1. DDoS Attacks on Financial Institutions Presentation
By: Chandler Strouse

2. What is DDoS? DDoS stands for Distributed Denial of Service
Attempts to make an online service unavailable by overwhelming it with traffic
Different types of attacks:
Volumetric
Protocol (State-Exhaustion)
Application-Layer

3. Volumetric Attack Most common form of DDoS
Floods network layer with traffic that appears legitimate
Examples of Volumetric attacks:
UDP Flood
ICMP (Ping) Flood

4. Volumetric Attack: UDP Flood
Floods random ports on a remote host with a huge number of UDP packets
Causes host to constantly check for application listening at the port
No application is found, replies with “Destination Unreachable” packet

5. Volumetric Attack: ICMP (Ping) Flood
Similar to UDP Flood
Sends vast numbers of ping packets without waiting for reply
Host attempts to respond to all pings, consuming both incoming and outgoing bandwidth

6. Protocol Attack
Also called state exhaustion, targets connection state tables in firewalls, app servers, etc.
Consumes server resources and works to exhaust the limited number of concurrent connections device can support
Examples of Protocol Attacks:
Ping of Death
SYN Flood

7. Protocol Attack: Ping of Death
Defragments large ping packet and sends to server as fast as possible
Target reassembles packet, causing a buffer overload
Target tries to respond to ping packet and crashes

8. Protocol Attack: SYN Flood
Exploits weakness in TCP Connection
TCP uses three-way handshake:
Request
Host ACK
Requester ACK
SYN Flood sends multiple requests but doesn’t respond to ACKs
Host system waits for ACK, binding resources and blocking traffic

9. Application-Layer Attack
Attack targets weaknesses in an application or server
Attempts to monopolize its processes and transactions
Hardest to detect
Mimics human behavior
Can originate from single machine, generating less traffic
Examples of Application-layer attacks:
HTTP Flood
Slowloris

10. Application-Layer Attack: HTTP Flood
Sends seemingly harmless HTTP GET or HTTP POST requests to app
Huge volumes of requests are sent and as app responds to each, resources are consumed
Ideally, application will be manipulated into using the maximum possible resources to respond to each request

11. Application-Layer Attack: Slowloris
Attacker sends partial request to target, however request is never completed and false connection is kept open
Eventually, max concurrent connection limit is reached
Effective because partial packets are used, rather than malformed packets, making it harder to detect
Can prevent creation of log files

12. Botnets DDoS attacks are more effective with more computers
Botnets are an interconnected network of infected computers
Can be used to send spam s, transmit viruses, or join in DDoS attacks
Can in size range from a couple of computers to hundreds of thousands

13. Why Do People Use DDoS Attacks?
Most common reason is money
Extortion
Heist
Bank of the West
Sabotage Rival Competitors
Also used as a form of protest
Anonymous
CIA, Vatican, ISIS

14. Why are Financial Institutions Targeted?
They control large amounts of money
Large user base
Support entire economy, other companies rely on them

15. Why are DDoS attacks so common?
Number and Severity of DDoS attacks been constantly rising over past couple years
Availability of powerful, free tools requiring minimal computer knowledge
HOIC
Relative cheapness of botnets

16. DDoS Defense? Impossible to prevent DDoS attacks Mitigate effects
Increase capabilities of system, Ex: more server processing power
ISPs can provide “burst” bandwidth
Configure router or switch to filter nonessential protocols and stop invalid IPs

17. DDoS Response Plan Preparation During attack Post-Attack Create a team
Role’s for each team member during an attack
Asses Risks and vulnerabilities that could be exploited
During attack
Analyze network to differentiate DDoS traffic from real users
Respond to attack by configuring filters to discard incoming packets or avoid sending unnecessary response packets
Post-Attack
Analyze damages
Adapt plan to better deal with next attack

18. Conclusion DDoS attacks are becoming more common and more severe
Must prepare for attacks
Response plan
Many reasons for attacks, but money is the most common reason
Because of this, Financial Institutions must take extra precaution to prepare for inevitable attacks