Routing Security DDoS and Route Hijacks. Merike Kaeo CEO, Double Shot Security
|
|
- Willis Douglas
- 5 years ago
- Views:
Transcription
1 Routing Security DDoS and Route Hijacks Merike Kaeo CEO, Double Shot Security
2 DISCUSSION POINTS Understanding The Growing Complexity DDoS Attack Trends Packet Filters and RTBH Admitting We Need to Take More Action Our Collective Responsibility
3 HOW DO ANY ATTACKS START? Protocols have flaws Implementations have bugs Implementations have poor default settings Home users are IoT operators but not network engineers If someone floods traffic, how do you NOT cause collateral damage to legitimate traffic?
4 DDoS AND ROUTING INFRASTRUCTURES Distributed and mostly coordinated attacks Increasing in rate and sophistication Hundreds of Gbps is not uncommon in extreme cases Infrastructure availability at risk Coordinated attack against infrastructure Attacks against multiple infrastructure components Overwhelming amounts of data Huge effort required to analyze Lots of uninteresting events
5 AUTOMATED DDoS ATTACKS 2 Vulnerable hosts are compromised and attack tools installed Attacker 1 Initiate port scan 2 Vulnerable hosts are compromised and attack tools installed 3 Further scanning for compromises 3 Further scanning for compromises 4 Massive DDoS attack launched Victim
6 HISTORICAL VIEW: DoS Single Machine and relatively unsophisticated Ping of Death (1996) Attacker sends ping packet larger than 65,536 bytes Land.c (1997) Attacker sends TCP SYN spoofed packet where source and destination IPs and ports are identical Smurf (1999) Large number of ICMP messages sent using target spoofed source IP address and destination IP broadcast address Fraggle Variation of SMURF attack using UDP port 7 (echo) and port 23 (chargen) instead of ICMP
7 HISTORICAL VIEW: DDoS Multiple Machines used to orchestrate attack Distributed and automated Trinoo (1999) The attacker(s) control one or more "master" servers, each of which can control many "daemons. The daemons are all instructed to coordinate a packet based attack against one or more victim systems. Specific ports are used in communications Utilizes UDP and ICMP Port Unreachable messages
8 HISTORICAL VIEW: DDoS TFN (Tribal Flood Network) (1999) - More sophisticated tool that can cause ICMP flood, SYN flood, UDP flood and SMURT-style attacks - Communications between attack infrastructures uses ICMP echo and echo-reply packets - IP Identification and payload of ICMP echo-reply identify type of attack - IP address can be spoofed TFN2K (1999/2000) Newer variant of TFN and doesn t use specific ports Stacheldraht (2000) Combines features of Trinoo and original TFN tool It can encrypt communications
9 OTHER WELL KNOWN ATTACKS YouTube [Blackhole Traffic] Pakistan Telecom was ordered to block YouTube YouTube s traffic was temporarily rerouted to Pakistan Turk Telekom [DNS Cache Poisoning] Turkish president ordered censorship of twitter Turk Telekom s DNS servers configured to return false IP Turk Telekom hijacked Google s IP addresses to disable using Mirai Up to 1.2Gbps DDoS targeting Dyn Many Many More (many not in mainstream media)
10 CURRENT DDoS TRENDS Source: Verisign DDoS Trends Report Volume 5, Issue 1 1 st Quarter 2018
11 GAME CHANGERS PEAK SIZE DURATION COMPLEXITY Source: Verisign DDoS Trends Report Volume 5, Issue 1 1 st Quarter 2018
12 RECENT DNS ATTACK VIA ROUTE HIJACK Amazon route prefixes were hijacked Amazon s Route53 DNS traffic was re-routed towards a malicious DNS server The malicious DNS authoritative server had a legitimate IP address These malicious DNS authoritative servers sent DNS answers back to DNS resolvers that pointed to malicious sites (i.e. cache poisoning) Traffic to any query to DNS resolvers that asked for names handled by Route53 would route to malicious sites.
