4 ms·

Looks to me like it's time for a DDoS X-Prize. 1. SSDP Flood 21% 2. SYN Flood 19% 3. UDP Flood 13% 4. UDP Fragment 12% 5. NTP Flood

by joshuak 12y ago

Looks to me like it's time for a DDoS X-Prize. 1. SSDP Flood 21% 2. SYN Flood 19% 3. UDP Flood 13% 4. UDP Fragment 12% 5. NTP Flood 8% 6. GET Flood 7% 7. CharGEN Attack 5% 8. DNS Flood 5% 9. ICMP Flood 2% 10. SNMP Flood 2% Eliminating these 10 attack vectors would account for 94% of DDoS attacks according to this visualization[1], as witnessed by Akamai over the last 30 days. Just the top 3 is more than 50%. Seems like a reasonable start on a way to measure success. Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money? [1] http://www.stateoftheinternet.com/trends-visualizations-security-real-time-global-ddos-attack-sources-types-and-targets.html http://www.stateoftheinternet.com/trends-visualizations-secu...

mike_hearn 12y ago
SYN Flood is already mitigated a long time ago with SYN cookies. The rest ..... well, it's basically just packets. I see this latest development as good news. The Javascript MITM trick was very clever because forcing github to render and serve a page is a lot more resource consuming than just firing packets at servers that ignore them (like a UDP or SYN flood). The latter can saturate network links until the sources are blocked, but those sources tend to be somewhat focused and don't shift much. An HTTP level attack driven by random web users means every request might have a different IP and it requires running way more of the app stack to be able to filter them out. If China is now resorted to SYN flooding then it means they ran out of better techniques.
- pyre 12y ago
  > well, it's basically just packets Is "DNS flood" a DNS reflection attack though?
  - majke 12y ago
    Usually no. There are generally two types of floods against DNS infrastructure: - Flood of "valid" requests, to a large number of open DNS recursors. To avoid caching they usually contain random prefix. Flood against large number of open DNS recursors basically causes the recursors to not work, and many authoritative servers to be overwhelmed. - Flood directly against authoritative servers, to fill the network or use up all the CPU. Traditional reflections aren't that popular any more.
- blibble 12y ago
  synflooding is not mitigated by syncookies. the attacker can encode information inside the packets in exactly the same way as the server, meaning they don't have to maintain any state, see: http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.ppt http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.ppt (slide 18 onwards)
  - Buge 12y ago
    That's not a syn flood though. A syn flood is purely syns. So there is no need for the attacker to encode information if they are just doing a syn flood.
xorcist 12y ago
Most of these attack vectors just mean a great amount of a specific traffic of some sort. Traffic volume is not something that you can, or would want to, eliminate. You have to somehow identify and separate the unwanted requests from you regular traffic. That's why these cases are unique and needs to be handled manually, in cooperation with your uplink(s).
- joshuak 12y ago
  To be clear these are attack vector prevalence relative to each other, and represent 'known' attack traffic identified by Akamai, not general traffic in these protocols. However, this is no doubt not a complete list of DDoS vectors as it doesn't account for application level exploits like demonstrated in the GitHub attacks. And obviously not everything that is a DDoS is a protocol flood. Either there is a way to identify those types of attacks now, or improved attack identification should be included as a requirement for the X-Prize.
codexon 12y ago
You aren't going to make ddos attacks go away by offering prizes for a miracle software solution. It amazes me that there are so many programmers here who don't understand this basic principal. I think the only way we can get people to understand the situation is with an analogy. Let's say your pipe can receive 1 Liter per second of water. There are some impurities that you can filter through your faucet, this is analogous to the software firewall. However what happens when someone starts piping 99 L/s of sludge through the other end? No matter how sophisticated the filter you have on your faucet, the water you will get out of it is going to slow to a trickle. Now I can already hear you asking, why does the Internet allow people to send whatever sludge they want? And the answer is because that's the way the internet is made. There has been a push to stop spoofing called BCP38, but this requires EVERYONE to do extra work and spend extra money which is why relatively little progress has been made since it was released 15 years ago, and is likely to never succeed. If it was as easy as creating a piece of software to deal with, large businesses like Prolexic wouldn't be banking their future on a problem that would be so easily solved.
- joshuak 12y ago
  I think there are plenty of people, myself included, who understand how DDoS attacks work. Do you know how X-Prizes work? Hit: Did I say anything about software? [edit: It's odd to me that this would get down voted. Is it offensive? Or are downvoters really that opposed to thinking outside of the box? The X-Prize encourages participation from unexpected directions, precisely where innovation is often found. As the parent post demonstrates (almost as if on queue), it's quite common for skilled experts within a field to become overly focused on specific classes of solution. I was careful not to say anything about how the above goals might be achieved.]
  - edmccard 12y ago
    >Did I say anything about software? Well, you did say: "Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money?"
    - 12y ago

