# DDOS attacks

# History

- Operation Chanology 2008
- Operation Avenge Assange 2010
- LOIC
- Mirai botnet 2017

# Distributed vs not distributed

- vulnerability or bandwidth
- size of target
- masses against the powerful

# Reverse proxies

- hidding behind Cloudflare
- MX records
- masscan with a Host header
- finding the hosting provider

# Amplification

- open relays
- nameservers with a big response (AXFR)
- method of hidding from the target
- spoofing IP needed, also ends up hiding from the relay 
- ISPs in Serbia droping them or rewriting them (CGNAT?)
- don't be stupid

# Amplification
![Amplification by protocol](slides/ddos/amp.png)

# SYN Flood

![3-way handshake](slides/ddos/tcp.jpg)

# SYN Flood

- spoofing doesn't break the attack
- defense can be configured, but it decreases relibility

# Other transmission layer attacks

- slow read, small TCP receive window
- TTL expiry, takes more CPU to drop then to forward

# HTTP/app based

- GET of large assests, URI takes relatively a lot of CPU work
- slow POST
- maybe search functions, database intensive work (regex?)
- Slowloris
- HTTP pipelining, order of requests, have to keep in memory

# SSL/TLS

- renegotiation
- flood

# Vulnerability

- all bugs in software are usually a DoS vulnerability
- most common type of CVE by far
- any layer bug will break the service, finding the weakest link

# Network recon

- sometimes the weakest link is router
- reverse proxy
- DNS server? (ignoring the TTL)
- anything used before connecting to server

# Guerrilla warfare tactics

- making sure the target uses more resources then the attacker
- getting broad support from the masses
- spoofing and being hard to find
- long term fight. losing battles, but winning the war

# Government DoS attacks

- Autistici/Inventati shutdown, censorship with excuse of terrorism
- Financial derisking isolation, sanctions with excuse of derisking
- State sponsored flood attacks
- Arrests, attacking the person behind the service, TPB, Wikileaks

# Conclusion

- don't be afraid, but be careful
- protest menatality, don't give up, don't let them rest
- long term results, can't win in a day
- organize, A/I call for a network called Resistance
- don't pretend politics have nothing to do with it
- fight your enemy, not theirs, public support