60 Days of Basic Naughtiness

Rob Thomas robt@cymru.comhttp://www.cymru.com/~robt

Probes and Attacks Endured by an Active Web Site

16 March 2001

60 Days of Basic Naughtiness

• Statistical analysis of log and IDS files.

• Statistical analysis of a two-day DDoS attack.

• Methods of mitigation.

• Questions.

About the Site

• Production site for several (> 4) years.

• Largely static content.

• No e-commerce.

• Layers of defense – more on that later!

About the Data

• Data from router logs.

• Data from IDS logs.

• Snapshot taken from 60 days of combined data.

• Data processed by several home-brew tools (mostly Perl and awk).

Definition of “Naughty”

• Any traffic that is logged by a specific “deny” ACL.

• Any traffic that presents a pattern detected by the IDS software.

• The two log sources are not necessarily synchronized.

Daily Probes and Attacks

• TCP and UDP Probes and Attacks – ICMP not counted.

• Average – 529.00

• Standard deviation – 644.10!

• 60 Day Low – 83.00

• 60 Day High – 4355.00

Daily Probes and AttacksDaily Probes and Attacks

Weekly Probes and Attacks

• There is no steady-state.• Attacks come in waves, generally on the

heels of a new exploit and scan.• Certain types of scans (e.g. Netbios) tend to

run 24x7x365. • Proactive monitoring, based on

underground and public alerts, will result in significant data capture.

Weekly Probes and AttacksTrend Analysis

Weekly Probes and Attacks

11/12 -11/18

11/19 -11/25

11/26 -12/02

12/03 -12/09

12/10 -12/16

12/17 -12/23

12/24 -12/30

12/31 -01/06

01/07 -01/13

01/14 -01/20

Hourly Probes and Attacks

• Myth: “Most attacks occur at night.”

• An attacker’s evening may be a victim’s day – the nature of a global network.

• Truth: Don’t plan based on the clock.

Hourly Probes and AttacksTrend Analysis

Hourly Probes and Attacks

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24

24 Hour Clock

UDP Probes and AttacksTop Five Destination Ports

• First – 137 NETBIOS

• Second – 53 DNS

• Third – 27960

• Fourth – 500 ISAKMP

• Fifth – 33480 (likely UNIX traceroute)

UDP Probes and AttacksTrend Analysis

UDP Probes and Attacks

Port 137 Hits

Port 53 Hits

TCP Probes and AttacksTop Five Destination Ports

• First – 3663 (DDoS Attack)

• Second – 0 Reserved (DDoS Attack)

• Third – 6667 IRC (DDoS Attack)

• Fourth – 81 (DDoS Attack)

• Fifth – 21 FTP-control

TCP Probes and AttacksTrend Analysis

TCP Probes and Attacks

s Port 0 Hits

Port 21 Hits

Source Address of Probes and Attacks

Classful Sources of Probes and Attacks

A B C D E

IP Netblock Class

Source Address Class Percentage

Source Address of Probes and AttacksBogon Source Percentages

IP Netblock Class

Bogon Addresses

Total Addresses

Source Address of Probes and Attacks

• Bogon source attacks still common.• Of all source addresses, 53.39% were in the

Class D and Class E space.• Percentage of bogons, all classes –

66.85%!• This is good news – prefix-list, ACL

defense, and uRPF will block 66.85% of these nasties!

Source Region of the NaughtyA dangerously misleading slide

RIR for Source Addresses

Intrusion (attempt) Detection

• IDS is not foolproof!

• Incorrect fingerprinting does occur.

• You can not identify that which you can not see.