13 BGP ROUTE HIJACK I usually announce / / / /23 I don t prefix filter and propagate the BAD routes Internet I hijack the Amazon AWS53 routes by sending more specific prefixes I accept the Amazon AWS 53 ranges with more specific route prefixes (/24s) and send them on. VicRm Client Recursive DNS Servers Vic@m I hear and believe the hijacked routes to Route53
14 DNS CACHE POISONING I send fake answer for the Ethereum site to cache poison recursive DNS servers Malicious AuthoritaRve Route53 DNS Servers Internet How do I get to the Ethereum site VicRm Client Recursive DNS Servers I route the request to get to Route53 authoritarve servers which are now the malicious authoritarve DNS servers There is no entry in cache so let me go ask authoritarve DNS server
15 ATTACK MITIGATION TECHNIQUES Route hijack would not have been possible if there had been effective BGP prefix filtering Most environments do NOT filter comprehensively ISPs should be filtering customer s prefixes ISPs should be filtering prefixes going out of their network Route hijack would not have been possible if RPKI used Recursive DNS server cache poisoning would not have been possible if DNSSEC had been deployed
16 WHY NETWORK HYGIENE MATTERS Best practices for network infrastructure security risk mitigation techniques have existed for decades Without deploying appropriate mitigation techniques we leave ourselves at risk for attackers to succeed with more sophisticated attacks. BGP and DNS have inter-dependencies which recently caused a successful attack. How many more attacks of this nature are in our immediate future?
17 DDoS AND ROUTER CPU OVERLOAD Attacks on applications affect CPU performance and leads to BGP instability Increasing numbers infected hosts that still used forged source IP addresses Small packet processing is taxing on many routers, even high-end architectures Filtering is useful but also has CPU hit
18 DEFENDING AGAINST DDoS Packet filters at customer site Must consider that packets have already traversed link Link could already be swamped Filters at ISP side could help Requires human intervention Requires serious CPU power on ISP access router doing the filtering Using all the ISPs routers to help Manually null route all traffic to IP address under attack Automated solution via Remotely Triggered Blackhole Filtering (RTBH)
19 REMOTELY TRIGGERED BLACKHOLE ROUTING BGP used to trigger network wide response Exploits router s forwarding logic to drop packets Packets are forwarded to a Null interface (aka Discard Interface ) Effective against spoofed and valid source IP addresses Fast response times Triggers network wide black holes as fast as ibgp can update the network Operational Deployments/Standardization Operationally used since the early 2000s RFC3882 Configuring BGP to Block Denial-of-Service Attacks (2004) RFC5635 Remotely Triggered Black Hole Filtering with urpf (2009) RFC7999 Blackhole Community (2016)
20 COMPONENTS OF RTBH ebgp Session Provider Edge Routers Attack Traffic BGP Update ibgp Trigger Router TARGET
21 DESTINATION BASED RTBH Steps Trigger 3. Withdrawal ibgp Trigger Router PE configured with static route to unused space set to Null0 ( /32 set to Null0) Receives ibgp update which states next hop for target is /32 Installs new (valid) route to target NOTE: All traffic to the target is dropped, even legitimate traffic TARGET TR configured to redistribute static into every ibgp peer Add static route which sets next hop to target destination ( ) Manually remove static route which causes BGP route withdrawl
22 UNICAST REVERSE PATH FORWARDING Originally created to scale BCP38 ingress filtering Check router s FIB for matching source IP address Strict vs Loose Mode Loose mode urpf provided ISPs with the means to trigger a network wide, source based black hole filter
23 BLACKHOLE FILTER CPU ADVANTAGES Packets Arrive FIB Null0/Discard Ingress Packet Filter Egress Interface Forward packet to the Bit Bucket Blackhole Filtering Saves on CPU and ACL processing
24 SOURCE BASED RTBH Steps Trigger 3. Withdrawal ibgp Trigger Router 1 PE configured with static route to unused space set to Null0 TARGET 1 ( /32 set to Null0) and loose mode urpf on external interfaces 2 3 Receives ibgp update which states next hop for target is /32. All traffic from source IP will fail loose urpf check. Installs new (valid) route to target NOTE: Only traffic from the attack sources get dropped 3 2 TR configured to redistribute static into every ibgp peer Add static route which sets next hop to target destination ( ) Manually remove static route which causes BGP route withdrawl