by joshuak 12y ago

mike_hearn 12y ago

SYN Flood is already mitigated a long time ago with SYN cookies. The rest ..... well, it's basically just packets. I see this latest development as good news. The Javascript MITM trick was very clever because forcing github to render and serve a page is a lot more resource consuming than just firing packets at servers that ignore them (like a UDP or SYN flood). The latter can saturate network links until the sources are blocked, but those sources tend to be somewhat focused and don't shift much. An HTTP level attack driven by random web users means every request might have a different IP and it requires running way more of the app stack to be able to filter them out. If China is now resorted to SYN flooding then it means they ran out of better techniques.

pyre 12y ago
> well, it's basically just packets Is "DNS flood" a DNS reflection attack though?
- majke 12y ago
  Usually no. There are generally two types of floods against DNS infrastructure: - Flood of "valid" requests, to a large number of open DNS recursors. To avoid caching they usually contain random prefix. Flood against large number of open DNS recursors basically causes the recursors to not work, and many authoritative servers to be overwhelmed. - Flood directly against authoritative servers, to fill the network or use up all the CPU. Traditional reflections aren't that popular any more.
blibble 12y ago
synflooding is not mitigated by syncookies. the attacker can encode information inside the packets in exactly the same way as the server, meaning they don't have to maintain any state, see: http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.ppt http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.ppt (slide 18 onwards)
- Buge 12y ago
  That's not a syn flood though. A syn flood is purely syns. So there is no need for the attacker to encode information if they are just doing a syn flood.

xorcist 12y ago

Most of these attack vectors just mean a great amount of a specific traffic of some sort. Traffic volume is not something that you can, or would want to, eliminate. You have to somehow identify and separate the unwanted requests from you regular traffic. That's why these cases are unique and needs to be handled manually, in cooperation with your uplink(s).

joshuak 12y ago
To be clear these are attack vector prevalence relative to each other, and represent 'known' attack traffic identified by Akamai, not general traffic in these protocols. However, this is no doubt not a complete list of DDoS vectors as it doesn't account for application level exploits like demonstrated in the GitHub attacks. And obviously not everything that is a DDoS is a protocol flood. Either there is a way to identify those types of attacks now, or improved attack identification should be included as a requirement for the X-Prize.

codexon 12y ago

You aren't going to make ddos attacks go away by offering prizes for a miracle software solution. It amazes me that there are so many programmers here who don't understand this basic principal. I think the only way we can get people to understand the situation is with an analogy. Let's say your pipe can receive 1 Liter per second of water. There are some impurities that you can filter through your faucet, this is analogous to the software firewall. However what happens when someone starts piping 99 L/s of sludge through the other end? No matter how sophisticated the filter you have on your faucet, the water you will get out of it is going to slow to a trickle. Now I can already hear you asking, why does the Internet allow people to send whatever sludge they want? And the answer is because that's the way the internet is made. There has been a push to stop spoofing called BCP38, but this requires EVERYONE to do extra work and spend extra money which is why relatively little progress has been made since it was released 15 years ago, and is likely to never succeed. If it was as easy as creating a piece of software to deal with, large businesses like Prolexic wouldn't be banking their future on a problem that would be so easily solved.

joshuak 12y ago
I think there are plenty of people, myself included, who understand how DDoS attacks work. Do you know how X-Prizes work? Hit: Did I say anything about software? [edit: It's odd to me that this would get down voted. Is it offensive? Or are downvoters really that opposed to thinking outside of the box? The X-Prize encourages participation from unexpected directions, precisely where innovation is often found. As the parent post demonstrates (almost as if on queue), it's quite common for skilled experts within a field to become overly focused on specific classes of solution. I was careful not to say anything about how the above goals might be achieved.]
- edmccard 12y ago
  >Did I say anything about software? Well, you did say: "Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money?"
  - 12y ago