countering syn flood denial of service dos attacks
play

Countering SYN Flood Denial-of-Service (DoS) Attacks Ross Oliver - PowerPoint PPT Presentation

Sep 22, 2022 •202 likes •493 views

Countering SYN Flood Denial-of-Service (DoS) Attacks Ross Oliver Tech Mavens reo@tech-mavens.com What is a Denial-of- Service (DoS) attack? ! Attacker generates unusually large volume of requests, overwhelming your servers ! Legitimate

  1. Countering SYN Flood Denial-of-Service (DoS) Attacks Ross Oliver Tech Mavens reo@tech-mavens.com

  2. What is a Denial-of- Service (DoS) attack? ! Attacker generates unusually large volume of requests, overwhelming your servers ! Legitimate users are denied access ! Can last from a few minutes to several days 2

  3. What is a SYN Flood? ! One kind of Denial-of-Service attack ! Simulates initial handshake of TCP/IP connection ! Web servers are particularly vulnerable 3

  4. Example SYN Flood Attack ! February 5 th – 11 th , 2000 ! Victims included CNN, eBay, Yahoo, Amazon ! Attacks allegedly perpetrated by teenagers ! Used compromised systems at UCSB 4

  5. Detailed Account of DDoS ! Gibson Research Corporation www.grc.com/dos/intro.htm ! May 4 th -20th, 2001 ! DDoS attack from 474 machines ! Completely saturated two T1s ! 13-year-old claimed responsibility 5

  6. Don’t Expect Outside Help ! GRC discovered: ! ISPs were unresponsive ! Law enforcement unable to help ! Under-age perpetrators have blanket immunity 6

  7. Normal TCP/IP Connection Initiation SYN SYN / ACK ACK Web surfer Web sever 7

  8. Unfinished TCP/IP Connection Initiation SYN SYN / ACK ??? Web surfer Web sever 8

  9. Web Server’s Table of Normal TCP/IP Connections Address Port State 192.168.3.16 80 ESTABLISHED 192.168.15.88 80 TIME_WAIT 192.168.3.94 80 ESTABILISHED 192.168.54.7 80 SYN 192.168.27.112 80 ESTABLISHED 192.168.4.23 80 TIME_WAIT 0.0.0.0 0 FREE 0.0.0.0 0 FREE 0.0.0.0 0 FREE 9

  10. Connections Table During SYN Flood Address Port State 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 192.168.7.99 80 SYN 10

  11. Why Defense is Difficult ! SYN packets are part of normal traffic ! Source IP addresses can be faked ! SYN packets are small ! Lengthy timeout period 11

  12. Possible Defenses ! Increase size of connections table ! Add more servers ! Trace attack back to source ! Deploy firewalls employing SYN flood defense 12

  13. Who Offers a Defense? ! PIX by Cisco ! Firewall-1 by Checkpoint ! Netscreen 100 by Netscreen ! AppSafe/AppSwitch by Top Layer 13

  14. Firewall-1 SYNDefender SYN SYN SYN / ACK ACK Web surfer FW-1 Web sever 14

  15. SYN Proxy SYN SYN / ACK ACK Web surfer Netscreen or Web sever AppSafe 15

  16. Measuring Effectiveness ! Create a realistic test environment ! Generate a SYN flood ! Measure how well each firewall keeps legitimate traffic flowing 16

  17. Test Configuration Attacker Test Firewall Hub Web Server Web Client 17

  18. Test Configuration ! Web Server: Linux (RedHat 7.2) " Apache web server ! Web Client: Windows 2000 " Script using wget to fetch web pages, measure response time ! Attacker: Linux (RedHat 7.2) " SYN flood generator 18

  19. Benchmark Results None 100 PI X 100 Firewall-1 500 Netscreen 14,000 AppSafe 22,000 1 10 100 1,000 10,000 100,000 Maximum SYNs per second 19

