1. 04/12/2001ecs289k, spring 20011 ecs298k Distributed Denial of Services lecture #5 Dr. S. Felix Wu Computer Science Department University of California, Davis http://www.cs.ucdavis.edu/~wu/ wu@cs.ucdavis.edu

2. 04/12/2001ecs289k, spring 20012 Internet Source Accountability NCSU AOL UUNet Header src: AOL dst:NCSU Payload …………….. A B Egress filtering???

3. 04/12/2001ecs289k, spring 20013 The Plain DDOS Model (1999-2000) Masters Slaves Victim... ISP.com ::::. Attackers src: random dst: victim

4. 04/12/2001ecs289k, spring 20014 Reflector Use a legitimate network server/client as the reflector to avoid being traced. (stepping stone). Reflector VictimSlave Service Request Packet src: Victim dst: Reflector Service Reply Packet src: Reflector dst: Victim

5. 04/12/2001ecs289k, spring 20015 The Reflective DDOS Model (2000) Masters Slaves Victim... ISP.com ::::. Reflectors Attackers src: victim dst: reflector src: reflector dst: victim

6. 04/12/2001ecs289k, spring 20016 What is the problem? Egress/ingress filtering possible?? Push-back Rate-Limiter Locating the slaves (compromized hosts in Universities, e.g.) is a good first step. Probably easiest to find. Cut them off to help. Further track down masters and “the attacker.”

7. 04/12/2001ecs289k, spring 20017 What have been proposed? Egress filtering using routing information –Lixia Zhang (UCLA), Van Jacobson (Packet Design),… Probabilistic Packet Marking –Steve Savage (UWa/UCSD), UCB, Purdue, UCD…. DECIDUOUS. ICMP Traceback Messages –IETF

8. 04/12/2001ecs289k, spring 20018 Packet Marking in DDoS Masters Slaves Victim... ISP.com ::::. Attackers src: random dst: victim

9. 04/12/2001ecs289k, spring 20019 Marking procedure at router R: for each packet w let x be a random number from [0..1) if x < p then write R into w.start and 0 into w.distance else if w.distance == 0 then write R into w.end increment w.distance A5R9 R8 R4 R7 R6 R3 R 5 R2 R1 A6 verhlenTOSTotal Length Identificationflagsoffset Time to liveProtocol Header checksum Source IP address Destination IP address offsetDistanceEdge fragment 02 37 8 15

10. 04/12/2001ecs289k, spring 200110 Masters Slaves Victim... ISP.com ::::. Reflectors Attackers src: victim dst: reflector src: reflector dst: victim ??? Find a special honey-pot reflectors???

11. 04/12/2001ecs289k, spring 200111 ICMP Traceback For a very small probability or very few packets (about 1 in 20,000), each router will send the destination a new ICMP message indicating the previous hop for that packet. Net traffic increase at endpoint is about 0.1% -- probably acceptable.

12. 04/12/2001ecs289k, spring 200112 Original iTrace Masters Slaves Victim... ISP.com ::::. Attackers src: random dst: victim

13. 04/12/2001ecs289k, spring 200113 iTrace in Reflective DDOS Masters Slaves Victim... ISP.com ::::. Reflectors Attackers src: victim dst: reflector src: reflector dst: victim

14. 04/12/2001ecs289k, spring 200114 Improved ICMP Traceback For a very few packets (about 1 in 20,000), each router will send the destination and the source a new ICMP message indicating the previous hop for that packet. Net traffic increase at endpoint is about 0.2% -- probably acceptable.

15. 04/12/2001ecs289k, spring 200115 Reflector VictimSlave Service Request Packet src: Victim dst: Reflector Service Reply Packet src: Reflector dst: Victim source Traceback Messages Who has spoofed me??

16. 04/12/2001ecs289k, spring 200116 Improved iTrace Masters Slaves Victim... ISP.com ::::. Reflectors Attackers src: victim dst: reflector src: reflector dst: victim

17. 04/12/2001ecs289k, spring 200117 What we believe…. Egress filtering is very important!! –We need to develop technical solutions to filter packets efficiently and accurately!! Probabilistic Marking will not work!! –It can not handle “reflective DDoS”! iTrace-based solutions can complement egress filtering. –With a fixed probability, we might not be able to reliably identify the final true sources/slaves. –How do I know if this is my own packet or spoofed packet?

18. 04/12/2001ecs289k, spring 200118 Each slave emits a “relatively small” amount of attack packets Masters Slaves Victim... ISP.com ::::. Attackers src: random dst: victim This will be a problem for any “static” probabilistic schemes.

19. 04/12/2001ecs289k, spring 200119 Reflector VictimSlave Service Request Packet src: Victim dst: Reflector Service Reply Packet src: Reflector dst: Victim source Traceback Messages Who has spoofed me??

20. 04/12/2001ecs289k, spring 200120 VictimISP Service Request Packet src: Victim dst: www.yahoo.com source Traceback Messages Is that really me??? How can I tell??

21. 04/12/2001ecs289k, spring 200121 Maybe it is my friend... Masters Slaves Victim... ISP.com ::::. Attackers src: random dst: victim Are you sure that this is from a slave or not? customers

22. 04/12/2001ecs289k, spring 200122 iTrace Packet Analyzer Are those problems (I just raised) realistic? In today’s Internet, how likely I will receive iTrace packets for “innocent” packets? How to correlate the iTrace packets to determine: –how many slaves? –where are they? –How reliable is the answer? If static, what should be the “best” prob?

23. 04/12/2001ecs289k, spring 200123 Magic Marks: concept src/dst IP addresses the rest….. an outgoing packet src/dst IP addresses 128 bit digest HMAC selector 16 bit mark src/dst IP addresses the rest….. 16 bit mark iTrace message either a SRC itrace or DST itrace... Private key

24. 04/12/2001ecs289k, spring 200124 Magic Marks: design src/dst IP addresses the rest….. an outgoing packet Src IP address plus N bits (N=8) of the dst IP address 128 bit digest HMAC selector 16 bit marks Private key Pre-compute the Marking table with 2 N entries! Mark Table look-up

25. 04/12/2001ecs289k, spring 200125 A scenario src/dst IP addresses the rest….. 16 bit mark dst iTrace message src/dst IP addresses the rest….. 16 bit mark verify message 16 bit mark src response (Y/N)