Slide title

In CAPITALS

50 pt

Slide subtitle

32 pt

Elliot Wallace

August 24, 2020

DOS AND DDOS

Lecture 13a

COMPSCI 726

Network Defence and Countermeasures

Source of some slides: CMU, Stanford University, and University of Twente

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

2

CYBER KILL CHAIN

Source: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

3

PORT SCANNING

▪ Reconnaissance

▪ Scans refer to information gathering

– Find vulnerable services/hosts

– Discover network topology (used IP addresses)

▪ Can be combined with a “real” attack

– E.g., a buffer overflow (ping of death)

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

4

SCAN TYPES

1

256

512

768

1024

1280

http

smtp

ftp

smb

imaps

kazaa

1.1.1.1 130.89.1.1 130.89.1.255 130.89.2.1

Horizontal scan

Vertical scan

Block scan

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

5

SCAN TYPES

▪ Most common uses – valuable for both attackers and

defenders

– Vulnerability scan (e.g. Nessus, Qualys)

– Discovery (e.g. nmap)

▪ IP range, applications, etc

▪ Attacker goals:

– Enumerate a network – entry point, next hop, etc

– Enumerate software on a system – identify vulnerabilities

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

6

SCAN TYPES

▪ Nmap cheat sheet

– nmap -sV -O -p- $TARGET_IP

– Scan all ports (-p-) on $TARGET_IP and detect the running

services (-sV) and operating system (-O)

▪ As a defender, we want to know what our attackers will

be doing

– It’s worth running these against your home network or local

machine to understand the output

– Look up some of the results in exploitdb - is your device

vulnerable to anything at the moment?

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

7

SCAN TYPES

▪ Common tools

– nmap

– wfuzz – Web application bruteforcer/fuzzer

– dirbuster/dirb/gobuster – web directory scanner (i.e. find all

directories under https://cs.auckland.ac.nz/)

– sqlmap – automated SQL injection tool/fuzzer

– Others: hydra, Wpscan, Nikto, etc etc

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

8

DENIAL OF SERVICE (DOS) ATTACK

▪ Old attack – consistent use in recent history

▪ First recorded DoS attack – 1996 (SYN Flood against

an ISP)

▪ June 2020 – AWS hit by 2.3Tbps DDoS

Source: https://www.bbc.com/news/technology-53093611

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

9

DENIAL OF SERVICE (DOS) ATTACK

▪ Aim: downgrade availability for a service (take it offline)

▪ Types

– Brute-forcing

▪ Send a lot of data (overload network), multiple queries

(overload CPU), ...

– Semantic

▪ Exploit vulnerability (buffer overflow, …)

▪ Send heavy requests (triggering complex operations)

▪ DoS can be applicable to any layer in the OSI model!

▪ Distributed DoS (DDoS)

– Attack from multiple sources (e.g. a botnet)

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

10

SMURF ATTACK

▪ Spoofed IP packets containing ICMP echo request

– Source: Victim’s IP

– Destination: Broadcast address

▪ Results in triggering all hosts included in the network to

respond with ICMP response packets

▪ Saturates the network with bogus traffic and delays

▪ Prevents legitimate traffic from reaching its destination

▪ An example of reflected attack

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

11

SMURF ATTACK

Attacking System

Internet

Broadcast

Enabled

Network

Victim System

Ping request to a

broadcast address

with source = victim's

IP address

Ping request to

broadcast address

with source = victim's

IP address

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

12

SMURF ATTACK

Attacking System

Internet

Broadcast

Enabled

Network

Victim System

Ping request to a

broadcast address

with source = victim's

IP address

Ping request to

broadcast address

with source = victim's

IP address

Ping reply from

every host

Replies directed

to victim

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

13

SMURF ATTACK

▪ Mitigations

– Don’t respond to ICMP requests

– Don’t forward packets to broadcast addresses

▪ Difficult to avoid being a target (similar mitigations to

DNS reflection)

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

14

PING FLOOD ATTACK

▪ Ping of death

▪ Over-sized packets to crash (or reboot) the system

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

15

PING FLOOD ATTACK

▪ Generally requires the attacker to have greater

bandwidth than target

▪ Target saturates bandwidth in two ways – receiving

requests and sending responses

▪ Mitigations

– Disable response to ICMP requests (either OS/network

level)

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

16

REVIEW: TCP HANDSHAKE

C S

SYN:

SYN/ACK:

ACK:

Listening

Store SNC , SNS

Wait

Established

SNCrandC

ANC0

SNSrandS

ANSSNC

SNSNC

ANSNS

▪ Client sends SYN, Server sends ACK and waits

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

17

REVIEW: TCP HANDSHAKE

▪ At an implementation level, a new port is allocated per

connection received

▪ The application typically establishes a new thread per

connection

▪ These resources typically remain assigned (both port

and thread) until the session ends

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

18

TCP SYN FLOOD

▪ Attacker sends many connection requests with spoofed

source addresses

▪ Victim allocates resources for each request

– New thread, connection state maintained until timeout

– Limited number of concurrent half-open connections

▪ Once resources exhausted, requests from legitimate

clients are denied

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

19

TCP SYN FLOOD

C

SYNC1

SYNC2

SYNC3

SYNC4

SYNC5

S Single machine:

• SYN packets withRandom source IPaddresses

• Fills up backlog queueon server

• No further connectionspossible

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

20

TCP SYN FLOOD

Backlog timeout: 3 minutes

Attacker needs only to send 128 SYN packets every 3 minutes

Low rate SYN flood

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

21

DDOS ATTACK

▪ Attacker takes over machines

via viruses and launches DoS

attacks from these “zombies”

or “bots”

▪ Larger botnets can have million of bots

▪ Sustainability of botnets

– Many owners are unaware that their machine is a zombie

– Owners are not motivated to patch their machines to

protect against malware in the absence of perceived harm

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

22

APPLICATION-TARGETING DOS

▪ A little out of scope for this course but worth

remembering!

▪ DDoS doesn’t have to target network comms

▪ DDoS also doesn’t have to be malicious ☺

▪ Examples:

– I get access to a Linux machine. I run a Python script that

reads junk into memory and writes junk to fill the disks

– I create an app for remote ordering coffee during lockdown

▪ 100000s of users on day 1

▪ App servers get overwhelmed

▪ Sad users

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

23

AS AN ATTACKER, WHY?

▪ Disrupt service, hacktivism/damage, and often a

smokescreen

▪ Practical example – you’re the CISO of a large bank

▪ Your web banking service (significant money maker)

gets DDoS’d

– You pivot your resources (time, money, people) to restoring

web banking

– Meanwhile, alerts for data exfiltration or weird login patterns

for monitored accounts

– What’s the priority?

▪ Web banking

▪ Attackers exfil data/hop through the network

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

24

TO BE CONTINUED

▪ See the next lecture

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

25

ACKNOWLEDGEMENT

▪ Most of these slides are from Rizwan Asghar,

thanks to him!

Top right

corner for

field

customer or

partner logotypes.

See Best practice

for example.

Slide title

40 pt

Slide subtitle

24 pt

Text

24 pt

5

20 pt

26

Questions?

Thanks for your attention!