  20. Cisco PIX Results ! No significant difference over no firewall ! Large “embrionic” value allowed flood through to server ! Small “embrionic” value blocked both flood and normal traffic 20

  21. Firewall-1 Results ! Protected up to 500 SYNs/sec, but with degraded response time ! Above 500 SYNs/sec, web page requests failed ! Web server recovered to normal 3-10 minutes after attack ceased 21

  22. Netscreen 100 Results ! Protected up to 14,000 SYNs/sec with acceptable server response times ! Above 14,000, web server continued to respond, with increasing delays ! Response times recovered to normal immediately after attack ceased 22

  23. AppSafe Results ! Effective up to 22,000 SYNs/sec ! Maximum test setup could produce ! No measurable change in response time 23

  24. How Bad Can It Get? ! Theoretical maximums for attackers using: " Analog modem: 87 SYNs/sec " ISDN, Cable, DSL: 200 SYNs/sec " T1: 2,343 SYNs/sec " 474 hacked systems 94,800 SYNs/sec 24

  25. How Much Do You Need? ! Single firewall for attacker with single ISDN, DSL, or T1 ! Multiple parallel units for higher bandwidth ! “Transparent” mode permits rapid deployment 25

  26. Conclusion ! SYN floods are nasty ! Firewalls with SYN flood defense can successfully counter attacks ! Multiple or distributed attacks may require multiple parallel firewalls 26

  27. Acknowledgements ! PIX provided by Atebion, Inc. ! Netscreen 100 provided by Yipes Communications ! AppSafe provided by Top Layer Networks ! Information Warehouse! Inc. 27

Recommend

Denial of Service attacks Markus Peuhkuri 2005-04-12 Lecture topics Types of denial of service

Denial of Service attacks Markus Peuhkuri 2005-04-12 Lecture topics Types of denial of service

Denial of Service attacks Markus Peuhkuri 2005-04-12 Lecture topics Types of denial of service How to mitigate attacks How to find out senders What is Denial of Service

542 views • 8 slides
Denial of Service Attacks Types, Causes, Motives & Remedies By M. Raza ur Rehman NUST

Denial of Service Attacks Types, Causes, Motives & Remedies By M. Raza ur Rehman NUST

Denial of Service Attacks Types, Causes, Motives & Remedies By M. Raza ur Rehman NUST PAKCON 2004 Denial of Service Attacks Attempts to prevent or disturb legitimate access to co mputer resources Resources like bandwidth, services

557 views • 18 slides
Automated Detection of Guessing and Denial of Service Attacks in Security Protocols Marius Minea

Automated Detection of Guessing and Denial of Service Attacks in Security Protocols Marius Minea

Automated Detection of Guessing and Denial of Service Attacks in Security Protocols Marius Minea Politehnica University of Timi soara CMACS seminar, CMU, 18 March 2010 In this talk Formalizing attacks on protocols denial of service by

732 views • 45 slides
Denial-of-Service (DoS) CS 161: Computer Security Prof. David Wagner March 5, 2013 Attacks on

Denial-of-Service (DoS) CS 161: Computer Security Prof. David Wagner March 5, 2013 Attacks on

Denial-of-Service (DoS) CS 161: Computer Security Prof. David Wagner March 5, 2013 Attacks on Availability Denial-of-Service (DoS): preventing legitimate users from using a computing service We do though need to consider our threat model

1.09k views • 42 slides
A study of denial of service attacks on the Internet David J. Marchette marchettedj@nswc.navy.mil

A study of denial of service attacks on the Internet David J. Marchette marchettedj@nswc.navy.mil

A study of denial of service attacks on the Internet David J. Marchette marchettedj@nswc.navy.mil Naval Surface Warfare Center Code B10 < > - + A study of denial of service attacks on the Internet p.1/39 Outline Background

761 views • 54 slides
Denial of Service Attacks that prevent legitimate users from doing their work By flooding

Denial of Service Attacks that prevent legitimate users from doing their work By flooding

