We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byElvin Townsend
Modified about 1 year ago
CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 The CERT Coordination Center is part of the Software Engineering Institute. The Software Engineering Institute is sponsored by the U.S. Department of Defense. © 2001 by Carnegie Mellon University some images copyright www.arttoday.com 1 Trends in Denial of Service Attack Technology Kevin J. Houle NANOG23 – October 2001
© 2001 by Carnegie Mellon University 2 Background: Pre-1999 DoS Tools: -Single-source, single target tools -IP source address spoofing -Packet amplification (e.g., smurf) Deployment: -Widespread scanning and exploitation via scripted tools -Hand-installed tools and toolkits on compromised hosts (unix) Use: -Hand executed on source host
© 2001 by Carnegie Mellon University 3 Background: 1999 DoS Tools: -Multiple-source, single target tools -Distributed attack networks (handler/agent) -DDoS attacks Deployment: -Hand-selected, hard-coded handlers -Scripted agent installation (unix) Use: -Custom, obfuscated control channels ›intruder handlers ›handlers agents
© 2001 by Carnegie Mellon University 4 Background: 2000 02-2000 : Infamous DDoS attacks 04-2000 : DNS amplification attacks, mstream DDoS tool 05-2000 : VBS/Loveletter, t0rnkit 07-2000 : Hybris 08-2000 : Trinity IRC-based DDoS tool (unix) 11-2000 :Multiple IRC-based DDoS tools (Windows)
© 2001 by Carnegie Mellon University 5 Background: 2001 01-2001 :Ramen worm 02-2001 :VBS/OnTheFly (Anna Kournikova), erkms worm, 1i0n worm 04-2001 :Adore/Red worm, carko DDoS tool 05-2001 :cheese worm, w0rmkit worm, sadmind/IIS worm 06-2001 :Maniac worm, Code Red worm 07-2001 :W32/Sircam, Leaves, Code Red II, various telnetd worms, various IRC-based DDoS tools (knight, kaiten) 09-2001 : Nimda worm
© 2001 by Carnegie Mellon University 6 Trends – Deployment Greater degree of automation Self-propagating worms -Central source propagation -Back channel propagation -Autonomous propagation
© 2001 by Carnegie Mellon University 7 Central Source Propagation central-source attackervictims next-victims 1 - exploit 2 – copy code 3 - repeat Example: 1i0n worm
© 2001 by Carnegie Mellon University 8 Back Channel Propagation attackervictims next-victims 1 - exploit 2 – copy code 3 - repeat Example: Ramen worm
© 2001 by Carnegie Mellon University 9 Autonomous Propagation attackervictims next-victims 1 – exploit & copy code2 - repeat Examples: Code Red, Code Red II
© 2001 by Carnegie Mellon University 10 Trends – Deployment (cont.) Degree of Blind Targeting Selective Targeting AutomationVery highLow high Vulnerability- specificity Very highLow high Other criteriaLowVery high Targeting Systems: Blind vs. Selective Targeting
© 2001 by Carnegie Mellon University 11 Blind Targeting Social Engineering -W32/Sircam Specific vulnerabilities -sadmind/IIS worm unix/Microsoft IIS -Code Red, Code Red II Microsoft IIS -Nimda Windows/IIS -Various telnetd worms unix Activity tends to follow vulnerability lifecycles
© 2001 by Carnegie Mellon University 12 Selective Targeting Windows end-users increasingly targeted -less technically sophisticated -less protected -difficult to contact en mass -slow response to security alerts/events -well-known netblocks -widespread broadband connectivity -increase in home networking -exploit technology base is maturing CERT® Tech Tip - Home Network Security http://www.cert.org/tech_tips/home_networks.html
© 2001 by Carnegie Mellon University 13 Selective Targeting (3) Routers increasingly targeted -source for recon/scanning -proxy to IRC networks -source for packet flooding attacks -Compromise via weak/default passwords -Routers sometimes reconfigured ›public guides are available -Increased threat of routing protocol attacks ›discussions at DefCon and Black Hat Briefings
© 2001 by Carnegie Mellon University 14 Trends: Use Control Infrastructure – The classic DDoS model intruder handler agent victim
