Survey
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Computer network wikipedia , lookup
Zero-configuration networking wikipedia , lookup
Cross-site scripting wikipedia , lookup
Recursive InterNetwork Architecture (RINA) wikipedia , lookup
Wake-on-LAN wikipedia , lookup
Network tap wikipedia , lookup
Airborne Networking wikipedia , lookup
Piggybacking (Internet access) wikipedia , lookup
List of wireless community networks by region wikipedia , lookup
Wireless security wikipedia , lookup
Computer security wikipedia , lookup
Network Denial of Service Attacks Advanced Network Security Peter Reiher August, 2014 Advanced Network Security Lecture 17 Page 1 Outline • Denial of service in networks – Basic methods • Non-distributed denial of service attacks Advanced Network Security Lecture 17 Page 2 Denial of Service Attacks • Unlike other forms of hacking, the goal isn’t access • Or theft of information or services • The goal is to stop your service from operating – To deny service to legitimate users • Generally temporarily – Usually during duration of attack Advanced Network Security Lecture 17 Page 3 Attacker Motivations • • • • • Sometimes extortion Sometimes political in nature Sometimes personal feuds Sometimes as distractions Many other possible motivations Advanced Network Security Lecture 17 Page 4 How Can Service Be Denied? • Lots of ways – Crash your machine – Crash routers on the path to your machine – Fool a protocol into behaving badly – Use up a key machine resource – Use up a key network resource • Using up resources is the most common approach Advanced Network Security Lecture 17 Page 5 • • • • What Resources Can Be Used Up? Network bandwidth Processing power RAM Network stack resources – E.g., records of open connections • Operating system or application resources – E.g., entries in a hash table Advanced Network Security Lecture 17 Page 6 Simple Denial of Service Attacks • One machine tries to overload another machine • E.g., send more packets than the target can handle • There is a fundamental problem for the attacker: – The attack machine must be “more powerful” than the target machine – Otherwise, the attack machine can’t generate enough packets • The target machine might be a powerful server • Can one typical client machine generate enough work to overcome a powerful server? Lecture 17 Advanced Network Security Page 7 A Flooding Attack Advanced Network Security But does it actually deny service here? Lecture 17 Page 8 The Problem With This Attack • The attacking computer is usually a home machine or office workstation • Maybe it’s got outgoing bandwidth of 10Mbps • The target is usually a server • Maybe it’s got incoming bandwidth of 1 Gbps • The target barely notices the attack Advanced Network Security Lecture 17 Page 9 “Solving” This Problem • How can an attacker overwhelm a machine with more resources than his? • Two possibilities: – Find a way to make the target pay more per message than the attacker – Use more than one machine to attack Advanced Network Security Lecture 17 Page 10 Solution 1: Make The Target Pay More • Usually the attacker’s limited resource is bandwidth – Sometimes processor power • Try to attack some other resource – Using small amount of bandwidth to use a lot of this resource • Another option: a reflector attack Advanced Network Security Lecture 17 Page 11 Denial of Service and Asymmetry • Sometimes generating a request is cheaper than formulating a response • If so, one attack machine can generate a lot of requests • And effectively multiply its power • E.g., send random garbage packets to a machine expecting encrypted packets • Not always possible to achieve this asymmetry • But often can be done Advanced Network Security Lecture 17 Page 12 An Example: SYN Flood • TCP is connection-oriented • Endpoints must keep information about current TCP connections – To detect packet loss – For flow control and congestion management So attack this • Typically kept in a table table, not the bandwidth! • Of fixed size . . . Advanced Network Security Lecture 17 Page 13 The TCP Open Connection Table • Designed to support many TCP connections at a time – E.g., for high volume web server • One entry per connection • Reuse an entry once the connection ends • Some legitimate connections will be slow – So must not discard seemingly inactive connection too soon • But some legitimate connections will be dropped – Eventually get rid of unused open connection Advanced Network Security Lecture 17 Page 14 The Basic Attack • Attacker uses initial request/response to start TCP sessions • Then he abandons them • Target keeps them open for a while • Filling up the server’s open connection table • Preventing new real TCP sessions Advanced Network Security Lecture 17 Page 15 Why Is This Better Than Simple Flooding? • You can reserve a connection table slot with one short message • The slot will be used for a significant period of time – Even if you never make progress • Provides attacker with good asymmetry Advanced Network Security Lecture 17 Page 16 Normal SYN Behavior SYN SYN/ACK ACK Table of open TCP connections Advanced Network Security Lecture 17 Page 17 A SYN Flood SYN SYN SYN/ACK Server can’t Table of open TCP fill request! connections Advanced Network Security Lecture 17 Page 18 Why Doesn’t the Attacker Send an ACK? • The attacker could send the second message (the ACK) – Then send no more messages • Why wouldn’t he do that? • Two reasons: – Can you figure out what they are? Advanced Network Security Lecture 17 Page 19 How To Defend? • Don’t let the attacker take too many open connection slots – Maybe restrict to three or four per IP address • Doesn’t help if attacker has a lot of machines • Doesn’t help if attacker spoofs IP address Advanced Network Security Lecture 17 Page 20 Another Defensive Option • Drop unused connections more aggressively – So half-open connections don’t waste the resource as long • Bad impact for slow legitimate clients • Only requires slight speed-up by attacker Advanced Network Security Lecture 17 Page 21 A Third Defensive Option • Preferred clients • Save most of your slots for their known good IP addresses • If attacker uses up the rest, doesn’t impact your core clients • Often not an option • Problematic in face of IP spoofing Advanced Network Security Lecture 17 Page 22 A Fourth Defensive Option • Increase the attacker’s cost • Make him pay something for getting the open connection table entry • If the cost is high enough, he can’t afford to fill my table • What “currency” can we make him pay in, though? Advanced Network Security Lecture 17 Page 23 Some Constraints on This Option • We can’t change the TCP protocol – A common theme when trying to protect the Internet – You can never change a widely deployed protocol • We can’t expect users to change the software on their machines • We can’t save information about connection requests Advanced Network Security Lecture 17 Page 24 And no changes to TCP protocol itself KEY POINT: Server doesn’t need to save Client IP address cookie value! SYN Cookies SYN/ACK number is secret function of various information & port, server’s IP address and port, and a timer No room in the table, so send back a SYN cookie, instead Server recalculates cookie to determine if proper response Advanced Network Security Lecture 17 Page 25 Good Aspects of This Approach • Doesn’t change TCP protocol • Doesn’t require clients to do anything they would not usually do • Doesn’t require server to save any information • Can be turned on and off easily • We would like many network security solutions to be like this one Advanced Network Security Lecture 17 Page 26 General Single Machine Denial of Service • Usually dangerous only if there is an asymmetry in resource use • Usually easy to defeat if you figure out what site is doing it – Just drop all packets from that site • Not typically a major threat on the Internet Advanced Network Security Lecture 17 Page 27 Denial of Service as a Distraction • Attackers sometimes perform denial of service attacks just to distract • Sysadmins will be occupied dealing with them • While attackers do their real work somewhere else • As defender, be aware that this could happen Advanced Network Security Lecture 17 Page 28 Conclusion • Denial of service attacks availability – Sometimes used for other purposes • Most often based on exhausting a resource at the victim – Any resource is a possible target • Defense mechanisms must operate well with ordinary behaviors Advanced Network Security Lecture 17 Page 29