Denial of Service Attacks that prevent legitimate users from doing their work By flooding the network Or corrupting routing tables Or flooding routers Or destroying key packets Lecture 9 Page 1 CS 236 Online How Do Denial of

259 views • 15 slides
Denial of Service Attacks Summary ITS335: IT Security Sirindhorn International Institute of

Denial of Service Attacks Summary ITS335: IT Security Sirindhorn International Institute of

ITS335 DoS Attacks DoS Attacks Classic DoS Flooding & DDoS Denial of Service Attacks Summary ITS335: IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 13 August 2013

409 views • 26 slides
Outline Distributed Denial of Service Introduction Attacks Characteristics of DDoS

Outline Distributed Denial of Service Introduction Attacks Characteristics of DDoS

Outline Distributed Denial of Service Introduction Attacks Characteristics of DDoS attacks CS 239 Some examples Security for Networks and Proposed prevention methods System Software May 15, 2002 Lecture 12 Lecture 12

421 views • 9 slides
Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the

Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the

Chapter 7 Denial of Service Attacks DoS attack: An action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU), memory, bandwidth, and disk space.

1.55k views • 28 slides
Denial-of-Service (DoS) & Web Attacks CS 161: Computer Security Prof. Vern Paxson TAs:

Denial-of-Service (DoS) & Web Attacks CS 161: Computer Security Prof. Vern Paxson TAs:

Denial-of-Service (DoS) & Web Attacks CS 161: Computer Security Prof. Vern Paxson TAs: Devdatta Akhawe, Mobin Javed & Matthias Vallentin http://inst.eecs.berkeley.edu/~cs161/ February 17, 2011 Goals For Today Continue our

902 views • 52 slides
Distributed Denial of Service Attacks & Defenses Guest Lecture by: Vamsi Kambhampati Fall

Distributed Denial of Service Attacks & Defenses Guest Lecture by: Vamsi Kambhampati Fall

Distributed Denial of Service Attacks & Defenses Guest Lecture by: Vamsi Kambhampati Fall 2011 Distributed Denial of Service (DDoS) Exhaust resources of a target, or the resources it depends on Resources: CPU, Memory, Bandwidth

427 views • 23 slides
ECE590 Computer and Information Security Fall 2018 Denial of Service Attacks Tyler Bletsch

ECE590 Computer and Information Security Fall 2018 Denial of Service Attacks Tyler Bletsch

ECE590 Computer and Information Security Fall 2018 Denial of Service Attacks Tyler Bletsch Duke University Denial-of-Service (DoS) Attack The NIST Computer Security Incident Handling Guide defines a DoS attack as: An action that

565 views • 28 slides
Computer and Information Security Fall 2019 Denial of Service Attacks Tyler Bletsch Duke

Computer and Information Security Fall 2019 Denial of Service Attacks Tyler Bletsch Duke

ECE590 Computer and Information Security Fall 2019 Denial of Service Attacks Tyler Bletsch Duke University Denial-of-Service (DoS) Attack The NIST Computer Security Incident Handling Guide defines a DoS attack as: An action that

314 views • 28 slides
Detecting Distributed Denial of Service Attacks: A Neural Network Approach Gulay Oke

Detecting Distributed Denial of Service Attacks: A Neural Network Approach Gulay Oke

Detecting Distributed Denial of Service Attacks: A Neural Network Approach Gulay Oke (g.oke@imperial.ac.uk) Intelligent Systems and Networks Group Dept. of Electrical and Electronic Engineering Imperial College London Multi-Service

681 views • 21 slides
CyberWarfare Defense against Penetration T esting and distributed Denial-of-Service Attacks The

CyberWarfare Defense against Penetration T esting and distributed Denial-of-Service Attacks The

CyberWarfare Defense against Penetration T esting and distributed Denial-of-Service Attacks The Foundation of Network Security Stand-alone (ISP/Carrier Server Farm) modular TIPS for Perimeter Defense We brought a prototype for you!