© 2001 by Carnegie Mellon University 15 Control Infrastructure Increased use of IRC networks and protocols -IRC server replaces the handler ›common, ‘legit’ service ports (e.g., 6667/tcp) ›commands are buried in ‘legit’ traffic ›no agent listeners; outbound connections only -More ‘survivable’ infrastructure ›reduction in address lists maintained ›disposable, easy to obtain agents ›makes use of public IRC networks ›private servers are also used
© 2001 by Carnegie Mellon University 16 Control Infrastructure (2) Increased use of IRC networks and protocols (cont.) -Agent redirection / update is easier ›everyone change to a new channel ›everyone change to a new IRC server ›everyone download this updated module -“floating” domains used to direct agents ›bogus WHOIS data, stolen credit cards ›‘A’ record modification redirects hard-wired agents
© 2001 by Carnegie Mellon University 17 Trends: Use Less emphasis on forged packet characteristics -size and distribution of DDoS makes response difficult ›overwhelming number of sources in DDoS attack ›sources often cross multiple AS boundaries ›high bandwidth consumption is easy; no need for fancy packets -increase in attacks using legitimate traffic ›mixes with other traffic ›harder to filter/limit
© 2001 by Carnegie Mellon University 18 Trends: Impact Increase in collateral damage (e.g., blast radius) -backup systems impacted by sharp increases in log volumes -financial impact at sites with measured usage circuits -multiple sites impacted in shared data centers -arp storms impacting locally infected networks Highly automated deployments are themselves causing denial of service conditions
© 2001 by Carnegie Mellon University 19 What We Are Not Seeing Changes in fundamental conditions that enable denial of service attacks Consumption of limited resources -Processing cycles -Memory resources -Network bandwidth Interdependency of security on the Internet -The exposure to DoS attack of SiteA depends on the security of SiteB -There are huge numbers of SiteB’s
© 2001 by Carnegie Mellon University 20 What We Are Not Seeing (2) Advances in DoS attack payload Seeing the same common packet stream types Known attacks work, there is little incentive to improve -TCP (SYN|ACK|FIN|RST) flood -UDP flood -ICMP echo request/reply flood -Amplification attacks -Source IP address spoofing
© 2001 by Carnegie Mellon University 21 What We Are Not Seeing (3) Reductions in launch-point availability Vendors are still producing insecure products Administrators/users are still deploying and operating systems insecurely Vulnerability life cycle is still lengthy (2-3 years)
© 2001 by Carnegie Mellon University 22 Credits Paper:Trends in Denial of Service Attack Technology Authors: Kevin Houle Neil Long Rob Thomas George Weaver http://www.cert.org/archive/pdf/DoS_trends.pdf
© 2001 by Carnegie Mellon University 23 CERT Coordination Center Software Engineering Institute Carnegie Mellon University 4500 Fifth Avenue Pittsburgh PA 15213 USA Hotline: +1 412 268 7090 CERT personnel answer 8:00 a.m. — 8:00 p.m. EST(GMT-5) / EDT(GMT-4), and are on call for emergencies during other hours. Fax:+1 412 268 6989 Web:http://www.cert.org/ Email:firstname.lastname@example.org CERT ® Contact Information
Trends in Denial of Service Attack Technology -or – Oh, please, they arent smart enough to do that… Presentation to CERT-Polska November 2001 Rob Thomas,
CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA The CERT Coordination Center is part of.
Simulation and Analysis of DDos Attacks Poongothai, M Department of Information Technology,Institute of Road and Transport Technology, Erode Tamilnadu,
DoS/DDoS attack and defense Nguyen Tien Thanh. Outline Denial of Service attack – Introduction – Impact of DoS attack – DoS attack types (ping flood,
--Harish Reddy Vemula Distributed Denial of Service.
% Security “ ” The only system which is truly secure is one which is switched off and unplugged, locked in a titanium lined safe, buried in a concrete.
Dos (Denial of Services) Aamir Wahid September 23 rd 2004.
UNCLASSIFIED Secure Indirect Routing and An Autonomous Enterprise Intrusion Defense System Applied to Mobile ad hoc Networks J. Leland Langston, Raytheon.
DDos Distributed Denial of Service Attacks by Mark Schuchter.
