Network Security Denial of Service Attacks Dina Katabi

Network Security Denial of Service Attacks Dina Katabi dk@mit. edu nms. csail. mit. edu/~dina

Announcements v v DP 2 extension until Sunday 5 pm Online evaluation is open at http: //web. mit. edu/subjectevaluation

Attacker’s Goals v Makes v a service inaccessible Links, servers, routing, etc. v Hide v Maximize damage for little work on the side of the attacker

Attacker Wants to Hide v Spoof the source (IP address, email account, . . . ) v Indirection v Attacker Reflector attacks: E. g. , Smurf Attack ICMP Echo Req Src: Victim’s addr Dest: brdct addr gateway Victim

Attacker Wants to Hide v Spoof the source (IP address, email account, . . . ) v Indirection v Reflector attacks: E. g. , Smurf Attack gateway Attacker ICMP Echo Reply Dest: Victim

Increase Damage Go Fully Distributed Use a Botnet Attacker Master Unidirectional commands Master Coordinating communication Daemon Daemon Daemon Victim Attack traffic

Trinoo Transcript Connection to port (default 27665/tcp) attacker$ telnet 10. 0. 0. 1 27665 Trying 10. 0. 0. 1 Connected to 10. 0. 0. 1 Escape character is '^]'. Kwijibo Connection closed by foreign host. . attacker$ telnet 10. 0. 0. 1 27665 Trying 10. 0. 0. 1 Connected to 10. 0. 0. 1 Escape character is '^]'. Betaalmostdone trinoo v 1. 07 d 2+f 3+c. . [rpm 8 d/cb 4 Sx/] trinoo>

Trin 00 Commands v dos <IP> - command to initiate a Do. S against the targeted <IP> address v mdos <IP 1: IP 2: IP 3> - sends command to attack three IP addresses, sequentially v die – shut down the master v mdie <password> - if correct password specified, packet is sent out to all daemon nodes to shutdown v mping – ping sent to all nodes in the deamon list v killdead – delete deamon nodes from list that didn’t reply to ping v bcast – gives a list of all active daemons v mstop – Attempts to stop an active Do. S attack. Never implemented by the author(s), but the command is there

Attacks

Attacks on Bandwidth v Brute force attack v Attacker sends traffic to consume link bandwidth

Defending against bandwidth attacks is hard Bottleneck Link ISP network Victim network v v v Should drop packets before the bottleneck, i. e. , at ISP But v ISPs are not willing to deploy complex filters for each client v ISPs have no strong incentive; they charge clients for traffic Big companies defend themselves by using very high bandwidth access links

Attacks on TCP

TCP Do. S Attacks: TCP SYN Flood Client Server SYNC Listening SYNS, ACKC Store data Wait ACKS Connected

TCP Do. S Attacks: TCP SYN Flood C S SYNC 1 SYNC 2 SYNC 3 SYNC 4 SYNC 5 Listening Store data

TCP Do. S Attacks: TCP SYN Flood v Usually targets connection memory Too many half-open connections v Potential victim is any TCP-based server such as a Web server, FTP server, or mail server v To check for SYN flood attacks v v Run netstat -s |grep "listenqueue overflows“ and check whether many connections are in "SYN_RECEIVED" How can the server deal with it? v v Server times out half-open connection SYN cookies and SYN caches prevent spoofed IP attacks

SYN Cookie v v Ensures source IP is not spoofed Server delay resource reservation until it checks that the client can receive a packet at the claimed source address C S SYNACK (seqs=cookie) No state is stored. Initialize TCP seq number to a random cookie ACK (seqs=cookie+1) Check seq to ensure client received cookie

Attacks on Routers

Attacks on Routers: Attacks on Routing Table Z A, Cost 1 Z A Routing Info B Y X Y Z A, Cost 2 v Attacker needs to get access to a router v Attacks v B Y Z A, Cost 3 Prefix hijacking by announcing a more desirable route § Z can lie about its route to A v Overload routers CPU by too many routing churns v Overload the routing table with too many routes § § Causes router to run out of memory or CPU power for processing routes E. g. , AS 7007

Attacks on Routers: Countering Routing Table Attacks v Authenticate peer routers v Secure BGP [Kent et al] v v Every ISP sign their advertisements creating a chain of accountability (e. g. , Y sends { X: {A}X }Y Too many signatures too slow § With no authentication needs a few usec; authentication needs 2 orders of magnitude more time

Do. S Attacks on Web Servers

Do. S Attacks on Servers: Attacks that Mimic Legitimate Traffic GET Large. File. zip DO Long. DBQuery v v v Attacker compromises many machines causing them to flood victim with HTTP requests Attacked resources v DB and Disk bandwidth v Socket buffers, processes, … v Dynamic content, password checking, etc. Hard to detect; attack traffic is indistinguishable from legitimate traffic

CAPTCH-Based Solution Suspected attack! To access www. foo. com enter the above letters: v Need to ensure: v v Cheap ways to send test and check answer Some people can’t or don’t want to answer graphical tests but are legitimate users (e. g. , Blind users)

Detection

Network Intrusion Detection XP Linux Mac Win 98 NT Linux Win 95 v NIDS box monitors traffic entering and leaving your network v In contrast to firewalls, NIDS are passive

Approaches to Intrusion Detection 1. Signature Based: Keeps a DB of known attack signatures and matches traffic against DB (e. g. , Bro, Snort) v Pros § § v Cons § 2. Can’t discover new attacks Anomaly Based: Matches traffic against a model of normal traffic and flags abnormalities (e. g. , EMERALD) v Pros § v Can deal with new attacks Cons § § § 3. Easy to understand the outcome More accurate in detecting known attacks Modeling normal. it is hard to describe what is normal Limits new applications Less accurate detection of known attacks Hybrid: Matches against DB of known attacks. If no match, it checks for anomaly

Evasion Problem in NIDS v v Consider scanning traffic for a particular string (“USER root”) Easiest: scan for the text in each packet v v Okay, remember text from previous packet v v No good: text might be split across multiple packets No good: out-of-order delivery Okay, fully reassemble byte stream v v Costs state …. …. and still evadable Source: Vern Paxson

Evading Detection Via Ambiguous TCP Retransmission Sender 15 hops 20 hops NIDS Receiver

Evading Detection Via Ambiguous TCP Retransmission n r Attacker TTL=17, seq=1 Timed out TTL=23, seq=1 NIDS r n or r? Receiver

Evading Detection Via Ambiguous TCP Retransmission n r o i TTL=17, seq=1 Timed out TTL=23, seq=1 r TTL=21, seq=2 o TTL=15, seq=2 Attacker Timed out NIDS n or r? i or o? Receiver

Evading Detection Via Ambiguous TCP Retransmission TTL=17, seq=1 n TTL=23, seq=1 r r TTL=21, seq=2 o o TTL=15, seq=2 i o c t Timed out TTL=20, seq=3 o TTL=19, seq=4 Timed out TTL=27, seq=4 Attacker t NIDS n or r? i or o? o c or t? Receiver noot? niot? rooc? nioc? riot? root? …

Bypassing NIDS v Evasion v Insertion v Do. S it v Hack it v Cause many false alarms until admin stops paying attention