Slashdot Mirror
200-400 Gbps DDoS Attacks Are Now Normal
An anonymous reader writes "Brian Krebs has a followup to this week's 400 Gbps DDoS attack using NTP amplification. Krebs, as a computer security writer, has often been the target of DDoS attacks. He was also hit by a 200Gbps attack this week (apparently, from a 15-year-old in Illinois). That kind of volume would have been record-breaking only a couple of years ago, but now it's just normal. Arbor Networks says we've entered the 'hockey stick' era of DDoS attacks, as a graph of attack volume spikes sharply over the past year. CloudFlare's CEO wrote, 'Monday's DDoS proved these attacks aren't just theoretical. To generate approximately 400Gbps of traffic, the attacker used 4,529 NTP servers running on 1,298 different networks. On average, each of these servers sent 87Mbps of traffic to the intended victim on CloudFlare's network. Remarkably, it is possible that the attacker used only a single server running on a network that allowed source IP address spoofing to initiate the requests. An attacker with a 1 Gbps connection can theoretically generate more than 200Gbps of DDoS traffic.' In a statement to Krebs, he added, 'We have an attack of over 100 Gbps almost every hour of every day.'"
The obvious solution is to unplug the Internet. I'm sure the government and the movie people will be thrilled.
Hosting/Colo/Transit providers are the real core issue. There is absolutely no reason that URPF or similar or at least ingress ACL's are not in place. Lets face it if your limiting the prefixes announced you should be filtering on them as well. Anything even close to core can do this in hardware, URPF and similar there is generally no config required more than turning it on. At Hosting/Colo levels do you still have something on the public side that can not do at least ACL's in hardware? Plenty of automation packages can do this stuff in an automated fashion. The root cause is lazy and broken providers that just do not care, DDOS traffic can make some of them piles of cash directly in transit billing or indirectly as the only people with a big enough pipe to do ddos protection.
No sir I dont like it.
So why don't NTP servers limit their responses to, say, 1 per 10 seconds per IP address? Even if spoofing, it would not take that long to exhaust the subnet of the attack target.
Maybe this is another reason to use TOR or something more generic to mask IP? Not for privacy, but to hide in the crowd. Google wants to know everything anyway....maybe they should offer a service to be a web-proxy-server.
These services are available for any kid with five dollars. The last one that hit my network knocked us off and our upstream provider. They use spoofed packets to machines with services such as chargen/echo to amplify the attacks. If you contact one of these services they will threaten or try to extort money from you.
I can't help but notice all the comments so far are about technical prevention. If it is possible, well, that would be great. But for those who dodge all technical barriers and pull this off, maybe its time for some laws equivalent to those insanely high penalties for file-sharing. It's not like a 200Gbps attacks are inadvertent or accidental; they take some deliberate effort. Make it a criminal-record, no-passport, ruin-your-employability, year-in-jail kind of crime. I suppose the 15-year-old in Illinois will have his computer taken away; what if HE were taken away?
While we patch and patch, we might be getting close to the point where a real restructuring or protocol update needs to happen. Various researchers have proposed technologies that could make the internet far more resilient to stuff like this, and maybe it is time we switch over.
But I am not thinking some nice gradual switch over, but a nice 'if you don't upgrade by X time you loose your insurance and can no longer peer'. If nothing else we could kill at least two birds with one stone... think about the massive economic fallout from the Y2K update, all the money that flowed into tech and job for that had a ripple effect through the economy. Requiring a complete upgrade of the internet would put a real dent in the current economic downturn.
Require ISPs to do checks on IP spoofing. Case closed for most DDoS attacks. Optimization always comes at a cost of security. I'm not even an expert and still know the solution, just like a kid can read and click through a premade tool, fill out some forms and do attacks.
Kids don't have the moral subroutines to understand restraint. Anyone with a minimum amount of knowledge can fire off attacks these days, it seems.
If someone starts DDOSing tor nodes with 200Gbps the entire network will become unusable.
Would you like us to send a refresh signal to your cable modem?
Somewhere, something incredible is waiting to be known. -Carl Sagan
Compared with the mostly unsolvable new normal of having most of basic internet infrastructure backdoored by a government i'd say that is pretty benign. You can diminish a lot asking administrators to fix their NTP servers or ban their IPs. But no matter how much you try, internet as a worldwide network is broken beyond repair, you can choose to ignore that fact (as much you can ignore to being hit by a 400gbps attack), but it will still be broken.