25 COMBINE PACKET FILTERS AND RTBH Packet Filter Strengths Detailed filtering (ports, protocols, ranges, fragments, etc.) Enlist support of upstream ISP Packet Filter Weaknesses Operationally challenging with frequent changes Difficult to deploy simultaneously on a multitude of devices Utilize Both Packet Filters and RTBH to Address Strengths Packet filters handle the strict static policies urpf remote-triggered black hole handles the dynamic sourcebased drops
26 ADDED CONSIDERATIONS Deploy Ingress Filtering [IETF - BCP 38] Segment Areas for Route Distribution Design Networks to Avoid Fate Sharing Outages don t affect entire network but only portions of it Control Router Access Watch against internal attacks [physical and/or virtual] Use different credentials for router root ( enable ) access Use cryptographically protected protocols for device access and management (SSH, NTP, SNMP, SCP, etc) Monitor for Configurations Changes Scanning Craze for all Kinds of Ports and Vulnerabilities Will Be a Never Ending Battle
27 ASSUMING RESPONSIBILITY A smart man learns from his own mistakes, a wise man learns from mistakes of others, and a fool never learns
Data Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
More informationNETWORK SECURITY. Ch. 3: Network Attacks
NETWORK SECURITY Ch. 3: Network Attacks Contents 3.1 Network Vulnerabilities 3.1.1 Media-Based 3.1.2 Network Device 3.2 Categories of Attacks 3.3 Methods of Network Attacks 03 NETWORK ATTACKS 2 3.1 Network
More informationCSE 565 Computer Security Fall 2018
CSE 565 Computer Security Fall 2018 Lecture 18: Network Attacks Department of Computer Science and Engineering University at Buffalo 1 Lecture Overview Network attacks denial-of-service (DoS) attacks SYN
More informationInternetwork Expert s CCNA Security Bootcamp. Common Security Threats
Internetwork Expert s CCNA Security Bootcamp Common Security Threats http:// Today s s Network Security Challenge The goal of the network is to provide high availability and easy access to data to meet
More informationDenial of Service. Serguei A. Mokhov SOEN321 - Fall 2004
Denial of Service Serguei A. Mokhov SOEN321 - Fall 2004 Contents DOS overview Distributed DOS Defending against DDOS egress filtering References Goal of an Attacker Reduce of an availability of a system
More informationSecurity in inter-domain routing
DD2491 p2 2011 Security in inter-domain routing Olof Hagsand KTH CSC 1 Literature Practical BGP pages Chapter 9 See reading instructions Beware of BGP Attacks (Nordström, Dovrolis) Examples of attacks
More informationDDoS and Traceback 1
DDoS and Traceback 1 Denial-of-Service (DoS) Attacks (via Resource/bandwidth consumption) malicious server legitimate Tecniche di Sicurezza dei Sistemi 2 TCP Handshake client SYN seq=x server SYN seq=y,
More informationDenial of Service Protection Standardize Defense or Loose the War
Denial of Service Protection Standardize Defense or Loose the War ETSI : the threats, risk and opportunities 16th and 17th - Sophia-Antipolis, France By: Emir@cw.net Arslanagic Head of Security Engineering
More informationSecurity+ Guide to Network Security Fundamentals, Fourth Edition. Network Attacks Denial of service Attacks
Security+ Guide to Network Security Fundamentals, Fourth Edition Network Attacks Denial of service Attacks Introduction: What is DoS? DoS attack is an attempt (malicious or selfish) by an attacker to cause
More informationThreat Pragmatics. Target 6/19/ June 2018 PacNOG 22, Honiara, Solomon Islands Supported by:
Threat Pragmatics 25-29 June 2018 PacNOG 22, Honiara, Solomon Islands Supported by: Issue Date: Revision: 1 Target Many sorts of targets: Network infrastructure Network services Application services User
More informationChair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 8
Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 8 System Vulnerabilities and Denial of Service Attacks System Vulnerabilities and
More informationDDoS made easy. IP reflection attacks for fun and profit. Gert Döring, SpaceNet AG, München. DECIX/ECO security event,
DDoS made easy IP reflection attacks for fun and profit Gert Döring, SpaceNet AG, München DECIX/ECO security event, 04.12.14, Frankfurt Agenda what are IP reflection attacks? why are they so effective
More informationNISCC Technical Note 06/02: Response to Distributed Denial of Service (DDoS) Attacks
NISCC Technical Note 06/02: Response to Distributed Denial of Service (DDoS) Attacks Background This NISCC technical note is intended to provide information to enable organisations in the UK s Critical