263 views • 24 slides
Denial of Service via Algorithmic Complexity Attacks Scott Crosby and Dan Wallach Presented by

Denial of Service via Algorithmic Complexity Attacks Scott Crosby and Dan Wallach Presented by

Denial of Service via Algorithmic Complexity Attacks Scott Crosby and Dan Wallach Presented by Eddie Aftandilian COMP150ICS Spring 2006 1 Problem Frequently used data structures and algorithms have good average-case running time but

232 views • 8 slides
802.11 Denial-of-Service Attacks Real Vulnerabilities and Practical Solutions John Bellardo and

802.11 Denial-of-Service Attacks Real Vulnerabilities and Practical Solutions John Bellardo and

802.11 Denial-of-Service Attacks Real Vulnerabilities and Practical Solutions John Bellardo and Stefan Savage Department of Computer Science and Engineering University of California, San Diego Motivation n 802.11-based networks have flourished

389 views • 25 slides
CompSci 514 Computer Networks Lecture 20: Combating Denial of Service Attacks Xiaowei Yang How

CompSci 514 Computer Networks Lecture 20: Combating Denial of Service Attacks Xiaowei Yang How

CompSci 514 Computer Networks Lecture 20: Combating Denial of Service Attacks Xiaowei Yang How to Attack : Exhausting shared resources L Flooding traffic to exhaust the bandwidth, memory, or CPU of a victim Spoof addresses to hide

971 views • 72 slides
RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty

RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty

RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty MIT Lincoln Laboratory 22 October 2002 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations,

336 views • 7 slides
A Machine Learning Approach for Detecting Distributed Denial of Service Attacks Tanaphon Roempluk

A Machine Learning Approach for Detecting Distributed Denial of Service Attacks Tanaphon Roempluk

A Machine Learning Approach for Detecting Distributed Denial of Service Attacks Tanaphon Roempluk Master's degree studying Majoring in Information technology Faculty of informatics, Mahasarakham University The 4th International Conference on

207 views • 17 slides
IoDDoS The Internet of Distributed Denial of Service Attacks A Case Study of the Mirai

IoDDoS The Internet of Distributed Denial of Service Attacks A Case Study of the Mirai

SPAWAR S YSTEMS C ENTER P ACIFIC IoDDoS The Internet of Distributed Denial of Service Attacks A Case Study of the Mirai Malware and IoT-Based Botnets 24-26 April, 2017 Presented at the 2 nd International Conference Presented by Roger

654 views • 20 slides
The Problem Distributed Denial of Service Attacks and Defenses CS 239 Advanced Topics in

The Problem Distributed Denial of Service Attacks and Defenses CS 239 Advanced Topics in

The Problem Distributed Denial of Service Attacks and Defenses CS 239 Advanced Topics in Network Security Peter Reiher May 3, 2006 Lecture 9 Lecture 9 Page 1 Page 2 CS 239, Spring 2006 CS 239, Spring 2006 Distributed Denial of Service

500 views • 4 slides
Network Attacks Review & Denial-of-Service (DoS) CS 161: Computer Security Prof. Vern Paxson

Network Attacks Review & Denial-of-Service (DoS) CS 161: Computer Security Prof. Vern Paxson

Network Attacks Review & Denial-of-Service (DoS) CS 161: Computer Security Prof. Vern Paxson TAs: Devdatta Akhawe, Mobin Javed & Matthias Vallentin http://inst.eecs.berkeley.edu/~cs161/ February 15, 2011 Goals For Today Review

825 views • 53 slides
Denial-of-Service Attacks on Shared Cache in Multicore: Analysis and Prevention Michael Bechtel

Denial-of-Service Attacks on Shared Cache in Multicore: Analysis and Prevention Michael Bechtel

Denial-of-Service Attacks on Shared Cache in Multicore: Analysis and Prevention Michael Bechtel and Heechul Yun University of Kansas 1 Multicore Platforms Increasingly demanded in embedded real-time systems. Provide improved

757 views • 31 slides

More recommend