How valuable DDoS mitigation hardware is for Layer 7 Sophisticated attacks

How valuable DDoS mitigation hardware

is for Layer 7 Sophisticated attacks

Stop DDoS before they stop you!

What Is Distributed Denial of Service

A Denial of Service attack (DoS) is any intended attempt to

prevent legitimate users from reaching a specific network

resource, from a single source.

Distributed Denial of Service attack (DDoS) is an extension to a

DoS attack however is harder to mitigate because source traffic is

from multiple source addresses. The attack traffic can be difficult

to distinguish from legitimate traffic.

Types of DoS Attacks

Layer 3 (Network Protocol) - (DoS, DDoS, DRDoS, CDRDoS)

IP Address attacks targeting network bandwidth - UDP Flood style attacks – DNS, NTP, SSDP, CHARGEN, SNMP.

Layer 7 (Application Protocol) (DoS, DDoS) TCP attacks on server sockets

HTTP attacks on Web server threads Protocol Attacks (SYN flood, fragments) Packet Storm (Excessive PPS)

Resource Starvation (CPU, I/O, Memory) Stealth/Creeper (Slowloris, Slow POST) Exploit (Application or OS Specific DoS)

They attack the top layer OSI model, They have low bandwidth consumption. They have a legitimate and stealth appearance.

They’re mostly non-volumetric. They’re increasingly popular.

There are a variety of methods, targets, and open-source tools. They’re difficult to defend against.

Common DDoS Defensive Techniques

•

Simple Site Failover

•

Null Route (Black Hole) (Automated or Manual)

•

Anycast – BGP Multi Home

•

Onsite Web Application Firewall

•

Load Balancing Appliances

•

Commercial Hardware Solutions – On Premises

•

Commercial Solutions – In the Cloud

Large Global Denial of Service attacks

300G

400G

Micron21 Statistics

Long term average attack lasts 34.5 hours

China is #1 origin of DDoS traffic, making up 40-50% of all

unwanted traffic activity

25% of attacks are against Infrastructure (Layers 3 attacks)

75% against Connection and Applications (layer 4 to 7 attacks)

75% of all attacks are under 1 Gbit

20% of all attacks are under 4 Gbit

5% of all attacks are above 4 Gbit

Tools used by Faceless Hacker in Layer 4 to 7 Attacks HTTP GET Flood

Syn Flood Attack Ack Flood Attack

SSL Based Attacks - CURL back track, THC SSL very hard to detect LOIC Low Orbit Ion Cannon

R.U.DY R U Dead Yet Slowloris

Pylorius DDoSim

THC-SSL-DOS

Dirt Jumper Drive2 – Method: HTTP flood, SYN flood, POST flood, and more. Tor’s Hammer – Method: Slow POST

Nuclear DDoSer – Method: Slow POST Railgun – Method: Slow POST

HTTP has a 60 known vulnerabilities which can be attacked

Micron21 Total Attacks Since January 2013

Attack Type Attack Count Dropped Traffic Dropped Traffic _{(packets) Dropped Traffic} Percentage of Percentage of _{Attack Type}