More informationOur Narrow Focus Computer Networking Security Vulnerabilities. Outline Part II
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2016 www.cs.cmu.edu/~prs/15-441-f16 Yes: Creating a secure channel for communication (Part I) Protecting
More informationPrevent DoS using IP source address spoofing
Prevent DoS using IP source address spoofing MATSUZAKI maz Yoshinobu 06-Sep-2006 Copyright (C) 2006 Internet Initiative Japan Inc. 1 ip spoofing creation of IP packets with source addresses
More informationDistributed Denial of Service (DDoS)
Distributed Denial of Service (DDoS) Defending against Flooding-Based DDoS Attacks: A Tutorial Rocky K. C. Chang Presented by Adwait Belsare (adwait@wpi.edu) Suvesh Pratapa (suveshp@wpi.edu) Modified by
More informationNetwork Security. Thierry Sans
Network Security Thierry Sans HTTP SMTP DNS BGP The Protocol Stack Application TCP UDP Transport IPv4 IPv6 ICMP Network ARP Link Ethernet WiFi The attacker is capable of confidentiality integrity availability
More informationSpaceNet AG. Internet Business Produkte für den Mittelstand. Produkt- und Firmenpräsentation. DENOG6, , Darmstadt
SpaceNet AG Internet Business Produkte für den Mittelstand Produkt- und Firmenpräsentation DENOG6, 20.11.14, Darmstadt DDoS made easy IP reflection attacks for fun and profit Gert Döring, SpaceNet AG,
More informationDenial of Service. EJ Jung 11/08/10
Denial of Service EJ Jung 11/08/10 Pop Quiz 3 Write one thing you learned from today s reading Write one thing you liked about today s reading Write one thing you disliked about today s reading Announcements
More informationChapter 10: Denial-of-Services
Chapter 10: Denial-of-Services Technology Brief This chapter, "Denial-of-Service" is focused on DoS and Distributed Denial-of-Service (DDOS) attacks. This chapter will cover understanding of different
More informationUnicast Reverse Path Forwarding Loose Mode
The feature creates a new option for Unicast Reverse Path Forwarding (Unicast RPF), providing a scalable anti-spoofing mechanism suitable for use in multihome network scenarios. This mechanism is especially
More informationConfiguring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
More informationComputer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 8 Denial of Service First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Denial of Service denial of service (DoS) an action
More informationContents. Configuring urpf 1
Contents Configuring urpf 1 Overview 1 urpf check modes 1 Features 1 urpf operation 2 Network application 3 Configuration procedure 4 Displaying and maintaining urpf 4 urpf configuration example 4 Configuring
More informationBackscatter A viable tool for threat of the past and today. Barry Raveendran Greene March 04, 2009
Backscatter A viable tool for threat of the past and today Barry Raveendran Greene March 04, 2009 bgreene@senki.org Agenda Backscatter: What is it? VzB s use with the Backscatter Traceback Technique. Using
More informationTDC 375 Network Protocols TDC 563 P&T for Data Networks
TDC 375 Network Protocols TDC 563 P&T for Data Networks Routing Threats TDC 375/563 Spring 2013/14 John Kristoff DePaul University 1 One of two critical systems Routing (BGP) and naming (DNS) are by far
More informationDNS Attacks. Haythem EL MIR, CISSP CTO, NACS
DNS Attacks Haythem EL MIR, CISSP CTO, NACS Why worry about DNS? All Applications Rely on DNS! VeriSign: DoS attack could shut down internet Denial-of-service attacks are growing faster than bandwidth
More informationERT Threat Alert New Risks Revealed by Mirai Botnet November 2, 2016
Abstract The Mirai botnet struck the security industry in three massive attacks that shook traditional DDoS protection paradigms, proving that the Internet of Things (IoT) threat is real and the grounds
More informationChapter 7. Denial of Service Attacks
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU),
More informationDDoS Testing with XM-2G. Step by Step Guide
DDoS Testing with XM-G Step by Step Guide DDoS DEFINED Distributed Denial of Service (DDoS) Multiple compromised systems usually infected with a Trojan are used to target a single system causing a Denial
More informationFiltering Trends Sorting Through FUD to get Sanity
Filtering Trends Sorting Through FUD to get Sanity NANOG48 Austin, Texas Merike Kaeo merike@doubleshotsecurity.com NANOG 48, February 2010 - Austin, Texas 1 Recent NANOG List Threads ISP Port Blocking
More informationNetwork Policy Enforcement
