(sec306) defending against ddos attacks

Andrew Kiggins, AWS SDM

Jeffrey Lyon, AWS Operations Manager

October 2015

SEC306

Defending Against DDoS Attacks

Useful background

Common attacks

CRIMINALS EXTORT BUSINESSES VIA DDOS ATTACKS

DDOS ATTACKS ARE GETTING MUCH

MORE POWERFUL

MEGA ATTACKS ARE ON THE RISE

MORE POWERFUL

MEGA ATTACKS ARE ON THE RISE

MORE POWERFUL

MEGA ATTACKS ARE ON THE RISETHE NEW NORMAL: 200 – 400 GBPS DDOS ATTACKS

1.04 39

Average size of a DDoS

attack

Source: Arbor Networks

Average duration of

> 10 Gbps attacks

DDoS attacks that

target network and

service

infrastructure

85%Gbps Minutes

Types of DDoS attacks

Volumetric DDoS attacks

Congest networks by flooding them with

more traffic than they are able to handle

(e.g., UDP reflection attacks)

State-exhaustion DDoS attacks

Type of protocol abuse that stresses systems

like firewalls, IPS, or load balancers (e.g.,

TCP SYN flood)

Application-layer DDoS attacks

Less frequently, an attacker will use well-

formed connections to circumvent mitigation

and consume application resources (e.g.,

HTTP GET, DNS query floods)

DDoS attack trends

Volumetric State exhaustion Application layer

65%Volumetric

20%State exhaustion

15%Application layer

DDoS attack trends

SSDP reflection attacks are very

common

Reflection attacks have clear signatures, but

can consume available bandwidth.

65%Volumetric

20%State exhaustion

DDoS attack trends

65%Volumetric

20%State exhaustion

Other common volumetric attacks:

NTP reflection, DNS reflection, Chargen

reflection, SNMP reflection

DDoS attack trends

SYN floods can look like real

connection attempts

And on average, they’re larger in volume.

They can prevent real users from

establishing connections.

65%Volumetric

20%State exhaustion

DDoS attack trends

DNS query floods are real DNS

requests

They can also go on for hours and exhaust

the available resources of the DNS server.

65%Volumetric

20%State exhaustion

DDoS attack trends

DNS query floods are real DNS

requests

They can also go on for hours and exhaust

the available resources of the DNS server.

65%Volumetric

20%State exhaustion

Other common application layer

attacks:

HTTP GET flood, Slowloris

Volumetric: UDP amplification

Volumetric amplification factors

Vector Factor Common Cause

SSDP 30.8 uPnP services exposed to Internet

NTP 556.9 Time servers with monlist enabled

DNS 28 - 54 Open resolvers

Chargen 358.8 Enabled Chargen service

SNMP 6.3 Open SNMP services

Source: US-CERT

DDoS attacks with multiple vectors

Single vector Multi-vector

85%Single vector

15%Multi-vector

Attackers are persistent

UDP/161 –

amplification

UDP/161 –

amplification UDP

fragments

UDP/161 –

amplification UDP

fragments

UDP/1900 –

SSDP reflection

UDP/161 –

amplification UDP

fragments

UDP/1900 –

SSDP reflection

UDP/1900 – SSDP reflection

UDP/161 –

amplification UDP

fragments

UDP/1900 –

SSDP reflection

UDP/123 – NTP reflection

UDP/161 –

amplification UDP

fragments

UDP/1900 –

SSDP reflection

UDP/123 – NTP reflection

6 hours

Mitigations

AWS Shared Responsibility Model

Before DDoS mitigation

Conventional data centerDDoS attack

Conventional DDoS mitigation services

Conventional data center

DDoS attack

Users DDoS mitigation service

Resilient by design

IP ICMP

Resilient by design

IP ICMP

Elastic Load

Balancing

Amazon

CloudFront

Resilient by design

IP ICMP

Elastic Load

Balancing

Amazon

CloudFront

Resilient by design

IP ICMP

Elastic Load

Balancing

Amazon

Route 53

Amazon

CloudFront

Resilient by design

IP ICMP

Elastic Load

Balancing

Amazon

Route 53

Amazon

CloudFront

DDoS mitigation for AWS infrastructure

virtual private cloud

AWS global infrastructure

DDoS attack

DDoS mitigation

CloudFrontRoute 53

Basic hygiene

Examples

• IP

• Checksum

• TCP

• Valid flags

• UDP

• Payload length

• DNS

• Request validation

Packet prioritization

Priority-based traffic shaping

Mitigation: Detection and

traffic engineering

Target identification in shared space

• Each IP set has a

unique combination

Edge location

Distribution Distribution Distribution

unique combination

Edge locationDDoS attack

Distribution Distribution Distribution

unique combination

• Allows target

identification Edge locationDDoS attack

Distribution Distribution

unique combination

• Allows target

identification

• Enables new

options for

mitigation

Edge location

Edge locationDDoS attack

Distribution

Traffic engineering

DDoS attack

Traffic engineering

Mitigate

DDoS attack

Traffic engineering

Isolate

DDoS attack

Traffic engineering

Isolate

Vacate

DDoS attack

Traffic engineering

DisperseDDoS attack

Architecture

Architecting on AWS for DDoS resiliency

Architecture: Volumetric

Why does this matter?

CloudFront – DNS reflection

• Simultaneous DNS reflection and UDP flood

• Automatically discarded by CloudFront

• No impact on CloudFront or CloudFront customers

CloudFront – DNS reflection

• Simultaneous DNS reflection and UDP flood

• Automatically discarded by CloudFront

• No impact on CloudFront or CloudFront customers

Common vector – SSDP

srcPort=

Payload =

HTTP/1.1…

Common vector – NTP

Payload =

MON_GETLIST

srcPort=

Common vector – DNS reflection

srcPort=

response

Larger

payload

Other vectors – RIPv1, Chargen, SNMP

• UDP based

• Reflection

• Amplification

• Unusual sources

• Abnormal payload

ELB Scaling

ELBUsers

Security group

public subnet

Security group

Front-end server

private subnet

Instances

Route 53 health checks on ELB instances

ELBUsers

Security group

instances

Route 53

ELBUsers

Security group

instances

Route 53

ELBUsers

Security group

instances

Route 53

ELBUsers

Security group

instances

Route 53

ELBUsers

Security group

instances

Route 53

ELBUsers

Security group

instances

Route 53

ELBUsers

Security group

instances

Route 53

Minimize the attack surface

Amazon Virtual Private Cloud (VPC)

• Allows you to define a virtual network in your own

logically isolated area on AWS

• Allows you to hide instances from the Internet using

security groups and network access control lists

(NACLs)

Security in your VPC

Security groups• Operate at the instance level (first layer of defense)

• Supports allow rules only

• Stateful, return traffic is automatically allowed

• All rules are evaluated before deciding whether to allow traffic

Network ACLs• Operate at the subnet level (second layer of defense)