SYN-Flood 544,272 260.7 G 547.4 M Less than 1.0% 43%

ACK-Flood 161,204 175.9 G 227.1 M Less than 1.0% 12.8%

UDP-Flood 111,429 2,660,087 G

(2597 TB) 47 Billion 98.0% 8.9%

ICMP-Flood 2,962 243.2 G 310.6 M Less than 1.0% 0.23%

Conn-Flood 173,042 44.2 G 8.6 M Less than 1.0% 13.8%

Stream-Flood 131,076 734.8 G 93.4 M Less than 1.0% 10.4%

Current Active DDoS Attacks -

Total Data PPS Target Type Port Peak Speed

0.05GB 49 111.223.226.91 Others 80 0.0Mbps 0.0GB 20 103.4.18.149 Stream Flood 80 0.0Mbps 0.0GB 4 111.223.232.30 SYN-Flood 443 0.0Mbps 0.0GB 1 27.131.75.35 Conn-Flood 80 0.0Mbps 0.0GB 1 111.223.231.34 ACK-Flood 80 0.0Mbps 0.0GB 1 27.131.75.36 SYN-Flood 80 0.0Mbps 0.0GB 1 27.131.75.35 Conn-Flood 80 0.0Mbps 0.0GB 1 27.131.105.189 SYN-Flood 80 0.0Mbps 0.0GB 1 111.223.228.178 SYN-Flood 80 0.0Mbps 0.0GB 1 111.223.231.34 ACK-Flood 80 0.0Mbps 0.0GB 1 27.131.75.35 SYN-Flood 80 0.0Mbps 0.0GB 1 27.131.105.189 Conn-Flood 25 0.0Mbps 0.0GB 1 111.223.228.186 ACK-Flood 80 0.0Mbps 0.0GB 1 111.223.228.178 SYN-Flood 80 0.0Mbps 0.0GB 1 111.223.231.34 ACK-Flood 21 0.0Mbps 0.0GB 1 27.131.75.36 SYN-Flood 443 0.0Mbps 0.0GB 1 27.131.75.35 SYN-Flood 80 0.0Mbps 0.0GB 1 27.131.105.189 ACK-Flood 80 0.0Mbps 0.0GB 1 111.223.228.178 SYN-Flood 25 0.0Mbps 0.0GB 1 111.223.231.34 Conn-Flood 443 0.0Mbps 0.0GB 1 111.223.228.178 Conn-Flood 80 0.0Mbps 0.0GB 1 27.131.66.209 Others 80 0.0Mbps 0.0GB 1 27.131.105.189 SYN-Flood 80 0.0Mbps 0.0GB 1 111.223.228.178 SYN-Flood 80 0.0Mbps 0.0GB 1 27.131.75.35 ACK-Flood 443 0.0Mbps 0.0GB 1 27.131.105.189 SYN-Flood 80 0.0Mbps 0.0GB 1 111.223.231.34 Conn-Flood 25 0.0Mbps

Firewalls and Layer 4 to 7 Attacks

Juniper SSG550M Firewall Specifications

ScreenOS version tested ScreenOS 6.2

Firewall Perf (Large Packets) 1+ Gbps

Firewall Performance (IMIX) 1 Gbps

Firewall Packets Per Second 600,000 PPS

3DES+SHA-1 VPN Perf 600 Mbps

Concurrent VPN Tunnels 1,000

Max Concurrent Sessions 256,000

New Sessions/Second 15,000

Max Security Policies 4,000

ACK Flood – Juniper SSG 550m Firewall

BOTNET 983 hosts

Each bot sends 8 packets per second at 25 bytes in size 7832 packets per second – 1.5mbits of traffic

Juniper SSG 550m 0.25m TCP sessions fails in 32 seconds Juniper SRX 1400 / Sonic Wall SuperMassive 9000 1.5m TCP sessions fails in 3.2 minutes Juniper SRX 3400 / Sonic Wall SuperMassive E10200 TCP 3.0m sessions fails in 6.4 minutes Juniper SRX 5800 / 100m sessions (over $1m investment) unlikely to fail with this attack

Layer 4 to 7 Attacks Prevention

How Does Micron21 Prevents Stateful devices from failing?

IE. Firewalls and Load Balancers ?

So How Does NSFOCUS work

NSFOCUS ADS - 6020

ADS -- Multilayer Cleaning

Rate Limit

2. Access Control List

 Layer 4 ACL  Conn-Exhaustion ACL  URL ACL 1. Protocol Analysis Protocol Validation by RFC Check 3. Reputation List  White/Black List  Dynamic Prioritizing 4. Layer 4 Flood Mitigation Source/destination IP address check/verification  Various mitigation algorithms Traffic Cleaning Center Internet 5. Layer 7 Flood Mitigation  Various mitigation algorithms Pattern Matching P ro to co l A na ly sis A cce ss C o nt ro l L is t Re p ut at io n L ist La ye r 4 F lo o d M it ig at io n La ye r 7 Flo o d M it ig at io n Attacker 6: Rate Limit

Restricts traffic and

ensures the critical business.

1 2 3 4 5

Packet Inspection and Capture

Netflow information is useless in application DDoS detection; you need advance packet inspection along with behavioral patterns.

Selected Clients - NSFOCUS provides over

4000G+

DDoS mitigation

capacity to global customers

Telecommunications

Korea Telecom

Banking and Finance

Enterprises

Hosting , IDC, ISP, MSSP

HQ

Overview

Regional Subsidiaries

Place your text here

• Jan. 2014 IPO

• Over 13 years experience in DDoS mitigation

• Dedicated to network security

About NSFOCUS

• US: Santa Clara, US • EMEA: London, UK • Japan: Tokyo, JP • APAC: Singapore • Global Business HQ:

Santa Clara, USA • CN HQ: Beijing • Founded in 2000

• Over 1,600 employees

THANK YOU !

come and talk with us on our booth.