...I mean it's not like CloudFlare's CEO could drum up any more business by exaggerating the threat of DDOSes or anything...
All this talk about young brains not being capable of knowing what consequences follow from their action, I'll call bullshit right now.
Thing is, I was a bit of a teenager once. Prone to pranks and doing things I shouldn't have. But, I *always* knew that I did, the results that would have, and how people would be disadvantaged by it. I knew. I also knew I shouldn't have done it. That I did it anyway is in no way due to my inadequately developed brain, but completely due to my lack of upbringing and moral values. I knew better. Then, and now. I should have been thrown the book at. Repeatedly, I might add.
DDOS'ing a site? Lock 'm up for, at least, twenty years. The Internet is essential for civilized life nowadays. We wouldn't be lenient on people that blew up power lines, why be soft on the cyber criminals? Arguably they commit worse crimes.
Find them, charge them, incarcerate them. Put it all over the news. Make it known the Internet is not the be tampered with, just like power lines, gas lines, and other essential infrastructure.
That will stop them. Or at least it will stop them for doing it *again*, once caught.
Since Windows started issuing certification warnings for third-party software, fewer relatively fewer trojans have effected Windows boxes. The same tactic has always helped reduce the infection rate for Mac OS. iOS fairs even better because all software approved by Apple for Appstore are screened. This is one way of reducing the bandwidth available for perpetrators: reduce the pasturing grounds for bot-herders.
That 99% of all mobile malware targets Android, as per Kaspersky, is evidence enough that the Appstore model works better (see heading 'Malware for Android' in link http://www.securelist.com/en/a...). With well over a billion Android activations to date, this is a whole new playground for bandwidth bandits to exploit (and are exploiting very effectively). Unless Google does something to ensure that their stores are sanitized this epidemic will continue to get worse.
Finally, penalizing countries that continue to support software piracy will also help. The main vector for the propagation of trojans is pirated software. Some countries have so much malware (take a look at the table under the title 'Local threats' in this link http://www.securelist.com/en/a...) that you have to wonder if their national bandwidth capacity is utilized for any productive use at all. Should these countries be penalized in terms of bandwidth available to them unless they proactively combat their piracy markets?
Then make the originating network legally and financially responsible for not filtering the spoofed packets originating from their network with a IDP (Internet Death Protocol) for any networks which do not fix their network within 3 days following a attack launched from their network.
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
Could NTP amplification be used to over stress the P.R.I.S.M. server banks? Or could these unsecured networks be used to spoof packets to poison "metadata" (NSA version of metadata)?
How can you push out propaganda if your main distribution method goes away?
---- Booth was a patriot ----
@by The Cat: "The obvious solution is to unplug the Internet. I'm sure the government and the movie people will be thrilled."
..
The obvious solution is to unplug Microsoft Windows from the Internet. It's all those Windows desktops out there that are the root cause of these DDoS attacks
Who cares... they are still in business? Focus on making us a better O-scope and keep your tripe to yourselves.
DDoS/DoS CAN be stopped (Microsoft & Amazon are setup PERFECTLY vs. it in fact, read on below on that note)!
---
Microsoft Windows NT-based OS settings vs. DoS:
Protect Against SYN Attacks
FROM -> http://msdn.microsoft.com/en-u...
A SYN attack exploits a vulnerability in the TCP/IP connection establishment mechanism. To mount a SYN flood attack, an attacker uses a program to send a flood of TCP SYN requests to fill the pending connection queue on the server. This prevents other users from establishing network connections.
To protect the network against SYN attacks, follow these generalized steps, explained later in this document:
Enable SYN attack protection
Set SYN protection thresholds
Set additional protections
Enable SYN Attack Protection
---
The named value to enable SYN attack protection is located beneath the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters.
Value name: SynAttackProtect
Recommended value: 2
Valid values: 0, 1, 2
Description: Causes TCP to adjust retransmission of SYN-ACKS. When you configure this value the connection responses timeout more quickly in the event of a SYN attack. A SYN attack is triggered when the values of TcpMaxHalfOpen or TcpMaxHalfOpenRetried are exceeded.
