Universal DDoS Mitigation Bypass DDoS Mitigation Lab About Us - - PowerPoint PPT Presentation

▶
universal ddos mitigation bypass
SMART_READER_LITE
LIVE PREVIEW

Universal DDoS Mitigation Bypass DDoS Mitigation Lab About Us - - PowerPoint PPT Presentation

Dec 07, 2023 308 likes •767 views

Universal DDoS Mitigation Bypass DDoS Mitigation Lab About Us Industry body formed to foster synergy among stakeholders to promote advancement in DDoS defense knowledge. Independent academic R&D division of Nexusguard building next

slide-1
SLIDE 1

Universal DDoS Mitigation Bypass

DDoS Mitigation Lab

slide-2
SLIDE 2

About Us

DDoS Mitigation Lab Independent academic R&D division of Nexusguard building next generation DDoS mitigation knowledge and collaborate with the defense community. Industry body formed to foster synergy among stakeholders to promote advancement in DDoS defense knowledge.

slide-3
SLIDE 3
  • DDoS Attack Categories
  • DDoS Detection and Mitigation Techniques

– How they work? – How to bypass / take advantage?

  • DDoS Mitigation Bypass

– How to use our PoC tool? – PoC tool capability

  • Next-Generation Mitigation

Outline

slide-4
SLIDE 4

Financial Impact

Source: NTT Communications, “Successfully Combating DDoS Attacks”, Aug 2012

slide-5
SLIDE 5

Volumetric Attacks

  • Packet-Rate-Based
  • Bit-Rate-Based
slide-6
SLIDE 6

Semantic Attacks

API attacks Hash DoS Apache Killer Teardrop

(old textbook example)

Slowloris / RUDY SYN Flood

(old textbook example)

Smurf

(old textbook example)

slide-7
SLIDE 7

Blended Attacks

slide-8
SLIDE 8

Attack Quadrant

Complexity

Simple Sophisticated

Volume

xxx Gbps+ xxx Mbps+

slide-9
SLIDE 9

DDoS Mitigations

Traffic Policing Proactive Resource Release Black- / Whitelisting xxx Gbps+ xxx Mbps+

Complexity

Simple Sophisticated

Volume

slide-10
SLIDE 10

DDoS Mitigation: Traffic Policing

Source: Cisco

slide-11
SLIDE 11

DDoS Mitigation: Proactive Resource Release

RST

  • 1. Open lots of TCP connections
  • 2. TCP connection pool starved
  • 3. Detect idle / slow TCP connections
  • 4. Close idle / slow TCP connections

With RST

Example: Slowloris Attack

slide-12
SLIDE 12

B Backend (dropped)

DDoS Mitigation: Black- / Whitelisting

Black List White List

1.2.3.4 5.6.7.8 5.6.7.8 3.4.5.6 6.7.8.9

= free pass

(for awhile / for x amount of volume)

Src: 1.2.3.4 Src: 3.4.5.6

slide-13
SLIDE 13

DDoS Mitigation: Source Isolation

Source: http://www.cs.duke.edu/nds/ddos/

AS AS AS

slide-14
SLIDE 14

DDoS Solution: Secure CDN

Backend End User 3: return 1: request 2: redirect to nearest server 4: bypass distribution, attack backend!

slide-15
SLIDE 15

DDoS Detection

Rate Measurement (SNMP) Baselining (Netflow) Protocol Sanity (PCAP) Application (SYSLOG) Protocol Behavior (PCAP) Big Data Analysis

Complexity

Simple Sophisticated

Volume

xxx Gbps+ xxx Mbps+

slide-16
SLIDE 16

Rate- / Flow-Based Countermeasures

Detection Mitigation

slide-17
SLIDE 17

Protocol-Based Countermeasures

Detection Mitigation

slide-18
SLIDE 18

Blanket Countermeasures

Traffic Statistics and Behavior Big Data Analysis

Detection Mitigation

Source Host Verification

slide-19
SLIDE 19

Source Host Verification

  • TCP SYN Auth
  • HTTP Redirect Auth
  • HTTP Cookie Auth
  • JavaScript Auth
  • CAPTCHA Auth
slide-20
SLIDE 20