• Supports allow and deny rules

• Stateless, return traffic must be explicitly allowed

• Rules are processed in order

Web app

server

DMZ public subnet

bastion

Amazon EC2security group

security group

Front-end private subnet

Amazon EC2

Back-end private subnet

security group

MySQL db

Amazon VPC

Web app

server

DMZ public subnet

bastion

ELBUsers

security group

TCP: 8080

Amazon EC2

TCP: 80/443

security group

TCP: 3306

MySQL db

Amazon VPC

Web app

server

DMZ public subnet

bastion

ELBUsers

Admin Amazon EC2security group

security group

TCP: 8080

Amazon EC2

TCP: 80/443

security group

TCP: 3306

MySQL db

TCP: 22

Amazon VPC

Web app

server

DMZ public subnet

bastion

ELBUsers

Internet

security group

TCP: 8080

Amazon EC2

TCP: 80/443

security group

TCP: 3306

MySQL db

TCP: Outbound

TCP: 22

Amazon VPC

Reference security groups

Reference network ACL

Be ready to scale and absorb

Route 53

• Highly available, scalable DNS service

• Uses anycast routing for low latency

Route 53

• Highly available, scalable DNS service

• Uses anycast routing for low latency

CloudFront

• Improves performance by caching content and

optimizing connections

• Disperses traffic across global edge locations

• DDoS attacks are absorbed close to the source

Elastic Load Balancing

• Fault tolerance for applications

• Automatic scaling

• Multiple Availability Zones

AWS global presence and redundancy

InternetConnection C

InternetConnection A

InternetConnection B

CloudFront

ValidObject Request

InvalidProtocol

InvalidObject Request

Route A

Route B

Route C

instances

Availability Zone

instances

Availability Zone

Route 53 anycast routing

How do I get toexample.com?

.co.uk

This way!

.co.uk

This way!

.co.uk

This way!

.co.uk

This way!

.co.uk

This way!

.co.uk

This way!

.co.uk

This way!

.co.uk

This way!

Architecture: State exhaustion

Why does this matter?

Common vector – SYN flood

Flags=

Cookie

returned

SYN proxy and SYN cookies

Using custom proxies

Security group

public subnet

Security group

Front-end server

private subnet

InstancesDDoS

Architecture: Application layer

Looks can be deceiving

Route 53

• DNS query flood targeting 34 of our edge locations

• Peak volume was in top 4% of all DDoS attacks

• Automatically detected and mitigated with no impact to availability

Route 53

• DNS query flood targeting 34 of our edge locations

• Peak volume was in top 4% of all DDoS attacks

• Automatically detected and mitigated with no impact to availability

Safeguard exposed resources

Resilient architecture

Web app

server

UsersWeb app

server

UsersWeb app

server

Auto Scaling

Web app

server

Security group

Auto Scaling

Front-end servers

private subnet

Web app

server

Security

public subnet

Security group

WAF/proxy

private subnet

ScalingELB

Security

Auto Scaling

Security

Front-end servers

private subnet

Web app

server

Security

public subnet

CloudFront

edge location

Security group

WAF/proxy

private subnet

ScalingELB

Security

Auto Scaling

Security

Front-end servers

private subnet

Web app

server

Under attack?

Help with architecture and mitigation

Resources

• Account manager, solutions architect

• Whitepaper: AWS Best Practices for DDoS

Resiliency

• AWS Security Blog

AWS Support

• Business – Technical assistance by phone, chat,

or email

• Enterprise – Fastest response time. Dedicated

technical account manager (TAM).

Information to provide AWS Support

• Instances (IPs help!), distributions, zones under attack

• Location

• Time

• Vector

• Sources

• Intel

AWS Security Center

To learn more, visit https://aws.amazon.com/security.

Thank you!

Remember to submit

your evaluations

by using the re:Invent app!https://reinvent.awsevents.com/mobile/

Related sessions

• SEC323: Securing Web Applications with AWS WAF; Friday, 9:00–10:00 A.M.

(sec306) defending against ddos attacks

Technology

1.1 operating system concepts defending against ddos attacks...

ddos mitigation support on cgse - cisco...ddos mitigation...

implementing bullet-proof hipaa solutions on aws (sec306) |...

ddos report | 2019 global ddos threat landscape · global...

defending pipeline drug cases handout (00090039.docx;1) ·...

an adaptive approach for defending against ddos attacks ·...

ddos testing services - zencurity.com · ddos testing...

amppot: monitoring and defending against ampli cation ddos...

scalable ddos mitigation · •scalable ddos mitigation...

datasheet: ddos protection - grayhats datasheet ddos...or...

defending against ddos attacks

defending california agencies against ddos attacks...

ddos 방어 계획 수립하기 8가지 모범 사례 ·...

(sec306) turn on cloudtrail: log api activity in your aws...

distributed denial of service...

prolexic ddos analytics & ddos mitigation in real time

a multilevel thrust filtration defending mechanism against...

distributed denial of service (ddos) defending against...

ddos threats landscape : countering large-scale ddos attacks

ddos secure gui user guide - juniper networks - network...