---
Set SYN Protection Thresholds
The following values determine the thresholds for which SYN protection is triggered. All of the keys and values in this section are under the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters
These keys and values are:
Value name: TcpMaxPortsExhausted
Recommended value: 5
Valid values: 0?65535
Description: Specifies the threshold of TCP connection requests that must be exceeded before SYN flood protection is triggered.
Value name: TcpMaxHalfOpen
Recommended value data: 500
Valid values: 100?65535
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state. When SynAttackProtect is exceeded, SYN flood protection is triggered.
Value name: TcpMaxHalfOpenRetried
Recommended value data: 400
Valid values: 80?65535
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state for which at least one retransmission has been sent. When SynAttackProtect is exceeded, SYN flood protection is triggered.
---
Set Additional Protections
All the keys and values in this section are located under the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters. These keys and values are:
Value name: TcpMaxConnectResponseRetransmissions
Recommended value data: 2
Valid values: 0?255
Description: Controls how many times a SYN-ACK is retransmitted before canceling the attempt when responding to a SYN request.
Value name: TcpMaxDataRetransmissions
Recommended value data: 2
Valid values: 0?65535
Description: Specifies the number of times that TCP retransmits an individual data segment (not connection request segments) before aborting the connection.
Value name: EnablePMTUDiscovery
Recommended value data: 0
Valid values: 0, 1
Description: Setting this value to 1 (the default) forces TCP to discover the maximum transmission unit or largest packet size over the path to a remote host. An attacker can force packet fragmentation, which overworks the stack.
Specifying 0 forces the MTU of 576 bytes for connections from hosts not on the local subnet.
Value name: KeepAliveTime
Recommended value data: 300000
Valid values: 80?4294967295
Description: Specifies how often T
DDOS causes more lost money than other "security" breaches. Therefore it is a top priority of companies and by extension public/private partnerships.
Of course, this is an asymmetric attack and you can't stop it. In other words, it is a democratizing attack.
When I worked with the FBI on security issues in the financial sector, I was disgusted by how little attention and funds were available to fix problems like unauthorized transactions but attention is available for issues like this.
-- I was raised on the command line, bitch
You wrote both "weaponize" and "weapon eyes", and you made some reference to "skateboarders" that I couldn't puzzle apart. What's going on here? Is your device set to "wreck a nice beach"?
iOS [fares] even better because all software approved by Apple for Appstore are screened.
But if most home computers are locked down to run only software chosen by the monopoly "App Store" chosen by the computer's manufacturer, then how will high school students enrolled in an introductory programming class complete their homework?
Finally, penalizing countries that continue to support software piracy will also help.
That or penalizing companies that refuse to sell their products at all in certain countries. In affected countries, copyright infringement is the only way to obtain a copy of the work at all.
May I remind you the internet is a global borderless network, which makes such laws impossible to implement.
Then perhaps the solution is to introduce borders, to implement something like SOPA except reworded to be not quite as unpalatable to civil libertarian types.
However, as long as the right legal systems and enterprising businesses exist, ventures like Android will keep popping up to balance out (and eventually crush?) 'monopolies' like iOS.
Then where's the 4" Wi-Fi-only tablet that can run applications designed for recent versions of Android as a competitor to the iPod touch? Or are people supposed to just buy a phone, not activate cellular data service on it, and pay for a GSM radio that they'll never use?
[In an App Store world,] how will high school students enrolled in an introductory programming class complete their homework?
As for young aspiring coders, they can use a free student certificate
Since when? This page states that only accredited postsecondary degree-granting institutions, not high schools, are allowed to participate. Besides, the parents would still need to buy the student a Mac on which to run Xcode; it does not run on an iPad even with a Bluetooth keyboard.
The real issue in this regard will be the effect on the open-source market. Then again, even Linux users are heavily dependent on online centralised package repositories, which could start adopting screening schemes.
Official repos already have screening schemes. But Linux distros also give system administrators the power to add third-party repos that someone other than the distro publisher screens. Ubuntu has PPAs, Android has Amazon Appstore and F-Droid, etc.
Or should people live according to their means
These "means" themselves are hard to compare between countries. Developers in the developed world expect to get paid on an exchange rate basis, while people earn wages on a purchasing power parity basis. The Balassa-Samuelson model predicts that currencies of markets without an established export industry will have disadvantageous exchange rates with more industrialized markets. Do a corrupt judicial branch and an economy oriented towards locally consumed goods and services go hand-in-hand?