PoC Tool

slide-21
SLIDE 21
  • True TCP/IP behavior (RST, resend, etc.)
  • Believable HTTP headers (User-Agent strings, etc.)
  • Embedded JavaScript engine
  • CAPTCHA solving capability
  • Randomized payload
  • Tunable post-authentication traffic model

PoC Tool Strengths

slide-22
SLIDE 22

PoC Tool: Authentication Bypass

slide-23
SLIDE 23

TCP SYN Auth (TCP Reset)

SYN ACK SYN ACK RST SYN SYN ACK ACK

slide-24
SLIDE 24

TCP SYN Auth (TCP Out-of-Sequence)

RST SYN SYN SYN ACK ACK

SYN ACK

slide-25
SLIDE 25

HTTP Redirect Auth

GET /index.html HTTP 302 redir dir to to /foo/index.html GET /foo/index.html HTTP 302 redir dir to to /index.html GET /index.html

slide-26
SLIDE 26

HTTP Cookie Auth

GET /index.html HTTP 302 redir dir to to /index.html HTTP 302 redir dir to to /index.html GET /index.html GET /index.html

slide-27
SLIDE 27

HTTP Cookie Auth (Header Token)

GET /index.html HTTP 302 redir dir to to /index.html

[X-Header: foo=bar]

GET /index.html

[X-Header: foo=bar]

GET /index.html

[X-Header: foo=bar]

HTTP 302 redir dir to to /index.html

[X-Header: foo=bar]

GET /index.html

[X-Header: foo=bar]

slide-28
SLIDE 28

JavaScript Auth

GET /index.html HTTP 302 redir dir to to /index.html GET /index.html POST /auth.php

ans=16

JS

7+nine=?

slide-29
SLIDE 29

CAPTCHA Auth

GET /index.html HTTP 302 redir dir to to /index.html GET /index.html POST /auth.php

slide-30
SLIDE 30

CAPTCHA Pwnage

slide-31
SLIDE 31

PoC Tool: TCP Traffic Model

slide-32
SLIDE 32

TCP Traffic Model

Number of Connections Connection Hold Time Before 1st Request Connection Idle Timeout After Last Request Connections Interval Connections Interval

TCP Connection TCP Connection TCP Connection

slide-33
SLIDE 33

PoC Tool: HTTP Traffic Model

slide-34
SLIDE 34

HTTP Traffic Model

Number of Requests per Connection Requests Interval Requests Interval Requests Interval

TCP Connection HTTP Connection HTTP Connection HTTP Connection HTTP Connection

slide-35
SLIDE 35
  • 3 tries per authentication attempt (in practice more

likely to success)

  • True TCP/IP behavior thru use of OS TCP/IP stack
  • Auth cookies persist during subsequent dialogues
  • JavaScript execution using embedded JS engine (lack
  • f complete DOM an obstacle to full emulation)

PoC Tool Design

slide-36
SLIDE 36
  • 1. Converted to black-and-white for max contrast
  • 2. 3x3 median filter applied for denoising
  • 3. Word segmentation
  • 4. Boundary recognition
  • 5. Pixel difference computed against character map

CAPTCHA Bypass Design

slide-37
SLIDE 37

PoC Tool in Action

slide-38
SLIDE 38

Testing Environment

Against Devices Against Services

Measure Attack Traffic Measure Attack Traffic

slide-39
SLIDE 39

Mitigation Bypass

(Protection Products)

Auth Bypass Post-Auth

Testing results under specific conditions, valid as of Jul 13, 2013

Proactive Resource Release

slide-40
SLIDE 40

Mitigation Bypass

(Protection Services)

Auth Bypass Post-Auth

Testing results under specific conditions, valid as of Jul 13, 2013 Proactive Resource Release

slide-41
SLIDE 41
  • Client Puzzle – add cost to individual zombies.

Next-Generation Mitigation

slide-42
SLIDE 42
  • DDoS is expensive to business
  • Existing DDoS protection insufficient
  • Next-Generation solution should make attack

expensive

Conclusion

slide-43
SLIDE 43

tony.miu@nexusguard.com albert.hui@ntisac.org waileng.lee@ntisac.org

Thank You!

http://www.ntisac.org

slide-44
SLIDE 44