DDoS Attacks: Best Practices for Prevention and Response

https://insights.sei.cmu.edu/sei_blog/2016/11/distributed-denial-of-service-attacks-four-best-practices-for-prevention-and-response.html

by kungfudoi • 10 years ago

193 70 10 years ago

insights.sei.cmu.edu

lima• 10 years ago

Google cache: http://webcache.googleusercontent.com/search?q=cache:https:/...

hamilyon2• 10 years ago

Does anyone else notice irony.

stcredzero• 10 years ago

I've heard rumors of such a word.

barking• 10 years ago

Nice to see an accurate use of the word, it's becoming a rarity.

user5994461• 10 years ago

All I notice is a case of "leading by example".

dgacmu• 10 years ago

If you'd like more: I'm a professor at CMU, and my office is currently offline because someone decided to throw 5gbit/sec at my machine starting last Thursday. CMU's response - which I can't really fault, given that my office is not geo-distributed - was to filter inbound traffic at our upstream provider. No Internet for me; I'm back on the wifi. :)

dogma1138• 10 years ago

They might want to consider implementing a few of those controls.

CiPHPerCoder• 10 years ago

Sadly, just because you know what the best practices are doesn't mean your university's IT department will let you implement them.

Same can often be said if you replace "university" with "company".

Internal political problems are beyond NP-hard.

seanwilson• 10 years ago

Sadly, just because you know what the best practices are doesn't mean your university's IT department will let you implement them.

The common saying is "the cobbler's children have no shoes".

Demcox• 10 years ago

Oh the irony....

AndrewStephens• 10 years ago

Well I finally got the article on DDoS attacks to load (I haven't been this put out since it raaaained on my wedding day). I didn't find it particularly illuminating.

Deploy appropriate hardware that can handle known attack types and use the options that are in the hardware that would protect network resources...
If affordable, scale up network bandwidth...
There are several large providers that specialize in scaling infrastructure to respond to attacks...

This advice all seems rather obvious.

sriehl• 10 years ago

archive.is link with all formatting: https://archive.is/ASz1w

AgentK203• 10 years ago

Unfortunately, all of these "Best Practices" are "spend more money," which effectively means the attacker wins. They're forcing you to spend more money, even if they're not attacking you now/recently. Would love to see more things that reference open source mitigation software and such like that, e.g. tossing a hardened nginx in front of your Tomcat server, stuff like that.

Granted, at some point, you're going to have to spend money to mitigate the attack no matter what, but if mitigation of DDoSs becomes entirely focused on "Go with a big centralized provider" or "Spend lots of money to mitigate the attacks," we end up in a much different Internet.

dorianm3• 10 years ago

Cloudflare is free, so there is that :)

Thaxll• 10 years ago

Cloudflare only works for http/https.

jaawn• 10 years ago

Whoah, I did not know they had a free plan for personal use. Thanks for the tip!

AgentK203• 10 years ago

True, and while Cloudflare is a great company, putting all our eggs in one basket isn't particularly wise. Not saying that this'll happen, but we've seen "great companies" that were great while there was strong competition, but eventually when they became the monopoly began to strangle out anything that they were against. Protection providers like Cloudflare would have enormous power to simply kick out a user for being "too costly to host," like Akamai did to KrebsOnSecurity, and then you'd get destroyed by attacks.

lossolo2• 10 years ago

They will direct traffic to your site on ddos if it will affect their infrastructure in free plan. And this will not protect you from level7 ddos.

erikb3• 10 years ago

Not really spend more money necessarily. Using dedicated hardware with prevention technology built in, making sure your servers are spread around the planet, all that sounds more like having a better architecture than necessarily spending more money.

AgentK203• 10 years ago

True, but there are certain scenarios (think gaming, VoIP, etc) where you can't really decentralize in the way that traditional websites can. On top of that, many lower-tier websites and service companies have to use budget hosts simply by the nature of them being an initial startup. Unless we're talking SV startups, it's much more difficult to throw big money around when you're just starting out to get that kind of dedicated hardware protection.

0xmohit• 10 years ago

I'm not so sure if the best practices for prevention would be of any good.

nailer• 10 years ago

15 years ago: wow DDoS attacks are a thing. ISPs need to implement egress filtering.

Now: wow DDoS attacks are still a thing. ISPs need to implement egress filtering.

A consumer internet user who visits baidu doesn't need to be flooding an anti-censorship project's github page.

A consumer internet user with an internet-of-shit camera doesn't need to be hitting dyn that frequently.

ISPs need to coordinate and rate limit customers towards something that looks like reasonable traffic.

erikb3• 10 years ago

Do you know that there are people who actively fight against ISPs filtering the internet?

marcosdumay• 10 years ago

What kinds of filtering are they fighting?

Because null-routing malformed packets, for example, is completely different from null-routing the port of a service the ISP don't want. What is again, completely different from null-routing bittorrent.

citrin_ru• 10 years ago

People usually fight against filtering which limit legitimate usage (like filtering port 80 to prevent hosting web-site at home). I doubt that anybody fight against RFC2827, but there are still many ISP which don't implement this.

hueving• 10 years ago

These points are so high level and obvious that this is basically useless:

Locate servers in different data centers.
Ensure that data centers are located on different networks.
Ensure that data centers have diverse paths.
Ensure that the data centers, or the networks that the data centers are connected to, have no notable bottlenecks or single points of failure.

Getting Robbed: Best practices for Prevention and Response

* Don't carry all of your money with you at all times.

* Don't advertise that you're carrying large sums of money.

