1. What Is DDoS
Take the Spring Festival ticket rush: the moment high-speed rail tickets go on sale, people all over the country send connection requests to the 12306 servers. The 12306 servers then either stop responding or respond slowly to web requests. That constitutes a DDoS attack β through a large number of concurrent requests, the target service is forced to become degraded, or even to shut down.
A DDoS attack achieves its goal by exploiting vulnerabilities on the server, or by consuming system resources (memory, disk, and so on) or application resources (connection tables, and so on) on the server. Botnets are not the only thing that can launch a DDoS attack; specialized DDoS tools can do it too. Compared with DoS attacks, DDoS is mainly about being distributed. A DDoS is often not initiated by a single host but by a large number of hosts at the same time, such as a botnet. This approach simulates normal access requests, which makes defending against DDoS attacks considerably harder. In recent years, as DDoS attack tools have become commoditized and botnets have grown larger and more numerous, many well-known companies have suffered DDoS attacks.
2. Common DDoS Tools
2.1 Hping, PenTBox, and Zarp
- Common features of Hping include network stress testing, firewall testing, and port scanning.
- PenTBox mainly helps security personnel test the security and stability of networks and systems, offering password algorithm tools, network tools (stress testing, overflow attacks), and web security testing tools.
- Zarp is an open-source integrated network attack testing tool written in Python, combining a variety of sniffing and DoS stress-testing capabilities.
2.2 LOIC
LOIC, the Low Orbit Ion Cannon, is one of the most popular DoS attack tools. It was used by the hacker collective Anonymous, popular the previous year, to attack many large companies. Download LOIC: http://sourceforge.net/projects/loic/
2.3 XOIC
XOIC is another good DoS attack tool. It performs DoS attacks against any server based on the port and protocol selected by the user. The XOIC developers also claim that XOIC is more powerful than LOIC above in many respects.
Generally speaking, the tool has three attack modes: the first is called test mode and is very basic; the second is normal DoS attack mode; and the last is a DoS attack mode with HTTP / TCP / UDP / ICMP messages. Download XOIC: http://sourceforge.net/projects/xoic/
2.4 HULK
HULK is another good DoS attack tool; it uses certain other techniques to avoid being detected through the attack. It has a known user-agent list and uses random requests. Download HULK here: http://packetstormsecurity.com/files/112856/HULK-Http-Unbearable-Load-King.html
3 Classification of DDoS Attacks
3.1 FLOOD Attacks
- ICMP FLOOD. ICMP is one of the core protocols of the TCP/IP protocol suite. It is used to send control messages within a TCP/IP network, providing feedback on the various problems that may occur in the communication environment. The attacker uses controlled hosts to send a large number of ICMP/IGMP packets to the target, carrying out a flood attack to consume the target’s bandwidth resources. This method is not common today; the target can simply filter and drop ICMP/IGMP packets at its network boundary, rendering the attack ineffective.
- UDP FLOOD. UDP is a connectionless transport-layer protocol that mainly provides a simple, unreliable information transfer service oriented toward transactions. The attacker sends packets to the target to consume bandwidth resources and achieve the goal. There are two kinds of packets: small UDP packets of 64 bytes, which can increase the pressure on network devices to process packets, causing slow processing and transmission delays β a denial-of-service effect. Large packets are those above 1500 bytes, exceeding the Ethernet maximum transmission unit. Large packets can effectively occupy the transmission bandwidth of the network interface, forcing the target to fragment and reassemble when it receives UDP data, congesting the network and delaying server responses.
- TCP FLOOD. TCP is a connection-oriented, reliable, byte-stream-based transport-layer communication protocol. The attacker sends a large number of TCP connections that fill up the target’s connection table, forcing the target to deny service and thereby achieving the goal.
- SYN FLOOD. Continuously sends connection requests (TCP SYN requests) to the server, at a rate as high as 150 per second. The server is busy dealing with these requests and thus cannot respond to normal users. In addition, the attacker can use randomly forged source addresses. On the one hand, this makes the attack source difficult to trace; on the other hand, the random source addresses also make filtering and blocking the attack very difficult. SYN attacks account for more than one third of DDoS attacks.
