2. Agenda 1. KISA(Korea Internet & Security Agency of Korea) 2. Background & Case of DDoS Attack in Korea 3..kr DNS DDoS Protection Project 2010 4. Q & A

3. 1. KISA(Korea Internet & Security Agency of Korea)  KISA is a government agency of Korea  Merged three Agency in to one in July 2009 KISA, NIDA, KIICA  Main roll Internet address resource management Internet business development Internet Security & Protection (KrCERT) International Internet Relation & Out Reach

4. 2. Case of DDoS attack in Korea  Non targeted 1/25, 2001 Major ISP has been attacked  Targeted for Money Online game Item trade site Home stock trading system Internet Banking system  Targeted to Government & Major ISP (7.7) 12~14 Government Website being attacked Including major Internet Portal site & banking

5. 2. Case of DDoS attack in Korea 7.7 DDoS Attack overview  Attack duration 7 th ~ 10 th of July Estimation of 180,000 Zombie PC were used  7.7 DDoS Attack specification Per one Zombie PC : 103 pps, 18.5Kbyte/sec Http Get Flooding : 20 pps, 12Kbyte/sec Http(TCP 80) Flooding : 40 pps, 3.6Kbyte/sec UDP 80 Flooding : 20 pps, 1.4Kbyte/sec ICMP Flooding : 23 pps, 1.5Kbyte/sec

6. 2. Case of DDoS attack in Korea  kr DNS Query per day (Millions)

7. 3..kr DNS DDoS Protection Project 2010 B, Seoul (KT) F, Seoul (Hanaro) E, Daejeon (KISTI) G Mirror, Frankfurt (DENIC) C, Anyang (Dacom) D Mirror, Red Wood (ISC) D, Seoul (KINX) G Mirror, Dulles (VeriSign) E Mirror, Beijing (CNNIC) G, Seoul (KISA) 20Gbps E Mirror, São Paulo (Registro.br) D Mirror, Singapore (SGNIC) SUPPORTS IPv6, IPv4 IPv4 Only Deploy 3 more Anycast site in total to be 14 sites X 2 D,E,G Seoul

8. Thank you Q & A Han Sang Lee leehs@kisa.or.kr