Embed Size (px)
Citation preview
1000 days of UDPamplification DDoS attacks
Daniel R. Thomas,Richard Clayton,
Alastair R. [email protected]
Daniel: 5017 A1EC 0B29 08E3 CF64 7CCD 5514 35D5 D749 33D9Richard: 899A 94CE BFCE CCE2 5744 5ACE 3BBC CF52 A8B9 ECFBAlastair: 9217 482D D647 8641 44BA 10D8 83F4 9FBF 1144 D9B3
UDP scanning
Reflector 8.8.8.8
Attacker 192.168.25.4
big.gov IN TXT src: 192.168.25.4 dst: 8.8.8.8
big.gov IN TXT " Extremely long response.............. ........................... ........................... .........................." src: 8.8.8.8 dst: 192.168.25.4
(1)(2)
2
UDP reflection DDoS attacks
Reflector 8.8.8.8
Attacker 192.168.25.4
Victim 172.16.6.2
big.gov IN TXT src: dst: 8.8.8.8
big.gov IN TXT " Extremely long response.............. ........................... ........................... .........................." src: 8.8.8.8 dst: 172.16.6.2
3
4
We run lots of UDP honeypots
● Median 65 nodes since 2014
● Hopscotch emulates abused protocols– QOTD, CHARGEN, DNS, NTP, SSDP, SQLMon, Portmap,
mDNS, LDAP
● Sniffer records all resulting UDP traffic
● (try to) Only reply to black hat scanners
5
This is ethical
● We reduce harm by absorbing attack traffic
● We don’t reply to white hat scanners (notimewasting)
Estimating total attacks usingcapture-recapture
A=160 B=200
Estimated population: 400 ± 62
8080
6
10
100
1000
10000
100000Est
imate
d n
um
ber
of
att
ack
s per
day (
log)
CHARGENDNSNTPSSDP
7
0
0.2
0.4
0.6
0.8
1
0
10
20
30
40
50
60
70
80
90Pro
port
ion
of
all
att
ack
s th
at
we o
bse
rve
CHARGENDNSNTP
SSDP
8
0
0.2
0.4
0.6
0.8
1
0
10
20
30
40
50
60
70
80
90
Nu
mb
er
of
hon
eyp
ots
in
op
era
tion
# A+B# A
9
0
0.2
0.4
0.6
0.8
1
0
10
20
30
40
50
60
70
80
90Pro
port
ion
of
all
att
ack
s th
at
we o
bse
rve
Nu
mb
er
of
hon
eyp
ots
in
op
era
tion
# A+B# A
CHARGENDNSNTP
SSDP
10
0
200
400
600
800
1000
1200
1400
Nu
mb
er
of
att
ack
s
SeenMissing
Vdos coverage NTP
11
Vdos coverage SSDP
0
100
200
300
400
500
600
700
800
900
Nu
mb
er
of
att
ack
s
SeenMissing
12
NTP
0
0.1
0.2
0.3
0.4
0.5
0.6
0.7
0.8
0.9
1
60 120
Frequency
of attacks (m
illions)
Duration of attack (minutes)13
NTP
0
0.1
0.2
0.3
0.4
0.5
0.6
60 120P(a
ttack
end
s in
<5
min
| d
ura
tion)
Duration of attack (minutes)14
15
Running a honeypot network is cheap(but we do it for you)● Median of 65 nodes.
● 200GB/month inbound per node.
● Hosting costs of $170/month (+staff costs)
● Need 10 to 100 sensors depending onprotocol.
● Our collection is ongoing and you can use ourdata. You can also contribute.
16
This is a solvable problem
● BCP38/SAVE
● Follow the money
● Enforce the law
● Warn customers it is illegal
17
Ongoing work
● Selective reply (like Krupp et al. 2016)
● More cross validation
● Estimate attack volume
● Collaboration– What do you want to do with this data?
– You can run our code.
– Do you have ground truth for attack volumes?
Daniel: 5017 A1EC 0B29 08E3 CF64 7CCD 5514 35D5 D749 33D9Richard: 899A 94CE BFCE CCE2 5744 5ACE 3BBC CF52 A8B9 ECFBAlastair: 9217 482D D647 8641 44BA 10D8 83F4 9FBF 1144 D9B3
Daniel R. ThomasRichard ClaytonAlastair R. [email protected]
Data is available through theCambridge Cybercrime Centre
https://cambridgecybercrime.uk/
![User Datagram Protocol (UDP) UDP [RFC 768] UDP Socket](https://img.pdfslide.us/doc/110x75/586e022b1a28ab3c168b57c2/user-datagram-protocol-udp-udp-rfc-768-udp-socket.jpg)
