2.3 KiB
2.3 KiB
DDOS attacks
History
- Operation Chanology 2008
- Operation Avenge Assange 2010
- LOIC
- Mirai botnet 2017
Distributed vs not distributed
- vulnerability or bandwidth
- size of target
- masses against the powerful
Reverse proxies
- hidding behind Cloudflare
- MX records
- masscan with a Host header
- finding the hosting provider
Amplification
- open relays
- nameservers with a big response (AXFR)
- method of hidding from the target
- spoofing IP needed, also ends up hiding from the relay
- ISPs in Serbia droping them or rewriting them (CGNAT?)
- don't be stupid
Amplification
SYN Flood
SYN Flood
- spoofing doesn't break the attack
- defense can be configured, but it decreases relibility
Other transmission layer attacks
- slow read, small TCP receive window
- TTL expiry, takes more CPU to drop then to forward
HTTP/app based
- GET of large assests, URI takes relatively a lot of CPU work
- slow POST
- maybe search functions, database intensive work (regex?)
- Slowloris
- HTTP pipelining, order of requests, have to keep in memory
SSL/TLS
- renegotiation
- flood
Vulnerability
- all bugs in software are usually a DoS vulnerability
- most common type of CVE by far
- any layer bug will break the service, finding the weakest link
Network recon
- sometimes the weakest link is router
- reverse proxy
- DNS server? (ignoring the TTL)
- anything used before connecting to server
Guerrilla warfare tactics
- making sure the target uses more resources then the attacker
- getting broad support from the masses
- spoofing and being hard to find
- long term fight. losing battles, but winning the war
Government DoS attacks
- Autistici/Inventati shutdown, censorship with excuse of terrorism
- Financial derisking isolation, sanctions with excuse of derisking
- State sponsored flood attacks
- Arrests, attacking the person behind the service, TPB, Wikileaks
Conclusion
- don't be afraid, but be careful
- protest menatality, don't give up, don't let them rest
- long term results, can't win in a day
- organize, A/I call for a network called Resistance
- don't pretend politics have nothing to do with it
- fight your enemy, not theirs, public support