CHAPTER 6 Baseline network policy enforcement is primarily concerned with ensuring that traffic entering a network conforms to the network policy, including the IP address range and traffic types. Anomalous
More informationConfiguring attack detection and prevention 1
Contents Configuring attack detection and prevention 1 Overview 1 Attacks that the device can prevent 1 Single-packet attacks 1 Scanning attacks 2 Flood attacks 3 TCP fragment attack 4 Login DoS attack
More informationTOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS
TOP TEN DNS ATTACKS PROTECTING YOUR ORGANIZATION AGAINST TODAY S FAST-GROWING THREATS 1 Introduction Your data and infrastructure are at the heart of your business. Your employees, business partners, and
More informationFlashback.. Internet design goals. Security Part One: Attacks and Countermeasures. Why did they leave it out? Security Vulnerabilities
Flashback.. Internet design goals Security Part One: Attacks and Countermeasures 15-441 With slides from: Debabrata Dash,Nick Feamster, Vyas Sekar 15-411: F08 security 1 1. Interconnection 2. Failure resilience
More informationCloudflare Advanced DDoS Protection
Cloudflare Advanced DDoS Protection Denial-of-service (DoS) attacks are on the rise and have evolved into complex and overwhelming security challenges. 1 888 99 FLARE enterprise@cloudflare.com www.cloudflare.com
More informationSecurity Configuration Guide: Unicast Reverse Path Forwarding, Cisco IOS XE Fuji 16.7.x (NCS 4200 Series)
Security Configuration Guide: Unicast Reverse Path Forwarding, Cisco IOS XE Fuji 16.7.x (NCS 4200 Series) First Published: 2017-12-24 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San
More informationTHE "TRIBE FLOOD NETWORK 2000" DISTRIBUTED DENIAL OF SERVICE ATTACK TOOL
TFN2K - An Analysis Jason Barlow and Woody Thrower AXENT Security Team February 10, 2000 (Updated March 7, 2000) Revision: 1.3 Abstract This document is a technical analysis of the Tribe Flood Network
More informationPreventing Traffic with Spoofed Source IP Addresses in MikroTik
Preventing Traffic with Spoofed Source IP Addresses in MikroTik Presented by Md. Abdullah Al Naser Sr. Systems Specialist MetroNet Bangladesh Ltd Founder, mn-lab info@mn-lab.net The routing system of the
More informationDan Boneh, John Mitchell, Dawn Song. Denial of Service
Dan Boneh, John Mitchell, Dawn Song Denial of Service What is network DoS? Goal: take out a large site with little computing work How: Amplification Small number of packets big effect Two types of amplification
More informationNetwork Infrastructure Filtering at the border. stole slides from Fakrul Alam
Network Infrastructure Filtering at the border maz@iij.ad.jp stole slides from Fakrul Alam fakrul@bdhbu.com Acknowledgement Original slides prepared by Merike Kaeo What we have in network? Router Switch
More informationImproving DNS Security and Resiliency. Carlos Vicente Network Startup Resource Center
Improving DNS Security and Resiliency Carlos Vicente Network Startup Resource Center Threats to DNS Server crashes Server compromise Denial of service attacks Amplification attacks Cache poisoning Targeted
More informationDenial of Service and Distributed Denial of Service Attacks
Denial of Service and Distributed Denial of Service Attacks Objectives: 1. To understand denial of service and distributed denial of service. 2. To take a glance about DoS techniques. Distributed denial
More informationTable of Contents. 1 Intrusion Detection Statistics 1-1 Overview 1-1 Displaying Intrusion Detection Statistics 1-1
Table of Contents 1 Intrusion Detection Statistics 1-1 Overview 1-1 Displaying Intrusion Detection Statistics 1-1 i 1 Intrusion Detection Statistics Overview Intrusion detection is an important network
More informationSecurity Configuration Guide: Unicast Reverse Path Forwarding, Cisco IOS XE Everest (Cisco ASR 920)
Security Configuration Guide: Unicast Reverse Path Forwarding, Cisco IOS XE Everest 16.5.1 (Cisco ASR 920) First Published: 2017-05-06 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San
More informationRouting and router security in an operator environment
DD2495 p4 2011 Routing and router security in an operator environment Olof Hagsand KTH CSC 1 Router lab objectives A network operator (eg ISP) needs to secure itself, its customers and its neighbors from
More informationAnalysis. Group 5 Mohammad Ahmad Ryadh Almuaili
Analysis Group 5 Mohammad Ahmad Ryadh Almuaili Outline Introduction Previous Work Approaches Design & Implementation Results Conclusion References WHAT IS DDoS? DDoS: Distributed denial of service attack
More informationRemember Extension Headers?
