97 lines
2.3 KiB
Markdown
97 lines
2.3 KiB
Markdown
# DDOS attacks
|
|
|
|
# History
|
|
|
|
- Operation Chanology 2008
|
|
- Operation Avenge Assange 2010
|
|
- LOIC
|
|
- Mirai botnet 2017
|
|
|
|
# Distributed vs not distributed
|
|
|
|
- vulnerability or bandwidth
|
|
- size of target
|
|
- masses against the powerful
|
|
|
|
# Reverse proxies
|
|
|
|
- hidding behind Cloudflare
|
|
- MX records
|
|
- masscan with a Host header
|
|
- finding the hosting provider
|
|
|
|
# Amplification
|
|
|
|
- open relays
|
|
- nameservers with a big response (AXFR)
|
|
- method of hidding from the target
|
|
- spoofing IP needed, also ends up hiding from the relay
|
|
- ISPs in Serbia droping them or rewriting them (CGNAT?)
|
|
- don't be stupid
|
|
|
|
# Amplification
|
|
|
|
|
|
# SYN Flood
|
|
|
|
|
|
|
|
# SYN Flood
|
|
|
|
- spoofing doesn't break the attack
|
|
- defense can be configured, but it decreases relibility
|
|
|
|
# Other transmission layer attacks
|
|
|
|
- slow read, small TCP receive window
|
|
- TTL expiry, takes more CPU to drop then to forward
|
|
|
|
# HTTP/app based
|
|
|
|
- GET of large assests, URI takes relatively a lot of CPU work
|
|
- slow POST
|
|
- maybe search functions, database intensive work (regex?)
|
|
- Slowloris
|
|
- HTTP pipelining, order of requests, have to keep in memory
|
|
|
|
# SSL/TLS
|
|
|
|
- renegotiation
|
|
- flood
|
|
|
|
# Vulnerability
|
|
|
|
- all bugs in software are usually a DoS vulnerability
|
|
- most common type of CVE by far
|
|
- any layer bug will break the service, finding the weakest link
|
|
|
|
# Network recon
|
|
|
|
- sometimes the weakest link is router
|
|
- reverse proxy
|
|
- DNS server? (ignoring the TTL)
|
|
- anything used before connecting to server
|
|
|
|
# Guerrilla warfare tactics
|
|
|
|
- making sure the target uses more resources then the attacker
|
|
- getting broad support from the masses
|
|
- spoofing and being hard to find
|
|
- long term fight. losing battles, but winning the war
|
|
|
|
# Government DoS attacks
|
|
|
|
- Autistici/Inventati shutdown, censorship with excuse of terrorism
|
|
- Financial derisking isolation, sanctions with excuse of derisking
|
|
- State sponsored flood attacks
|
|
- Arrests, attacking the person behind the service, TPB, Wikileaks
|
|
|
|
# Conclusion
|
|
|
|
- don't be afraid, but be careful
|
|
- protest menatality, don't give up, don't let them rest
|
|
- long term results, can't win in a day
|
|
- organize, A/I call for a network called Resistance
|
|
- don't pretend politics have nothing to do with it
|
|
- fight your enemy, not theirs, public support
|