DDoS Defense

Tags:
Categories:

DDoS Defense

DDoS Definition

Two kinds of DoS attacks:

  • Crash the service
  • Congest the network

Attack Types

Attack TypeAttack MethodCountermeasure
Distributed DoSMultiple independent-IP machines begin attacking simultaneously1. Degrade service 2. Blacklist 3. Shut down network equipment
Yo-yo attackAgainst services that can auto-scale resources, attacks during the small window when resources are shrinkingBlacklist
Application layer attacksTarget specific functions or features; LAND attacks fall into this categoryBlacklist
LANSSpecially crafted TCP SYN packets (normally used to open a new connection) cause the target to open a null connection whose source and destination are both its own IP, continuously self-responding until it crashes. Different from SYN flood.Blacklist
Advanced persistent DoSAnti-reconnaissance / pinpoint targets / evasion / long duration / high compute / multithreadedDegrade service
HTTP slow POST DoSAfter creating legitimate connections, send large amounts of data at very low speed until server resources are exhaustedDegrade service
Challenge Collapsar (CC) attackFrequently send standard legitimate requests that consume heavy resources (e.g., search engines use lots of RAM)Degrade service, content identification
ICMP floodMass ping / bad ping / Ping of Death (malformed ping packets)Degrade service
Permanent denial-of-service attacksAttack on hardwareContent identification
Reflected attackSend requests to third parties, spoof source address so replies go to the real victimDDoS scope
AmplificationExploit some services as reflectors to magnify trafficDDoS scope
Mirai botnetLeverage compromised IoT devicesDDoS scope
SACK PanicManipulate MSS and selective acknowledgement to cause retransmissionContent identification
Shrew attackExploit weaknesses in TCP retransmission timeout with short synchronous bursts to disrupt TCP connections on the same linkTimeout discard
Slow Read attackLike slow POST: send legitimate requests but read extremely slowly to exhaust connection pools by advertising a very small TCP Receive WindowTimeout disconnect, degrade service, blacklist
SYN floodSend large numbers of TCP/SYN packets, creating half-open connectionsTimeout mechanism
Teardrop attacksSend malformed IP fragments with overlapping oversized payloads to the targetContent identification
TTL expiry attackWhen packets are dropped due to TTL expiry, the router CPU must generate and send ICMP Time-Exceeded responses; generating many of these overloads the CPUDrop traffic
UPnP attackBased on DNS amplification, but uses a UPnP router that forwards requests from an external source while ignoring UPnP rulesDegrade service
SSDP reflectionMany devices, including home routers, have UPnP vulnerabilities that let attackers obtain replies to a spoofed target on port 1900Degrade service, block port
ARP spoofingAssociate a MAC address with another computer or gateway (router) IP so traffic directed to the legitimate IP is rerouted to the attacker, causing DoSDDoS scope

Protective Measures

  1. Identify attack traffic

    • Disrupt service
      • Inspect traffic content
    • Congest service
      • Log access times

  2. Process attack traffic

    • Drop attack packets
    • Ban attacker IPs
      • IPv4 addresses are scarce, blacklists easy to build
      • IPv6 is plentiful, blacklists harder; can use CIDR blocks but risks collateral blocking
    • Control access rate

Open-source Tools

Attack Tools

Defense Tools

Traffic Monitoring