IPv6 Security 1 Remember Extension Headers? IPv6 allows an optional Extension Header in between the IPv6 header and upper layer header Allows adding new features to IPv6 protocol without major re-engineering
More informationNetwork and Internet Vulnerabilities
Network and Internet Vulnerabilities Computer Security Lecture 10 Mike Just 1 School of Informatics University of Edinburgh 15th February 2010 1 Based on original lecture notes by David Aspinall Internet
More informationLife After IPv4 Depletion
1 Life After IPv4 Depletion Jon Worley Analyst Securing Core Internet Functions Resource Certification, RPKI Mark Kosters Chief Technology Officer 2 Core Internet Functions: Routing & DNS The Internet
More informationHP High-End Firewalls
HP High-End Firewalls Attack Protection Configuration Guide Part number: 5998-2650 Software version: F1000-A-EI&F1000-S-EI: R3721 F5000: F3210 F1000-E: F3171 Firewall module: F3171 Document version: 6PW101-20120719
More informationOur Narrow Focus Computer Networking Security Vulnerabilities. IP-level vulnerabilities
Our Narrow Focus 15-441 15-441 Computer Networking 15-641 Lecture 22 Security: DOS Peter Steenkiste Fall 2014 www.cs.cmu.edu/~prs/15-441-f14 Yes: Creating a secure channel for communication (Part I) Protecting
More informationCSE Computer Security (Fall 2006)
CSE 543 - Computer Security (Fall 2006) Lecture 18 - Network Security November 7, 2006 URL: http://www.cse.psu.edu/~tjaeger/cse543-f06/ 1 Denial of Service Intentional prevention of access to valued resource
More informationCollective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Phil Roberts roberts@isoc.org Andrei Robachevsky www.internetsociety.org Let us look at the problem
More informationConfiguring Unicast Reverse Path Forwarding
Configuring Unicast Reverse Path Forwarding This chapter describes the Unicast Reverse Path Forwarding (Unicast RPF) feature. The Unicast RPF feature helps to mitigate problems that are caused by malformed
More informationDenial Of Service Attacks
FISTConference October 2004 Denial Of Service Attacks Gabriel Verdejo Alvarez (gaby@tau.uab.es) Barcelona INDEX Speaker s introduction. Denial Of Service attacks (DOS). Examples. Distributed Denial of
More informationAttack Prevention Technology White Paper
Attack Prevention Technology White Paper Keywords: Attack prevention, denial of service Abstract: This document introduces the common network attacks and the corresponding prevention measures, and describes
More informationContents. Denial-of-Service Attacks. Flooding Attacks. Distributed Denial-of Service Attacks. Reflector Against Denial-of-Service Attacks
Contents Denial-of-Service Attacks Flooding Attacks Distributed Denial-of Service Attacks Reflector Against Denial-of-Service Attacks Responding to a Denial-of-Service Attacks 2 Denial-of-Service Attacks
More informationCollective responsibility for security and resilience of the global routing system
Collective responsibility for security and resilience of the global routing system Andrei Robachevsky www.internetsociety.org Let us look at the problem first BGP is based on trust
More information(DNS, and DNSSEC and DDOS) Geoff Huston APNIC
D* (DNS, and DNSSEC and DDOS) Geoff Huston APNIC How to be bad 2 How to be bad Host and application-based exploits abound And are not going away anytime soon! And there are attacks on the Internet infrastructure
More informationUDP-based Amplification Attacks and its Mitigations
UDP-based Amplification Attacks and its Mitigations Yoshiaki Kasahara kasahara@nc.kyushu-u.ac.jp 1/21/2014 APAN 37th in Bandung, Indonesia 1 Summary If you have servers with global IP addresses 1. Make
More informationCSE Computer Security
CSE 543 - Computer Security Lecture 22 - Denial of Service November 15, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Denial of Service Intentional prevention of access to valued resource CPU,
More informationThe Spoofer Project Inferring the Extent of Source Address Filtering on the Internet
The Spoofer Project Inferring the Extent of Source Address Filtering on the Internet Rob Beverly and Steve Bauer {rbeverly,bauer}@mit.edu The Spoofer Project Goal: Quantify the extent and nature of source
More informationSecuring Core Internet Functions Resource Certification, RPKI. Mark Kosters ARIN CTO
Securing Core Internet Functions Resource Certification, RPKI Mark Kosters ARIN CTO Core Internet Functions: Routing & DNS The Internet relies on two critical resources DNS: Translates domain names to
More informationSecurity by BGP 101 Building distributed, BGP-based security system
Security by BGP 101 Building distributed, BGP-based security system Łukasz Bromirski lukasz@bromirski.net May 2017, CERT EE meeting Roadmap for the session BGP as security mechanism BGP blackholing project
More informationOn the State of the Inter-domain and Intra-domain Routing Security
On the State of the Inter-domain and Intra-domain Routing Security Mingwei Zhang April 19, 2016 Mingwei Zhang Internet Routing Security 1 / 54 Section Internet Routing Security Background Internet Routing
More informationAre You Fully Prepared to Withstand DNS Attacks?
WHITE PAPER Are You Fully Prepared to Withstand DNS Attacks? Fortifying Mission-Critical DNS Infrastructure Are You Fully Prepared to Withstand DNS Attacks? Fortifying Mission-Critical DNS Infrastructure
More informationDDoS Protection in Backbone Networks
DDoS Protection in Backbone Networks The Czech Way Pavel Minarik, Chief Technology Officer Holland Strikes Back, 3 rd Oct 2017 Backbone DDoS protection Backbone protection is specific High number of up-links,
More informationAn Operational Perspective on BGP Security. Geoff Huston February 2005
An Operational Perspective on BGP Security Geoff Huston February 2005 Disclaimer This is not a description of the approach taken by any particular service provider in securing their network. It is intended
More informationIPv6. Copyright 2017 NTT corp. All Rights Reserved. 1
IPv6 IPv6 NTT IPv6 Copyright 2017 NTT corp. All Rights Reserved. 1 IPv6 IPv4 IPv6 Copyright 2017 NTT corp. All Rights Reserved. 2 IPv4 http://www.potaroo.net/tools/ipv4/ 2018.3.5 Copyright 2017 NTT corp.
More informationOFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES. Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner
OFF-PATH ATTACKS AGAINST PUBLIC KEY INFRASTRUCTURES Markus Brandt, Tianxiang Dai, Elias Heftrig, Amit Klein, Haya Shulman, Michael Waidner 1 AGENDA Objectives Attacking Impact Mitigation Summary 2 AGENDA
More informationCS Paul Krzyzanowski
The Internet Packet switching: store-and-forward routing across multiple physical networks... across multiple organizations Computer Security 11. Network Security ISP Paul Krzyzanowski Rutgers University
More informationThe information in this document is based on Cisco IOS Software Release 15.4 version.
Contents Introduction Prerequisites Requirements Components Used Background Information Configure Network Diagram Relevant Configuration Verify Test case 1 Test case 2 Test case 3 Troubleshoot Introduction
More informationHP High-End Firewalls
HP High-End Firewalls Attack Protection Configuration Guide Part number: 5998-2630 Software version: F1000-E/Firewall module: R3166 F5000-A5: R3206 Document version: 6PW101-20120706 Legal and notice information
More informationNetwork Infrastructure Security
Network Infrastructure Security Workshop February 18-20, 2005 Merike Kaeo merike@doubleshotsecurity.com Agenda (Day 1) Threat Models What Are We Protecting Against? Securing The Device Physical and Logical
More informationDNS Security. Ch 1: The Importance of DNS Security. Updated
DNS Security Ch 1: The Importance of DNS Security Updated 8-21-17 DNS is Essential Without DNS, no one can use domain names like ccsf.edu Almost every Internet communication begins with a DNS resolution
More informationDDoS Defense Mechanisms for IXP Infrastructures
DDoS Defense Mechanisms for IXP Infrastructures Tim Dijkhuizen Lennart van Gijtenbeek Supervisor: Stavros Konstantaras (AMS-IX) SNE: Research Project II 03-07-2018 Introduction Distributed Denial of Service
More informationAnatomy and Mechanism of DOS attack
Anatomy and Mechanism of DOS attack Ms. Neha. D. Mistri. Research Scholar, Karpagam University, Coimbatore Assistant Professor, S.V. Institute. Of Computer Studies, Kadi - 382 715. Gujarat - India nehamistry27@rediffmail.com
More informationA Survey of BGP Security Review
A Survey of BGP Security Review Network Security Instructor:Dr. Shishir Nagaraja Submitted By: Jyoti Leeka November 16, 2011 1 Introduction to the topic and the reason for the topic being interesting Border
More informationELEC5616 COMPUTER & NETWORK SECURITY
ELEC5616 COMPUTER & NETWORK SECURITY Lecture 17: Network Protocols I IP The Internet Protocol (IP) is a stateless protocol that is used to send packets from one machine to another using 32- bit addresses
More informationComputer Security. 11. Network Security. Paul Krzyzanowski. Rutgers University. Spring 2018
Computer Security 11. Network Security Paul Krzyzanowski Rutgers University Spring 2018 April 15, 2018 CS 419 2018 Paul Krzyzanowski 1 The Internet Packet switching: store-and-forward routing across multiple
More informationINTRODUCTION ON D-DOS. Presentation by RAJKUMAR PATOLIYA
INTRODUCTION ON D-DOS Presentation by RAJKUMAR PATOLIYA What is d-dos??? The full form of the D-DOS is Distributed Denial of Service. The attacks are carried out by flooding site traffic at appoint in
More informationAnti-DDoS. FAQs. Issue 11 Date HUAWEI TECHNOLOGIES CO., LTD.