* Have enough money that getting robbed doesn't really affect you.

* Pay someone else to do your errands so you're not at risk.

erikb3• 10 years ago

Not really getting your point. All but "having enough money" are actually good advice to not getting robbed. E.g. if carry around a golden Rolex and/or the newest iPhone you are much more likely to get robbed than if you have no watch and a $150 Android device in your hand. And most people don't carry around all their money for exactly the reason to not lose too much.

haimez• 10 years ago

Except UNLIKE the Rolex analogy, the recommendation is not "do not carry your role" it is more akin too "do not own a Rolex". Or more directly, "avoid the problem by not having enough resources to own a Rolex".

TeMPOraL2• 10 years ago

I suppose anything more specific - both in case of DDoS and robbery prevention - would require a person/organization specific analysis that takes into account what you want to protect, what resources you have at your disposal and what threat model you operate under.

I would love a link to some resources about how to do such analysis. Maybe someone here knows a good one?

gbuk20136• 10 years ago

I work for a DDoS protection company and while the advice in the article is indeed high level, it is exactly what we do.

  - buy a ton of network capacity in multiple locations around the world
  - route incoming traffic to different locations at BGP level

This is really the only way to reliably cope with modern volumetric attacks right now.

On top of that we:

  - scrub the traffic using using some expensive fancy appliances(*)
  - employ a bunch of very skilled people to manage it all and provide support

This is what you need to protect against protocol / application level attacks.

* which we get a very good deal on by virtue of making said appliances :)

brownbat2• 10 years ago

In some ongoing DDoS attacks, I've heard companies say they're dedicating more resources to combatting the problem.

Is active mitigation mainly about sifting through incoming traffic, trying to find signatures and update filters in realtime? Or more replacing dynamic with static content as its targeted? Or are there other ways resources get surged during a crisis?

ie, Is it heavy on manual analysis, or are we at the point yet where we can automate mitigation?

Just curious. Would recommend an AMA, but that's not this site.

bogomipz5• 10 years ago

"buy a ton of network capacity in multiple locations around the world"

There are estimates that the Dyn attack was 1.2Tbps. What provider do you work for that can absorb that?

"scrub the traffic using using some expensive fancy appliances(*)"

Does scrubbing work with a bunch of randomized source ports and source address? How do you find the "signature" in that to scrub? It was my understanding that the traffic in the Dyn attacks was indistinguishable from legitimate traffic. Can you explain how traffic scrubbing works in such scenarios? Or do you just drop stuff on the floor?

Kephael2• 10 years ago

These points are so high level and obvious that this is basically useless:

In general, this has been my perception of the majority of "software engineering" research which I've encountered.

paulddraper• 10 years ago

Your advice about robbery seems pretty solid.

Out of curiosity, what would you recommend differently? Carrying a weapon and engaging in combat?

criddell2• 10 years ago

This is offtopic, but did CMU ever face any consequences for their attack on Tor a year or two ago?

tomschlick2• 10 years ago

Why would they? From what I remember (helping to de-anonymize users) they didn't do anything illegal...

criddell2• 10 years ago

University studies often have to meet an ethical as well as legal standard.

lossolo2• 10 years ago

As someone that experienced DDoS which made whole leaseweb feel it (site i was operating was on servers in leaseweb), I can tell you one thing.. Unless you are ddosed by someone from their home connection or one server you need professional DDOS protection. No guide will help you here, you probably don't have the pipe big enough in case of UDP flood and don't have enough resources in case of sophisticated TCP attacks.

If you only want to protect your website then go for cloudflare pro, it will be enough for 95% of ddosers. If cloudflare is not enough then you need thousands or ten of thousands of dollars to get protection.

dx0343• 10 years ago

Do you know if anyone has ever been kicked from cloudflare pro because the attack was too large?

I'd guess that they're one of the largest companies providing DDos defenses. I'd guess if they can't handle it there aren't many more that could. But don't know if that has ever happened.

jester23947• 10 years ago

So how do you prevent volumetric attack?

Kephael2• 10 years ago

You must have excess bandwidth in order to absorb the flood or your upstream transit provider(s) need to filter the attack.

based2• 10 years ago

https://tools.ietf.org/html/rfc2827

http://www.bcp38.info/index.php/Main_Page

cft• 10 years ago

I was hoping that ipv6 would help with the attacks from non-spoofed IPs: each DDoS participating device would get a permanent sticky IP address, and there would be a global list of blacklisted IP addresses maintened by a neutral organization, such that these IPs would get null routed by transit carriers.

jlgaddis2• 10 years ago

The routing tables would fill up very, very quickly.

Not to mention that IPv6 doesn't really help solve the "ISPs aren't dropping invalid packets as they are received" problem.

velox_io• 10 years ago

So are there any ways to mitigate a DDoS attack, aside from throwing money at it by buying a large pipe? Null routing/ taking the site offline doesn't sound like a solution.

assafridman• 10 years ago

Spread over several servers in several continents , limit each server to serve its own region and use geo located dns

if you dont want to waste money on the server, just use incapsula

IHG• 10 years ago

Make sure you understand your infrastructure and web deployment. Lock this down as tightly as possible. Use a 3rd part to protect your web infrastructure such as Incapula

breaker9691• 10 years ago

the best way to prevent the ddos attack is using money, there're nothing you can do more than money can.

andhix• 10 years ago

I have no idea, still learning about ddos attack and how to protect from it. Just call ddos expert, i thought.

DDoS Attacks: Best Practices for Prevention and Response

Related Stories