Presentation is loading. Please wait.

Presentation is loading. Please wait.

DDOS attacks in an IPv6 World Tom Paseka HKNOG 1.0 September 2014.

Similar presentations


Presentation on theme: "DDOS attacks in an IPv6 World Tom Paseka HKNOG 1.0 September 2014."— Presentation transcript:

1 DDOS attacks in an IPv6 World Tom Paseka HKNOG 1.0 September 2014

2 Who are we? 2

3 How does CloudFlare Work? 3 CloudFlare works at the network level. Once a website is part of the CloudFlare community, its web traffic is routed through CloudFlare’s global network of 24 (and growing) data centers. At each edge node, CloudFlare manages DNS, caching, bot filtering, web content optimization and third party app installations.

4 IPv6 Gateway With the Internet's explosive growth and the number of on-net devices closing in on IPv4's maximum capacity, CloudFlare now offers an automatic IPv6 gateway seamlessly bridging the IPv4 and IPv6 networks. For most businesses, upgrading to the IPv6 protocol is costly and time consuming. CloudFlare’s solution requires NO hardware, software, or other infrastructure changes by the site owner or hosting provider. Enabled via the flip of a switch on the site owner’s CloudFlare dashboard. Users can choose two options: (FULL) which will enable IPv6 on all subdomains that are CloudFlare Enabled, or (SAFE) which will automatically create specific IPv6-only subdomains (e.g. www.ipv6.yoursite.com). www.ipv6.yoursite.com 4

5 DDoS Overview

6 Purpose of a DDoS is to overwhelm an internet resource, to take it offline This can be: Volumetric (eg. High Gbps, High PPS or SYN Flooding). To overwhelm infrastructure to the website / resource. SYN floods overwhelm the Application based (eg. Excessive HTTP POST or search) To overwhelm the application or server. A website suddenly becoming very popular can also be like a DDOS

7 DDoS Overview Growing Trend Increasing in size all the time Now regularly attacks are greater than 400Gbps+ Source: http://www.arbornetworks.com/images/P eakDDoSAttack_rev2.jpg

8 DDoS Overview Large scale DDoS is a common occurrence. Used for exploitation, even for relatively low amounts (US$500 and below). Online services available for purchase of DDoS Known as ‘Booters’ Large purpose is to kick competitors off online-games so they forfeit the game Free trails are often available for ‘Booters’ too!

9 So, what’s this got to do with IPv6?

10 Nothing?

11 So, what’s this got to do with IPv6? Or maybe a lot?

12 So, what’s this got to do with IPv6? Aged tools without IPv6 support: NetFlow (v5):Interface (SNMP) Graph:

13 So, what’s this got to do with IPv6? Aged tools without IPv6 support: NetFlow (v5):Interface (SNMP) Graph:

14 So, what’s this got to do with IPv6? Aged tools without IPv6 support: NetFlow (v5):Interface (SNMP) Graph: ?

15 So, what’s this got to do with IPv6? [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet f? Possible completions: > flow Include flow NLRI [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet6 f? No valid completions

16 So, what’s this got to do with IPv6? [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet f? Possible completions: > flow Include flow NLRI [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet6 f? No valid completions

17 So, what’s this got to do with IPv6? [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet f? Possible completions: > flow Include flow NLRI [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet6 f? No valid completions

18 So, what’s this got to do with IPv6? [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet f? Possible completions: > flow Include flow NLRI [edit protocols bgp group ROUTESERVER neighbor] tom@edge01.syd01# set family inet6 f? No valid completions 

19 So, what’s this got to do with IPv6? Without supporting systems, many things may be impeded: Ability to identify attacks: No NetFlow data? Ability to filter the attacks: IP Tables support? (ip6tables) IP ACL / Access-lists BGP FlowSpec Remotely Triggered Black Holing

20 So, what’s this got to do with IPv6? So, is this IPv6’s fault? Looking at the vendors in the room. Why is any product released without FULL IPv6 support today.

21 So, what’s this got to do with IPv6? A lot of IPv6 deployments feel like “best effort” Best effort doesn’t cut it under big attacks and with security We all still have a long way to come.

22 IPv6 Attacks in the Wild

23 For the most part, in our experience, they’re the same as IPv4 based attacks. Typically, attack scope is smaller, due to much smaller number of IPv6 hosts on the internet Not true for all attacks

24 IPv6 Attacks in the Wild DNS cache-busted query attacks. Not only a IPv6 attack, but interesting because of how it came in over IPv6. Botnet bots, query through their normal configured recursors, using random strings which aren’t cachable

25 IPv6 Attacks in the Wild Queries look like this : ebepexklyfaxmloh.www.popvote.hk ktylstudkr.www.popvote.hk ohunarajmbkrej.www.popvote.hk wwtdheilzcv.www.popvote.hk zktvvotoyrewaku.www.popvote.hk ……. khyhavsnijslyb.www.popvote.hk gchjpexychflvfv.api-token.popvote.hk ruqnpvp.api-token.popvote.hk fapzefvgowzonss.api-token.popvote.hk mcvhothfketpgre.api-token.popvote.hk

26 IPv6 Attacks in the Wild We see about equal break down between normal DNS traffic and Attack DNS traffic with IPv4 and IPv6 Often in ISP networks, first thing IPv6 enabled on is their own infrastructure, eg: DNS Servers When infrastructure is dual stacked, the abuse will follow! $ host tom.ns.cloudflare.com tom.ns.cloudflare.com has address 173.245.59.147 tom.ns.cloudflare.com has IPv6 address 2400:cb00:2049:1::adf5:3b93

27 IPv6 Attacks in the Wild These attacks are very effective Attacks growing past 100M PPS (packets per second) With the prior ratio of IPv6 traffic That’s ~20M PPS of IPv6 traffic

28 IPv6 Attacks in the Wild About the same amount of IPv6 PPS going across AMS-IX Internet exchange!

29 IPv6 Attacks in the Wild IPv6 SYN Floods (and other flooding based attacks) Botnet send commands/attacks to direct traffic towards a hostname, eg: example.com $ host example.com example.com has address 93.184.216.119 example.com has IPv6 address 2606:2800:220:6d:26bf:1447:1097:aa7

30 IPv6 Attacks in the Wild Botnet master may not be intentional to send traffic towards IPv6 hosts But bots inside the botnet see the AAAA and send traffic that way IPv6 preferred selection.

31 IPv6 Attacks in the Wild Aged tools without IPv6 support: NetFlow (v5):Interface (SNMP) Graph: ?

32 IPv6 Attacks in the Wild Is all of this interesting?

33 IPv6 Attacks in the Wild Show’s IPv6 adoption is growing, not just in users networks, but other parts of the internet. Expands scope of where IPv6 attacks can come in Helps change the IPv4 only mindset

34 Moving Forward

35

36 We’re making sure IPv6 is enabled for everyone Previously, we had IPv6 as an option, now its default on and enabled for all our customers

37 Moving Forward

38 This is just the tip of the iceberg Nothing over IPv6 has been that unique yet Most attacks are still directed at an IP (IPv4) Address Most sophisticated are still IPv4 only Who knows what is coming next?

39 Moving Forward Unless we can see what’s happening now We can’t know what to expect going forward Except that if you’re not prepared with the same principles in IPv4 security, IPv6 will byte you. Once you’ve reached equality in IPv4 and IPv6, the issues of IPv4 v. IPv6 in attacks is moot.

40 Questions?

41 Thank You!

42


Download ppt "DDOS attacks in an IPv6 World Tom Paseka HKNOG 1.0 September 2014."

Similar presentations


Ads by Google