Issue 11 Date 2018-05-28 HUAWEI TECHNOLOGIES CO., LTD. Copyright Huawei Technologies Co., Ltd. 2019. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any
More informationCE Advanced Network Security Botnets
CE 817 - Advanced Network Security Botnets Lecture 11 Mehdi Kharrazi Department of Computer Engineering Sharif University of Technology Acknowledgments: Some of the slides are fully or partially obtained
More informationGuide to DDoS Attacks November 2017
This Multi-State Information Sharing and Analysis Center (MS-ISAC) document is a guide to aid partners in their remediation efforts of Distributed Denial of Service (DDoS) attacks. This guide is not inclusive
More informationData Sheet. DPtech Anti-DDoS Series. Overview. Series
Data Sheet DPtech Anti-DDoS Series DPtech Anti-DDoS Series Overview DoS (Denial of Service) leverage various service requests to exhaust victims system resources, causing the victim to deny service to
More informationNetwork Security. Chapter 0. Attacks and Attack Detection
Network Security Chapter 0 Attacks and Attack Detection 1 Attacks and Attack Detection Have you ever been attacked (in the IT security sense)? What kind of attacks do you know? 2 What can happen? Part
More informationConfiguring Unicast RPF
20 CHAPTER This chapter describes how to configure Unicast Reverse Path Forwarding (Unicast RPF) on NX-OS devices. This chapter includes the following sections: Information About Unicast RPF, page 20-1
More informationCSC 4900 Computer Networks: Routing Protocols
CSC 4900 Computer Networks: Routing Protocols Professor Henry Carter Fall 2017 Last Time Link State (LS) versus Distance Vector (DV) algorithms: What are some of the differences? What is an AS? Why do
More informationOpenFlow DDoS Mitigation
OpenFlow DDoS Mitigation C. Dillon, M. Berkelaar February 9, 2014 University of Amsterdam Quanza Engineering Introduction Distributed Denial of Service attacks Types of attacks Application layer attacks
More informationEnhanced Feasible-Path Unicast Reverse Path Filtering draft-sriram-opsec-urpf-improvements-01
Enhanced Feasible-Path Unicast Reverse Path Filtering draft-sriram-opsec-urpf-improvements-01 K. Sriram and D. Montgomery OPSEC Working Group Meeting, IETF-99 July 2017 Acknowledgements: The authors are
More informationCS 134 Winter 2018 Lecture 16. Network Threats & Attacks
CS 134 Winter 2018 Lecture 16 Network Threats & Attacks 1 Internet Structure backbone ISP local network local network Internet service provider (ISP) Autonomous system (AS) is a collection of IP networks
More informationDistributed Systems. 29. Firewalls. Paul Krzyzanowski. Rutgers University. Fall 2015
Distributed Systems 29. Firewalls Paul Krzyzanowski Rutgers University Fall 2015 2013-2015 Paul Krzyzanowski 1 Network Security Goals Confidentiality: sensitive data & systems not accessible Integrity:
More informationVERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT
VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT VOLUME 4, ISSUE 4 4TH QUARTER 2017 Complimentary report supplied by CONTENTS EXECUTIVE SUMMARY 3 VERISIGN-OBSERVED DDoS ATTACK TRENDS: Q4 2017 4 DDoS
More informationEXPERIMENTAL STUDY OF FLOOD TYPE DISTRIBUTED DENIAL-OF- SERVICE ATTACK IN SOFTWARE DEFINED NETWORKING (SDN) BASED ON FLOW BEHAVIORS
EXPERIMENTAL STUDY OF FLOOD TYPE DISTRIBUTED DENIAL-OF- SERVICE ATTACK IN SOFTWARE DEFINED NETWORKING (SDN) BASED ON FLOW BEHAVIORS Andry Putra Fajar and Tito Waluyo Purboyo Faculty of Electrical Engineering,
More informationSecuring network infrastructure
Securing network infrastructure Matsuzaki maz Yoshinobu maz@iij.ad.jp 1 Our Goals Ensuring Network Availability Controlling Routing Policy Protecting Information Preventing Misuse Mitigating
More informationPhase 4 Traceback the Attack. 2002, Cisco Systems, Inc. All rights reserved.
Phase 4 Traceback the Attack 1 Six Phases to ISP Security Incident Response Preparation Identification Classification Traceback Reaction Post Mortem 2 Traceback Attacks to their Source Valid IPv4 Source
More informationLecture 10. Denial of Service Attacks (cont d) Thursday 24/12/2015
Lecture 10 Denial of Service Attacks (cont d) Thursday 24/12/2015 Agenda DoS Attacks (cont d) TCP DoS attacks DNS DoS attacks DoS via route hijacking DoS at higher layers Mobile Platform Security Models
More informationVERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT
VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT VOLUME 3, ISSUE 3 3RD QUARTER 2016 Complimentary report supplied by CONTENTS EXECUTIVE SUMMARY 3 VERISIGN-OBSERVED DDoS ATTACK TRENDS: Q3 2016 4 DDoS
More informationDenial of Service (DoS)
Flood Denial of Service (DoS) Comp Sci 3600 Security Outline Flood 1 2 3 4 5 Flood 6 7 8 Denial-of-Service (DoS) Attack Flood The NIST Computer Security Incident Handling Guide defines a DoS attack as:
More information