Open-Source DoS Testing and Defense Presentation.pdf

《Open-Source DoS Testing and Defense Presentation.pdf》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、OpenSourceDoSTestingandDefenseChristianTernus@ternusOSCONJuly23rd,20141/44Who'sThisGuy?▶ChristianTernus▶@ternus▶https://cternus.net▶Sr.SecurityResearcheratAkamai▶IwriteandtestDoSattacks▶amongotherthings...2/44Who'sThisTalkFor?▶Self-hostedsites▶Startups▶StuffonVPSes▶Communitypa

2、ges▶PublicAPIs▶AppAPIs▶etc.3/44DoSAttacksareMakingtheNews4/44JustAskAkamai'sCSO-NewYorkTimesBITS5/44WhatisaDoSAttack?ADoS(DenialofService)attackisanactiontakenbyanadversaryagainstanavailabilitygoal.▶"Mywebsitestaysaccessible"▶"AdminscanSSHtotheprodserver"▶"Peoplecancallcustome

3、rsupport"▶"IhaveWiFi/cellphoneaccess"▶"Employeescanenterthebuilding"▶etc.6/44ThinkLikeanAttackerACME.ly▶Smallwebstartup,twodevs,twoadminpeople,onesysadmin▶Theysellwidgetsonlinethroughafulfillmentservice▶TheyuseaPHP-basedorderingsystemwithSSLonaVPS▶TheyhaveaGoogleVoicecustomers

4、ervicehotlineandafeedbackform▶TheyworkinasmallofficeonthetopfloorofawarehouseHowwouldyouDoStheaveragewebstartup?7/44LotsofDoSVectorsTargetAttackWebsiteGETfloodattackSSHonprodserverSSHconnectionfloodCustomerhotlineMaliciousrobocallsWiFiDisassociatespamCellphonesignalRadiojammer

5、BuildingentrancesFillthelockswithglue8/44NotAllDoSAttacksareCreatedEqual9/44InternetAttacksareEasyandEffective10/44WhenYou'reOutofLuck11/44SometimesMathisNotOnYourSide300Gbps>40Gbps▶BlockattheISP/ASlevel(ifyoucan…)▶Sendthetrafficsomewhereelse(CDN/scrubber/blackhole)▶Giveupandg

6、ohome-NewYorkTimesBITS12/44SoWhatCanYouDo?Mostattacksdon'tmakethenews.Youcanmakeyourselfsaferagainstsmallerattacks(farmorecommon!)13/44ThreeTypesofDoSSymmetricAsymmetricInstantDeath1:11:N1:1GETfloodSSLNegotiationSMBBug14/44DoSAttackPlaybook▶AdversarialTesting▶Filtering▶Rate-Li

7、miting▶Upgrading▶MakingTradeoffs15/44HoldOnaSecondAttackmyself?Areyounuts?16/44Bitethe(DoS)BulletTheonlywaytoknowifyoucantakeapunch…istotakeit.Unfortunately,adversariesdon'tmakeappointments.17/44IfYouDon'tDoItNow,You'llRegretItLaterPrimeDirectiveofTestPlanning:Ifyoufeartesting

8、,yoursystemneedsit.18/44Where'sthe(OpenSource)Beef?19/44Let's