Political DDoS: Estonia and Beyond Jose Nazario, Ph.D.
[email protected] USENIX Security, 2008 Jose Nazario, Ph.D. o Arbor 2002 - Present o ATLAS, ASERT, ATF o Research, analysis, engineering Page 2 DDoS Background Exhaust resources Overwhelm target Dispersed origins Page 3 Page 4 DDoS Background Page 5 DDoS Types o Bandwidth exhaustion – UDP floods – ICMP floods o Server resource exhaustion – HTTP GET request floods – SYN floods o Spoofed or not o Protocol abuse (ie DNS amplification) Page 6 DDoS History 25 Gbps 200 Mbps 1998 2001 2004 2007 Primitive Worms Botnets Cyberwar TFN, etc Code Red IRC Dedicated Nimda Botnets Page 7 Trivial Requires human coordination Page 8 Power to the People Page 9 More Sophisticated Page 10 Measuring Global Attacks Page 11 Internet Attack Scale o Unique attacks exceeding indicated BPS threshold for single ISP o Average of three 1-Gbps or larger attacks per day over 485 days of collection o Two ~25 Gbps attacks reported by a single ISP (on same day, about one hour apart, duration of ~35 minutes) Page 12 21 Days Y/Y o Significant Y/Y growth o Identify additional trends: Holiday Season typically slow time for attackers Page 13 Attack Intensity 2-3% Backbone Traffic Page 14 Attack Subtypes • 1 year of global measured attack data • 1128 attacks per day average • 30 attacks per deployment per day reporting Attack Subtype Percent of Total Attacks DNS 0.23% IP Fragment 14.41% Private IP Space 1.22% IP NULL Protocol 0.78% TCP NULL Flag 0.57% TCP Reset 6.45% TCP SYN 15.53 Page 15 Attacks over Time Page 16 By Protocol