- RST FLOOD. This method takes advantage of the fact that a TCP connection is torn down through a four-way handshake of packets carrying the FIN flag. However, if something unexpected happens and the four-way handshake cannot complete, an RST packet is used to force an interruption. An RST attack forcibly interrupts the TCP service between the client and the server by forging TCP packets carrying the RST flag.
- SSL FLOOD. The SSL attack mainly consumes the CPU resources of the target, forcing the target to stop responding. After establishing an SSL connection and handshake, the attacker repeatedly performs the key renegotiation process.
- HTTP FLOOD. The attacker uses a large number of controlled hosts to continuously send large volumes of malicious HTTP requests to a web server, requiring the web server to process them and consuming server resources, so that other users cannot get a response.
3.2 Reflection Attacks
With an ordinary FLOOD attack, the attack source can be located. A reflection attack works by modifying the source IP of packets (usually UDP, ACK, and other packets that require no handshake authentication). First, a large number of packets are sent to controlled hosts, with the destination IP set to a reflector (a server, router, or other network device) and the source IP address set to the target’s IP. The reflector receives the packets, assumes that the target is requesting data, and returns a large amount of data in response, consuming the target’s bandwidth resources.
3.3 Amplification Attacks
The idea of an amplification attack is to send a smaller request packet m and receive a larger response packet M, thereby consuming the target’s bandwidth resources many times over, with an amplification ratio of size(M)/size(m). A common example is the DNS amplification attack: the DNS query request packet the attacker sends is only about 60 bytes, while the response packet returned is as large as 3000 bytes, achieving about 50x amplification. Similarly, there is the NTP amplification attack, which sends time synchronization requests.
3.4 Sockstress Attacks
After the client establishes a connection with the server, Sockstress sets the TCP window size to 0, or to a very small value. The target keeps probing for changes in the client’s TCP window in order to keep the connection alive, consuming its connection table. This achieves the goal of denial of service.
3.5 Slow Attacks
The strategy of a slow attack is to occupy connection resources for a long time, thereby consuming the target’s application resources. POST
4. Prevention Measures
Because DDoS is distributed, it is very difficult to identify the hosts launching the attack from a single characteristic. Defending against DDoS attacks can use several methods in parallel, which gives a better effect. DDoS defense is mainly divided into three parts: DNS, network, and application. Since DNS now mainly relies on third parties, attacks against DNS servers have a very broad impact, so third-party DNS providers usually attach great importance to DDoS attacks and prepare thoroughly. Attacks against the network mainly consume network bandwidth. There is another kind that targets application servers; this kind of attack mainly consumes the server’s CPU, memory, database connections, and other hardware and software resources to achieve its goal.
- CDN
Keeps static pages unaffected. Binding a separate domain in the page and distributing static files through a CDN network may be a good choice. It can significantly increase the number of concurrent requests. If possible, making the home page a static page can significantly improve resistance to DDoS attacks. - Buying bandwidth
Since most DDoS attacks have the characteristics of short duration and high traffic, during the period when a DDoS breaks out you can dynamically purchase a large amount of bandwidth to increase bandwidth and fight the attack. Spending a certain amount of money to avoid damage to the company’s image and to provide continuous service is a fairly cost-effective thing. - Traffic scrubbing
Inspect some information about access requests and selectively serve them by setting filtering conditions. For example, block access from certain IPs. - Load balancing
Distribute different access sources to different servers to enhance service availability. - AnyCast
Anycast is a network addressing and routing method. By using Anycast, a group of hosts providing a particular service can use the same IP address, and at the same time the request packets from the service consumer will be routed by the IP network to the host in this group that is topologically closest. Almost all internet root name servers deploy Anycast. Using Anycast technology can dilute distributed denial-of-service attack traffic: during the Anycast addressing process, traffic is directed to the network-topologically nearest node; in this process the attacker cannot manipulate the attack traffic, so the attack traffic is dispersed and diluted onto the nearest nodes, and the resource consumption on each node is reduced. Because high-defense servers mainly act at the node level, this design can effectively reduce the pressure on high-defense servers.
