e-maknyus: ddos mitigation

Showing posts with label ddos mitigation. Show all posts

Wednesday, September 7, 2011

Stop Denial of Service attacks

Taking advantage of a known problem with the Operating System or any running services on the target, a good programmer can build an application that sends some data that causes the targeted system to crash.

The worst case scenario is not when a hacker crashes a service, but when it finds a way to maximize the CPU usage causing a total malfunction on the system.

Of course most of the attacks are not initiated by these kind of programmers, but by "script kiddies" who only read about it, find the program's source over the web and just use it without knowing the mechanisms it uses.

(D)DoS Deflate

(D)DoS Deflate is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It utilizes the command below to create a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level.

netstat -ntu | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n

IP addresses with over a pre-configured number of connections are automatically blocked in the server's firewall, which can be direct iptables or Advanced Policy Firewall (APF). (We highly recommend that you use APF on your server in general, but deflate will work without it.)

DDOS FAQ

What is Distributed Denial of Service (DDOS) and How To Protect Your Site

A denial of service against a web site is launched by overwhelming the site and related services (such as DNS) with tsunami requests from multiple infected computers - "a botnet" under the control of the attacker. With 1000s of infected computers in a botnet connected via high speed DSL / cable modem from all over the world, a serious denial of service attack can scale to multiple gigabits per second of traffic.

The Top 10 Things To Do While Under DDoS Attack

In my past decade-plus dealing with distributed denial-of-service attacks, I have noticed a few patterns in the way that companies handle these attacks. Usually when an unprepared virgin company is first attacked, all hell breaks loose. The lack of preparedness causes several chain reactions that make the situation worse. Addressing these most common mistakes ahead of time can help a situation tremendously.
When someone calls me for advice, the first few items I go over have nothing to do with fixing the attack. I’m giving advice that I think is common sense, and I’ve been surprised that others don’t find it obvious.
Here are my Top 10 To-do’s for making life less painful during an attack.

Using Squid Proxy to Fight DDoS

Complicated web applications are often difficult to scale, as a result they become easy DDoS targets. However, making them scale is easy with front-end proxy servers. The added scale gives an application more resiliency to DDoS attacks.

When setup correctly, the proxy “network” becomes the target of any malicious activity and can be placed globally while still keeping the original web application in same location for content.

This is by no means new, it’s been done all over the Internet and in some cases is the base of a bunch of different companies. This is just a simple tutorial that is meant to help people understand how this works.

ddos mitigation video

Zombie Recruitment: How Attackers Find, Exploit, and Employ You

A crucial element of a DDoS attack is the ability to employ hundreds, thousands, or even millions of infected hosts to do the attacker’s bidding. The reasons are obvious – the end target(s) of the attack will find it more difficult to fend off the malicious traffic, and the attack is less likely to be traced back to the actual perpetrator. These “zombie” hosts are rarely related to the source host of the attack, and are rather infected by other compromised hosts – but can end up causing more damage than the machine that originated the attack in the first place. So you may be wondering – where do zombies come from?

Captcha Based Protection against HTTP GET DDos Attacks

especially HTTP GET attacks can be crippling to a web server. These attacks can come in two varieties, large amounts of requests per second, or small amounts of requests per second from any given IP, so that it becomes difficult to distinguish between a legitimate request and one that is powered by a botnet.

Barret Lyon on DDoS and how to use Squid to Stop it.

In the world of Information Security, especially DDoS, Barrett Lyon is no stranger. Barrett was one of the co-founders of Prolexic (a company that specializes in DDoS Protection). Barrett recently launched a new venture, called 3Crowd.

What intrigued me – is how I could possibly overlook a post by Barrett on his blog regarding DDoS. Albeit, he writes a lot of stuff concerning security, this mini-tutorial is worth looking into.

Using Squid proxy to Fight DDoS
and also this article “The Top 10 Things to Do While Under DDoS“

The latter is okay, but the Squid Proxy tutorial is something worthy for newbies to look into. How a Squid Proxy can really deflate a lot of the attack traffic, not to mention that most providers such as Prolexic, Gigenet, Staminus, etc. use SNORT and FreeBSD based boxes running PF (Packet Filter). A FreeBSD Box running PF can scale quite well and is very good an thwarting traffic. A lot of new small service providers are propping up – using a distributed FBSD setup, they are able to break up the incoming traffic and filter it – to quite a significant extent, and then parsing the traffic onto a secure (read: optimized for Anti-DDoS efforts) squid box and it deflate the incoming DDoS attack to a very large extent.

However, as with everything else in life, no one will provide you with the complete recipe that works for DDoS protection.

Understanding Setup Rates on your DDoS Mitigation Appliance

Within the DDoS appliance space, those appliances that do DPI or session handling, it is very important to understand how the setup rates comes into play.

Each appliance, be it DPI or Sessions based Proxy appliance or just plain Layer 2/3 Filtering devices, these devices have to look at traffic at very high speeds.

Each appliance has what it called a “connection setup rate” typically quoted in X many connections/second.

e-maknyus