Top Five IDS Detected ProbesIDS Detected Probes

NetBus Backorifice TFTP IDENT Deep Throat

Top Five Detected IDS ProbesIDS Detected Probes - Trend Analysis

1 4 7 10 13 16 19 22 25 28 31 34 37 40 43 46 49 52

NetBus

Backorifice

Deep Throat

Top Five IDS Detected AttacksIDS Detected Attacks

TCP Port 0 FIN flood Fragments ICMP flood RST flood

Hits Number

Top Five IDS Detected SourcesIDS Detected Source Netblocks

Azerbaijan USA 01 South Korea USA 02 Canada

Netblock Location

Top Five IDS Detected SourcesIDS Detected Attacks - Trend Analysis

1 3 5 7 9 11 13 15 17 19 21 23 25 27 29 31 33 35 37 39 41 43 45 47 49

Match a Source with a ScanSource to Hit Matching

1 2 3 4 5 6 7

NetBus

Backorifice

Deep Throat

Two Days of DDoS

• Attack that resulted in 10295 hits on day one and 77466 hits on day two.

• Attack lasted 25 hours, 25 minutes, and 44 seconds.

• Quasi-random UDP high ports (source and destination), small packets.

Two Days of DDoS

• Perhaps as many as 2000 hosts used by the attackers.

• 23 unique organizations.

• 9 different nations located in the Americas, Europe, and Asia.

• Source netblocks all legitimate.

Two Days of DDoSPackets per minute

DATE:HOUR:MINUTE

Two Days of DDoSDDoS Sources

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

Site Defense and Attack Mitigation

• While you can not prevent an attack, you can choose how to react to an attack.

• Layers of defense that use multiple tools.

• Layers of monitoring and alert mechanisms.

• Know how to respond before the attack begins.

• Border router– Protocol shaping and filtering.– Anti-bogon and anti-spoofing defense (uRPF),

ingress and egress filtering.– NetFlow.

• IDS device(s)– Attack and probe signatures.– Alerts.

• Border firewall– Port filtering.– Logging.– Some IDS capability.

• End systems– Tuned kernel.– TCP wrappers, disable services, etc.– Crunchy through and through!

• Don’t panic!

• Collect data!

• The good news - you can survive!

References and shameless self advertisements

• RFC 2267 - http://rfc.net/rfc2267.html• Secure IOS Template –

http://www.cymru.com/~robt/Docs/Articles/secure-ios-template.html

• Secure BGP Template – http://www.cymru.com/~robt/Docs/Articles/secure-bgp-template.html

• UNIX IP Stack Tuning Guide – http://www.cymru.com/~robt/Docs/Articles/ip-stack-tuning.html

Any questions?

Thank you for your time!

• Thanks to Jan, Luuk, and Jacques for inviting me to speak with you today.

• Thanks to Surfnet/CERT-NL for picking up the travel.

• Thanks for all of the coffee!

60 Days of Basic Naughtiness

Documents

INTERNATIONAL CIVIL SERVICE COMMISSION - … - (Currency) Area First 60 Days US$ First 60 Days Local >60 Days Local Room as % of DSA Effective Date d/mm/y Survey Date d/mm/y Notes

In 60 Days – ICND2

James 1:21 “Wherefore lay apart all filthiness and superfluity of naughtiness...”

Diet Can Change Eye Color in 60 Days

Star Diamond in 60 Days

Our First 60 Days of FME

Journal - WordPress.com · Journal. Day #60 Measurements ... 30 Days: 45 Days: 60 Days: Neck Chest: Arms Waist: Hips Thighs: Shins Size: Weight: ... FEB MAR …

The First 60 Days

60 Days to Fall in Love

Why NEC in Hong Kong ? --- DSD’s experience on NEC- DSD’s … · 2019. 7. 2. · No. of CE. Days (less than x days) Average (60) Average 60 days 60 days 60 days to settle (from

IASbaba’s 60 Days Plan – Day 24 (Polity)

How to Pass Your CCNA in 60 Days

60 Days of Direct Marketing Trends

Rob Thomas robt@cymru.com robt 60 Days of Basic Naughtiness Probes and Attacks Endured by an Active Web Site 16 March 2001

Around the World in 60 Days

IASbaba Prelims 60 Days Plan

Write Your Book in 60 Days Webinar

Public Data Access Release · Req 7.EWL Count 8.Appts Between 0-14 Days 9.EWL 0-14 Days 10.Appts Between 15-30 Days 11.EWL 15 -30 days 12.Appts Between 31-60 Days 13.EWL 31 -60 Days

30-60-90 Days Finish Strong

60 Days to A Radiating Faith