Network Security in NKN - Fourth Annual NKN Workshop 2015,...

Network Security in NKN

AGENDA

► DDOS—What Is It?► Examples of DDOS► Co-lateral Damage► Origin of BOTNETs► How BOTNETs are Created► BOTNET Uses► BOTNET Mitigation Options

National Knowledge Network

► DDOS—What Is It?► Examples of DDOS► Co-lateral Damage► Origin of BOTNETs► How BOTNETs are Created► BOTNET Uses► BOTNET Mitigation Options

Zombies

Customer’s Premises:

Server/FW/Switch/Router

Denial of Service and ISPs


Hacker

Control TrafficAttack Traffic

Masters

Victim(Web Server)

Flooded PipeISP Edge Router

Drinking From The Fire Hose

Slide Courtesy of

DDoS Step 1: Crack Handlers and Agents

Attacker

Innocent Handler

Innocent Agents


► Crack a huge number ofinnocent but unprotectedhosts…► Using well known

vulnerabilities► Manually or through use of

automated tools

InnocentHandler

InnocentAgents

DDoS Step 2: Install Trojan & CovertCommunication Channel

Attacker

Innocent Handler

Innocent Agents


► Use FTP handler and agentprograms on all cracked hosts

► Create a hierarchical covertchannel using innocent lookingICMP packets whose payloadcontains DDOS commands; someDDOS further encrypt thepayload...

InnocentHandler

InnocentAgents

Attacker

Innocent Handler

Innocent Agents

DDoS Step 3: Launch the Attack

Attack AliceNOW !


InnocentHandler

InnocentAgents

Victim

A

Attack AliceNOW !

Peering Link

Zombies onInnocent

Computers

Distributed Denial of Service


ISP BackboneAS 24

EnterpriseISP Edge

Slide Courtesy of

SYN Attack

B A CMasquerading as B

A Allocates Kernel Resource forHandling the Starting Connection


Denial of ServicesKernel Resources Exhausted

A Allocates Kernel Resource forHandling the Starting Connection

No Answer From B…120 Sec Timeout

Free the Resource

syn rqst

synackClient Server

TCP SYN Flood


syn rqst

synackVictim

Waiting BufferOverflowsZombies

One of the first CERT DDoS advisories issued – 9/1996► http://www.cert.org/advisories/CA-1996-21.html

Spoofed

TCPLocal Address Remote Address State-------------------- -------------------- -------*.* *.* IDLE*.sunrpc *.* LISTEN*.ftp *.* LISTEN*.telnet *.* LISTEN*.finger *.* LISTENtarget.telnet 10.10.10.11.41508 SYN_RCVDtarget.telnet 10.10.10.12.41508 SYN_RCVDtarget.telnet 10.10.10.13.41508 SYN_RCVDtarget.telnet 10.10.10.14.41508 SYN_RCVDtarget.telnet 10.10.10.10.41508 SYN_RCVDtarget.telnet 10.10.10.15.41508 SYN_RCVDtarget.telnet 10.10.10.16.41508 SYN_RCVDtarget.telnet 10.10.10.17.41508 SYN_RCVDtarget.telnet 10.10.10.18.41508 SYN_RCVDtarget.telnet 10.10.10.19.41508 SYN_RCVDtarget.telnet 10.10.10.20.41508 SYN_RCVD*.* *.* IDLE

TCP SYN Flood

Result ofnetstat -a

On TargetHost

National Knowledge NetworkOnce the Connection Queue Is Full of Waiting-to-Be-Completed Connections,

No More Connections Can Be Accepted on the Target Port

TCPLocal Address Remote Address State-------------------- -------------------- -------*.* *.* IDLE*.sunrpc *.* LISTEN*.ftp *.* LISTEN*.telnet *.* LISTEN*.finger *.* LISTENtarget.telnet 10.10.10.11.41508 SYN_RCVDtarget.telnet 10.10.10.12.41508 SYN_RCVDtarget.telnet 10.10.10.13.41508 SYN_RCVDtarget.telnet 10.10.10.14.41508 SYN_RCVDtarget.telnet 10.10.10.10.41508 SYN_RCVDtarget.telnet 10.10.10.15.41508 SYN_RCVDtarget.telnet 10.10.10.16.41508 SYN_RCVDtarget.telnet 10.10.10.17.41508 SYN_RCVDtarget.telnet 10.10.10.18.41508 SYN_RCVDtarget.telnet 10.10.10.19.41508 SYN_RCVDtarget.telnet 10.10.10.20.41508 SYN_RCVD*.* *.* IDLE

Result ofnetstat -a

On TargetHost

Internet

Peering Edge

Core

DDoS MitigationDevice

Netflow/SNMPVia DCN

CleaningCentre GW

1. NKN Member InstituteManaged Object

(MO) configured inCP.

Cleaning Center Design

DDoS CollectorDevice


0. Pre-setup

Provider Edge RegionalScrubbing Centre

Customer Server

NKN Member Institute

Internet

Peering Edge

Core



Netflow/SNMPVia DCN

CleaningCentre GW

2. Traffic destined toNKN Member

Institute server vianormal route.


1. PeaceTime


Customer Server

CleaningCentre GW


Internet

Peering Edge

Core



Netflow/SNMPVia DCN

CleaningCentre GW

3. NKN MemberInstitute Serveris under DDOS

attack!


2. Attack Starts


Customer Server

CleaningCentre GW


Attack Traffic

Internet

Peering Edge

Core



Netflow/SNMPVia DCN

CleaningCentre GW

4. DDoS CP/FS detectsanomaly via Netflow.


DDOS Systemdetects anomaly


Customer Server

CleaningCentre GW

NKN Member Edge

Attack Traffic

Internet

Peering Edge

Core



Netflow/SNMPVia DCN

CleaningCentre GW

5. TMS makes more specificroute announcement to CCGW

6. CCGW sendsiBGP update

7. Traffic DiversionTo scrubbing centre

Attack Traffic


4. DDoS System drawsroutes to Cleaning Centre


Customer Server

CleaningCentre GW


5. TMS makes more specificroute announcement to CCGW

Internet

Peering Edge

Core



Netflow/SNMPVia DCN

CleaningCentre GW

Attack Traffic

Clean Traffic8. TMS scrubs traffic

and sends clean trafficto CCGW.


5. DDoS System scrubsand re-injects clean traffic


Customer Server


8. TMS scrubs trafficand sends clean traffic

to CCGW.

Internet

Peering Edge

Core



CleaningCentre GW

9. DDoS CP/FS detectsattack has subsided,

stops mitigation.

10. TMS withdraws route

11. CCGW sendsiBGP update

12. Traffic destined toNKN Member

Institute server vianormal route again.


6. Attack stops


Customer Server

CleaningCentre GW


10. TMS withdraws route12. Traffic destined toNKN Member

Institute server vianormal route again.

DATA FLOW


Thank You

WWW.NKN.IN


Thank You

Network Security in NKN - Fourth Annual NKN Workshop 2015,...

Documents

Transcript of Network Security in NKN - Fourth Annual NKN Workshop 2015,...