Workshop "Anti DDoS ochrana od F5" Praha, 11.5.2016 Prezentoval: David Holmes, F5 Networks

1. Denial of Service
David Holmes
World Wide Security Evangelist
© F5 Networks, Inc

2. © F5 Networks, Inc 2
• Since 2011, F5’s externally-facing Security Evangelist
• Former Principal Software Engineer for F5
• Spoken at 30 conferences on 6 continents, including
• InfoSec Europe, Gartner Data Center, RSA Europe
• 3 Patents
• @dholmesf5 on Twitter
• Published in DarkReading, Network World,
SC Magazine, Wired Online, Gadget and more
• Bi-Weekly column at SecurityWeek
Meet Your Security Evangelist

3. © F5 Networks, Inc 3

4. © F5 Networks, Inc 4
Global Threat Intelligence
• Worldwide Coverage
• Global Scope & Scale
• Regional Focus
• 24x7 Team
• Sensors & Honeynets
• Owned and 3rd Party Intel.
• Darknet and other sources
• Vulnerability Testing
• Research Tools

5. • Ridiculous Introduction
• DDoS Attack Types and Trends
• Network Attacks
• Application Attacks
• Volumetric Attacks
• Collateral
Denial of Service

6. © F5 Networks, Inc 7
Network Attacks

8. © F5 Networks, Inc 9

9. © F5 Networks, Inc 10

10. © F5 Networks, Inc 11
Determined DDoS Activist
• Of the 16 people arrested for the Wikileaks attacks, only one
was female — Mercedes Haefer, a college student at UNLV.
– Representative of the Hacktivist movement.
• www.freemercedes.com
• “If you block traffic on the street during a demonstration it’s a
night in jail and a $200 fine. But if you protest online, it’s a 15-
year prison sentence.”

11. SYN-Flood - Normal TCP Setup
Flow table
3-way handshake establishes connection
Flow table entry created
and inserted on receipt of
SYN packet
Connection Established

12. SYN-Flood – Consume Session Table
Flow table
SYNs overflow flow table on server
Flow table entry created
and inserted on receipt of
SYN packet
Overflow! Denial of Service

13. © F5 Networks, Inc 14
SYN Cookies
Flow table
Original SYN transformed into Cookie, sent back
to client with SYN-ACK
Flow table entry created
and inserted on receipt of
ACK packet
Connection Established

14. Querying for randomly-generated non-existent
hostnames
• Causes enormous work on DNS resolver
• Blows out DNS caches
• Easy to generate – single packet per name
• Easy to spoof source address – UDP
• Asymmetric
• Low-Bandwidth
DNS NXDOMAIN Random Hostname Attack

15. © F5 Networks, Inc 17
Application Attacks

16. © F5 Networks, Inc 18

17. Izz ad-din al Qassam Cyber Fighters
DDoS attacks on Bank of America, NYSE, Wells Fargo, PNC, Chase,
SunTrust, Capital One and others.
Peak attacks 75G, including mix of layer 3, 4, 5 and 7 attacks.
Spotlight: Operation Ababil
Motivation appears to be pro-censorship, specifically demanding the Google remove the
video “Innocence of Muslims.”
Video director has been incarcerated (unrelated charges).
A Fatwa exists against him, the actors, and anyone involved with the video.
• Actors say the anti-Muslim rhetoric was dubbed in post-production.

18. Goal of layer-7 DDoS reconnaissance
• Obtain list of site URIs
• Sort by time-to-complete (CPU cost)
• Sort list by megabytes (Bandwidth)
Spiders for rent on Internet that will do this
• Though they are often known by security community
• Can be done with simple wget script
# wget –r –wait=1 -nv https://the.target.com
Application Reconnaissance

19. 21 © 2013 F5 Networks, Inc.
GET /download/doc.pdf?121234234fgsefasdfl11 HTTP/1.1rn
Host: www.xxxxyyyyzzzz.comrn
User-Agent: Mozilla/4.0rn
Connection: keep-alivern
GET /download/doc.pdf?121234234fgsefasdfl11 HTTP/1.1rn
Host: www.xxxxyyyyzzzz.comrn
User-Agent: Mozilla/4.0rn
Connection: keep-alivern
GET /download/doc.pdf?121234234fgsefasdfl11 HTTP/1.1rn
Host: www.xxxxyyyyzzzz.comrn
User-Agent: Mozilla/4.0rn
Connection: keep-alivern
GET /download/doc.pdf?121234234fgsefasdfl11 HTTP/1.1rn
Host: www.xxxxyyyyzzzz.comrn
User-Agent: Mozilla/4.0rn
Connection: keep-alivern

20. © F5 Networks, Inc 23
Volumetric Attacks

21. © F5 Networks, Inc 24
DD4BC Group – Indiscriminate

22. © F5 Networks, Inc 25

23. © F5 Networks, Inc 26
F5 DDoS
REFERENCE
ARCHITECTURE

24. © F5 Networks, Inc 27
F5 DDoS Reference Architecture
Cloud Network Application
Legitimate
Users
DDoS
Attackers
Cloud
Scrubbing
Service
Volumetric attacks and
floods, operations
center experts, L3-7
known signature attacks
ISPa/b
Multiple ISP
strategy
Network attacks:
ICMP flood,
UDP flood,
SYN flood
DNS attacks:
DNS amplification,
query flood,
dictionary attack,
DNS poisoning
IPS
Network
and DNS
Application
HTTP attacks:
Slowloris,
slow POST,
recursive POST/GET
SSL attacks:
SSL renegotiation,
SSL flood
Financial
Services
E-Commerce
Subscriber
Strategic Point of Control

25. © F5 Networks, Inc 28
• The F5 DDoS Protection Reference Architecture
• https://f5.com/solutions/architectures/ddos-protection
• White paper: The F5 DDoS Protection Reference Architecture
• Best practices: F5 DDoS Protection – recommended Practices
• The F5 Silverline DDoS Protection Service Overview
• https://f5.com/products/platforms/silverline/f5-silverline-ddos-protection
Key Resources

26. © F5 Networks, Inc 29
• 15 Pages
• Vendor Agnostic
• 5 worksheets
DDoS Defense Playbook
10 Steps to Combatting DDoS

27. © F5 Networks, Inc 30
Data Center 2
Data Center 1
CSP
Verizon
Amazon EC2
Second Red Team
Traffic Generators
CSP DDoS Service
[Firewall]
Internet
Router
Internet
Router
IDS
Servers Servers
Internet
Router
Internet
Router
Primary Red Team
Traffic Generators
Clean Traffic Attack Traffic
Simulated Good
Traffic
ACLs filter out all outbound traffic (except
a few specific ranges) ensures no other
customers affected by DDoS Test
ACLs
Customer Self-DDoS Suicide Plan