High Performance Research Network Dept. / Supercomputing Center 1 DDoS Detection and Response System NetWRAP : Running on KREONET Yoonjoo Kwon
Denial of Service Attacks: Methods, Tools, and Defenses Authors: Milutinovic, Veljko, Savic, Milan, Milic, Bratislav,
Being an Intermediary for Another Attack Prepared By : Muhammad Majali Supervised By : Dr. Lo’ai Tawalbeh New York Institute of Technology (winter 2007)
Distributed Denial of Service Attacks Shankar Saxena Veer Vivek Kaushik.
1 Carnegie Mellon University Overview of the CERT/CC and the Survivable Systems Initiative Andrew P. Moore CERT Coordination Center.
Internet Relay Chat Security Issues By Kelvin Lau and Ming Li.
Denial of Service A comparison of DoS schemes Kevin LaMantia COSC 316.
(Distributed) Denial of Service Nick Feamster CS 4251 Spring 2008.
Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.
EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Security News Source Courtesy:
Internet Relay Chat Chandrea Dungy Derek Garrett #29.
DOS Attacks Lyle YapDiangco COEN 150 5/21/04. Background DOS attacks have been around for decades Usually intentional and malicious Can cost a target.
Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 8 – Denial of Service.
Slammer Worm By : Varsha Gupta.P 08QR1A1216. The slammer worm is a computer virus that caused a denial of service on some Internet hosts and dramatically.
Lecture 18 Page 1 Advanced Network Security Distributed Denial of Service Attacks Advanced Network Security Peter Reiher August, 2014.
Intruder Trends Tom Longstaff CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA Sponsored by.
Distributed Denial of Service Attacks: Characterization and Defense Will Lefevers CS522 UCCS.
High Performance Research Network. Development Lab. / Supercomputing Center 1 Design of the Detection and Response System against DDoS attacks Yoonjoo.
Computer Security and Penetration Testing Chapter 11 Denial-of-Service Attacks.
Computer Security Fundamentals by Chuck Easttom Chapter 4 Denial of Service Attacks.
Chapter 7 Denial-of-Service Attacks Denial-of-Service (DoS) Attack The NIST Computer Security Incident Handling Guide defines a DoS attack as: “An action.
1 Carnegie Mellon University Protecting Information Infrastructures Rich Pethia Software Engineering Institute Carnegie Mellon University Pittsburgh,
APA of Isfahan University of Technology In the name of God.
COEN 252: Computer Forensics Router Investigation.
Internet Threats Denial Of Service Attacks “The wonderful thing about the Internet is that you’re connected to everyone else. The terrible thing about.
4061 Session 26 (4/19). Today Network security Sockets: building a server.
DDoS Attack and Its Defense1 CSE 5473: Network Security Prof. Dong Xuan.
Internet Vulnerabilities & Criminal Activity Internet Forensics 12.1 April 26, 2010 Internet Forensics 12.1 April 26, 2010.
Lesson 9-Securing a Network. Overview Identifying threats to the network security. Planning a secure network.
Network Security Introduction Some of these slides have been modified from slides of Michael I. Shamos COPYRIGHT © 2003 MICHAEL I. SHAMOS.
Common forms and remedies Neeta Bhadane Raunaq Nilekani Sahasranshu.
Denial of Service Datakom Ht08 Jesper Christensen, Patrick Johansson, Robert Kajic A short introduction to DoS.
© 2011 Infoblox Inc. All Rights Reserved. Infoblox – control, secure & automate Mike Carroll.
ITIS 1210 Introduction to Web-Based Information Systems Chapter 45 How Hackers can Cripple the Internet and Attack Your PC How Hackers can Cripple the.
Net security - budi rahardjo Overview of Network Security Budi Rahardjo CISCO seminar 13 March 2002.
1Federal Network Systems, LLC CIS Network Security Instructor Professor Mort Anvair Notice: Use and Disclosure of Data. Limited Data Rights. This proposal.
Attacks On systems And Networks To understand how we can protect our system and network we need to know about what kind of attacks a hacker/cracker would.
NETWORK ATTACKS Dr. Andy Wu BCIS 4630 Fundamentals of IT Security.
Lecture 15 Denial of Service Attacks modified from slides of Lawrie Brown.
KFSensor Honeypot and Intrusion Detection System Sunil Gurung [60-475] Security and Privacy on the Internet.
Code-Red : a case study on the spread and victims of an Internet worm David Moore, Colleen Shannon, Jeffery Brown Jonghyun Kim.
© 2017 SlidePlayer.com Inc. All rights reserved.