

1.2.3.45.6.7.8

5.6.7.83.4.5.66.7.8.9

= free pass(for awhile / for x amount of volume)

Src: 1.2.3.4

Src: 3.4.5.6

Page 13: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

DDoS Mitigation:Source Isolation

Source: http://www.cs.duke.edu/nds/ddos/

AS

ASAS

Page 14: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

DDoS Solution: Secure CDN

Backend

End User

3: return

1: request

2: redirectto nearestserver

4: bypass distribution,attack backend!

Page 15: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

DDoS DetectionRate Measurement

(SNMP)

Baselining(Netflow)

Protocol Sanity (PCAP)

Application(SYSLOG)

Protocol Behavior(PCAP)

Big Data Analysis

ComplexitySimple Sophisticated

Volu

me

xxx Gbps+

xxx Mbps+

Page 16: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Rate- / Flow-Based Countermeasures

Detection

Mitigation

Page 17: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Protocol-Based Countermeasures

Detection

Mitigation

Page 18: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Blanket Countermeasures

Traffic Statistics and BehaviorBig Data Analysis

Detection

Mitigation

Source Host Verification

Page 19: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Source Host Verification

• TCP SYN Auth• HTTP Redirect Auth• HTTP Cookie Auth• JavaScript Auth• CAPTCHA Auth

Page 20: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

PoC Tool

Page 21: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

• True TCP/IP behavior (RST, resend, etc.)• Believable HTTP headers (User-Agent strings, etc.)• Embedded JavaScript engine• CAPTCHA solving capability• Randomized payload• Tunable post-authentication traffic model

PoC Tool Strengths

Page 22: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

PoC Tool: Authentication Bypass

Page 23: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

TCP SYN Auth (TCP Reset)

SYN ACK

SYN

ACK

RST

SYN

SYN ACK

ACK

Page 24: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

TCP SYN Auth (TCP Out-of-Sequence)

RST

SYN

SYN

SYN ACK

ACK

SYN ACK

Page 25: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

HTTP Redirect Auth

GET /index.html

HTTP 302 redir to /foo/index.html

GET /foo/index.html

HTTP 302 redir to /index.html

GET /index.html

Page 26: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

HTTP Cookie Auth

GET /index.html

HTTP 302 redir to /index.html

HTTP 302 redir to /index.html

GET /index.html

GET /index.html

Page 27: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

HTTP Cookie Auth (Header Token)

GET /index.html

HTTP 302 redir to /index.html [X-Header: foo=bar]

GET /index.html[X-Header: foo=bar]

GET /index.html[X-Header: foo=bar]

HTTP 302 redir to /index.html [X-Header: foo=bar]

GET /index.html

[X-Header: foo=bar]

Page 28: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

JavaScript Auth

GET /index.html

HTTP 302 redir to /index.html

GET /index.html

POST /auth.phpans=16

JS 7+nine=?

Page 29: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

CAPTCHA Auth

GET /index.html

HTTP 302 redir to /index.html

GET /index.html

POST /auth.php

Page 30: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

CAPTCHA Pwnage

Page 31: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

PoC Tool: TCP Traffic Model

Page 32: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

TCP Traffic ModelNu

mber

of C

onne

ction

s

Connection Hold TimeBefore 1st Request

Connection Idle TimeoutAfter Last Request

ConnectionsInterval

ConnectionsInterval

TCP Connection

TCP Connection

TCP Connection

Page 33: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

PoC Tool: HTTP Traffic Model

Page 34: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

HTTP Traffic ModelNu

mber

of R

eque

stspe

r Con

necti

on

RequestsInterval

RequestsInterval

RequestsInterval

TCP Connection

HTTP Connection

HTTP Connection

HTTP Connection

HTTP Connection

Page 35: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

• 3 tries per authentication attempt (in practice more likely to success)

• True TCP/IP behavior thru use of OS TCP/IP stack• Auth cookies persist during subsequent dialogues• JavaScript execution using embedded JS engine (lack

of complete DOM an obstacle to full emulation)

PoC Tool Design

Page 36: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

1. Converted to black-and-white for max contrast2. 3x3 median filter applied for denoising3. Word segmentation4. Boundary recognition5. Pixel difference computed against character map

CAPTCHA Bypass Design

Page 37: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

PoC Tool in Action

Page 38: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Testing Environment

Against Devices Against Services

MeasureAttackTraffic

MeasureAttackTraffic

Page 39: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Mitigation Bypass(Protection Products)

Auth Bypass Post-Auth

Testing results under specific conditions,valid as of Jul 13, 2013

ProactiveResource Release

Page 40: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Mitigation Bypass(Protection Services)

Auth Bypass Post-Auth

Testing results under specific conditions,valid as of Jul 13, 2013

ProactiveResource Release

Page 41: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

• Client Puzzle – add cost to individual zombies.

Next-Generation Mitigation

Page 42: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

• DDoS is expensive to business• Existing DDoS protection insufficient• Next-Generation solution should make attack

expensive

Conclusion

Page 43: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

[email protected]@ntisac.org

[email protected]

Thank You!

http://www.ntisac.org

Page 44: Universal DDoS Mitigation Bypass - Black Hat Briefings · DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and

Related Documents
DDoS Attack Detection & Mitigation in SDN

DDoS Attack Detection & Mitigation in SDN

Category: Engineering
D3TLV17- Advanced DDoS Mitigation Techniques

D3TLV17- Advanced DDoS Mitigation Techniques

Category: Technology
DDOS Attack & Mitigation SImulation

DDOS Attack & Mitigation SImulation

Category: Documents
DDoS mitigation for systems processing

DDoS mitigation for systems processing

Category: Internet
DDoS Attack Mitigation Guide FortiDDoS

DDoS Attack Mitigation Guide FortiDDoS

Category: Documents
Anomaly Detection and Mitigation. Outline DoS and DDoS Anomaly Detection and Mitigation Systems Cisco DDoS Anomaly Detection and Mitigation Solutions.

Anomaly Detection and Mitigation. Outline DoS and DDoS...

Category: Documents
Cisco DDoS Mitigation Service Provider Solutions...Cisco DDoS Mitigation Service Provider Solutions DDoS Protection Cisco Service Modules (cont.) •Guard/Detector MVP-OS Release 4.0

Cisco DDoS Mitigation Service Provider Solutions...Cisco...

Category: Documents
Global DDoS Mitigationstatic.newsletter.veracomp.pl/files/0c648f0dec5ffa... · DDoS mitigation solutions. In particular, DDoS mitigation solutions continue to evolve in response to

Global DDoS...

Category: Documents
DDoS mitigation in the real world

DDoS mitigation in the real world

Category: Technology
2016 Global DDoS Mitigation Entrepreneurial Company of the ......Nexusguard solution is sensitive to the needs of service providers, offering both cloud-based mitigation and a private,

2016 Global DDoS Mitigation Entrepreneurial Company of the.....

Category: Documents
DDoS Mitigation Support on CGSE - Cisco...DDoS Mitigation Support on CGSE Distributeddenial-of-service(DDoS)attackstargetnetworkinfrastructuresorcomputerservicesresources ...

DDoS Mitigation Support on CGSE - Cisco...DDoS Mitigation...

Category: Documents
(D)DOS DEMYSTIFIED - OARnet...DDoS Attack Customers DDoS Attack Volumetric Protection Cloud ISPa ISPb L3-4 DDoS mitigation DDoS Platform DDoS Platform L7 DDoS mitigation SSL Termination

(D)DOS DEMYSTIFIED - OARnet...DDoS Attack Customers DDoS...

Category: Documents