Layer 7 denial of services attack mitigation

Layer7 Denial Of Sevice Attack Mitigation

IT LESEHAN - y3dipsSaturday, November 12, 11

Agenda

• Introduction

• Denial Of Service

• Layer 7 Denial Of Service

• Case Stories

• Demo

• Discussion

Saturday, November 12, 11

Introduction• Freelance IT Security Consultant

• More than 9 years in IT Security

• Founder of “ECHO” one of Indonesian Hacker Community, established 2003

• Founder of IDSECCONF - Indonesia Security Conference in Cooperation with DEPKOMINFO

• More Info:

• [email protected]

• @y3dips


http://web.id

http://web.id

Denial of ServiceSuatu jenis kegiatan yang bertujuan untuk menggagalkan kerja suatu

sistem secara maksimal baik sebagian atau seluruhnya.


DOS

• Stupid Act

• Exhausted also yours

• Old story,

• moby write ddos in 2003 *

• I write apache dos in 2003**

• Well handle by now*http://ezine.echo.or.id/ezine2/ddos%7EMoby.txt**http://ezine.echo.or.id/ezine2/dos_buat_apache%7Ey3dips.txt


http://ezine.echo.or.id/ezine2/ddos%7EMoby.txt

http://ezine.echo.or.id/ezine2/ddos%7EMoby.txt

http://ezine.echo.or.id/ezine2/dos_buat_apache%7Ey3dips.txt

http://ezine.echo.or.id/ezine2/dos_buat_apache%7Ey3dips.txt

Type of Network DOS

• Layer 4

• Attack layer 4 protocol

• TCP

• SYN, FIN, ACK

• smurf, TRINOO, stacheldart, teardrop


Type of Network DOS

• Layer 7

• Attack Layer 7 Protocol

• HTTP, FTP, DNS

• HTTP-slow post, HTTP-GET


Real Life Stories When this all begin


DOS Terhadap ECHO

• 7 - 8 November 2011

• Unknown Motives

• Echo Web Access Down


Attack Detection


See TKP :)


Check Validitas DOS

• Only you?

• Or for everyone :D

• http://downforeveryoneorjustme.com/


http://downforeveryoneorjustme.com

http://downforeveryoneorjustme.com

Analyze :|


Analyze

• The Server Down?

• Or onlye specific service Down


In this Case 80 down


Layer 7 DOSLets Dig arround on 80!


See Stats :)


Ganti Periode Laporan: 201111 - Bulan Nov 2011 Go

Statistik untuk: echo.or.idTerakhir diupdate: 08 Nov 2011 - 14:20Periode Laporan: Bulan Nov 2011

Kapan: Monthly history Days of month Hari Jam (Waktu Server) Siapa: Countries Daftar Lengkap Host Daftar Lengkap Kunjungan Terakhir Alamat IP yang tidak teresolve Robot/Spider Daftar Lengkap

Kunjungan Terakhir Navigasi: Lama kunjungan Jenis File Halaman yang Dilihat Daftar Lengkap Halaman masuk (entry page) Halaman keluar (exit page) Sistem Operasi

Versi Tidak Diketahui Browser Versi Tidak Diketahui Referer: Asal Search engine referer Situs referer Pencarian Frase Pencarian Kata Kunci Pencarian Lainnya: Miscellaneous Kode error HTTP Halaman tidak ditemukan (not found)

Ringkasan Periode Laporan Bulan Nov 2011Kunjungan Pertama 01 Nov 2011 - 00:00Kunjungan Terakhir 08 Nov 2011 - 11:35

Pengunjung Unik Jumlah Kunjungan Halaman Hit Bandwidth

Traffic viewed * 10021

14357(1.43 kunjungan/pengunjung)

102822(7.16 Halaman/Kunjungan)

417078(29.05 Hit/Kunjungan)

1.45 GB(105.69 KB/Kunjungan)

Traffic not viewed * 88111 145915 395.12 MB

* Not viewed traffic includes traffic generated by robots, worms, or replies with special HTTP status codes.

Monthly history

Jan2011

Feb2011

Mar2011

Apr2011

Mei2011

Jun2011

Jul2011

Agu2011

Sep2011

Okt2011

Nov2011

Des2011

Bulan Pengunjung Jumlah Halaman Hit Bandwidth

Statistik untuk echo.or.id (2011-11) http://echo.or.id/index.cgi

1 of 10 11/9/11 1:46 PMSeems all LegitSaturday, November 12, 11

7, 8 November?Saturday, November 12, 11

7, 8 November?Saturday, November 12, 11

Ask the Logs :)


Logs

• HTTP/S logs

• http-access

• http-error


A Valid OneSaturday, November 12, 11

A Valid One but also http-flood GET Saturday, November 12, 11

Conclusion

• Its an HTTP-flood GET

• Connection need to be Established

• IP need to be valid?


Learn from Code :)


*Credit to Google for the code, just dig and found


Attack Mitigation


Mitigation

• Always Have your backup

• No privil8 access to server; LAPORKAN


Mitigation

• Had The Privileged

• check netstat -n | grep 80 | wc -l

• block :

• iptables -A INPUT -s x. x. x. x -p tcp -j TARPIT

• iptables -A INPUT -s x. x. x. x -p tcp -j DROP


TARPITING

http://www.secureworks.com/research/threats/ddos/

Care to Send and double the packet :) ?




Hardening Apache

•TimeOut=Default 300 detik atau 5 Menit, disarankan 10 detik

• TimeOut akan melindungi server dari rikues dalam jumlah besar, dan tidak pernah di putus oleh Attacker, dengan adanya TimeOut, apabila tidak terjadi transaksi dalam waktu tersebut (10 detik), maka Apache akan memutus koneksi


Hardening Apache

•KeepAlive = On• KeepAlive akan mengijinkan Berbagai jenis HTTP rikues

dilakukan dalam satu koneksi.

•KeepAlive = 15 detik• Setting ini akan melindungi Server dari Rikues Keepalive tanpa

transaksi


Hardening Apache

•AcceptFilter = http/https data• Melindungi dari jenis serangan, dimana attacker membuka

koneksi via socket dan membiarkannya tanpa terjadinya transaksi data. Dengan mendefinisikan data pada http dan https akan meminimalisir jenis serangan ini.


DeMo



Layer7 Denial Of Sevice Attack Mitigation

IT LESEHAN - y3dipsSaturday, November 12, 11

Date post:	18-May-2015
Category:	Technology
Upload:	ammar-wk
View:	2,623 times
Download:	3 times

Layer 7 denial of services attack mitigation

Technology