What Researchers Are Learning About DDoS Tactics
- 21 January, 2010 02:25
The ability of attackers to dig deeper and wider thanks to the proliferation of botnets was covered in the first article of this series, DDoS Attacks Are Back (and Bigger Than Before). The trend is also covered at length in The Botnet Hunters.
In this article, two IT security practitioners -- one with experience in dealing with DDoS attacks against government systems, the other an expert from the corporate side -- share what they've learned about the targets chosen for DDoS attacks and how to adjust security strategies based on those lessons.
CSOonline conducted Q&As with Jerry Mangiarelli, a security specialist with TD Bank in Canada, and Israeli researcher Gadi Evron.
A corporate security specialist on motives and tactics Jerry Mangiarelli has gained a lot of private-sector perspective on the DDoS threat over the years through his own personal research into botnets. He's a frequent speaker on the subject at such security conferences as EC-Council, SecTor and FSP. Here, he gives examples of what his research says about hacker tactics and motives.
CSO: What was it that shifted your focus so heavily into the area of bot-related DDoS attacks?Mangiarelli: The shift was influenced by my continued interest/research in malware and the application layer. The adversaries' motives that we've witnessed over the years as botnets mesh with the application layer is that there's a lot of return-on-investment (ROI) for them.
Describe what goes into your research in terms of hours spent and tools used.Mangiarelli: I spend a considerable amount of time researching. I like to call it my nightshift after the kids are in bed. I spend the time evaluating tools used by adversaries specifically around the development of Web-based DDoS toolkits.
Based on your research to date, what is most surprising about the firepower behind DDoS attacks?Mangiarelli: What most individuals are unaware of is their ability to utilize Web servers as controllers. The FTP attacks that were launched early 2009 and the mass SQL Injections from 2008 that carried over into 2009 have displayed opportunities to expand on the DDoS armies.
Are you finding such attacks are directed more toward the corporate world or are most politically motivated?Mangiarelli: As I alluded to earlier, adversary motives have changed. Each bot is now created differently with additional modules which are specific to each bot herder's needs or the needs of their customers. We'll continue to see attacks that target both worlds, corporate and political for a long time. This road will never end.
Lessons learned from hacktivism against the state Israeli security researcher Gadi Evron has put in a lot of time examining DDoS attacks against government networks. His cases include the massive attack that hit Estonia a few years ago. At the time, he concluded the attacks were the work of so-called hacktivists rather than people working directly on behalf of enemy governments (Russia, in this case). Here, he explains what corporate IT security pros can learn from attacks against the public sector:
CSO: Based on what you've learned from Estonia and similar incidents, are there any best practices IT security practitioners can glean from the tactics that were used?Gadi Evron: DDoS attacks are not about best practices. They're about either planning (infrastructure and contacts) or mitigation (playing with infrastructure and contacts)
Explain what that entails.Evron: The best thing for companies to do is follow their traffic load and make sure they can take a more serious load. No one can pay for 1000 times their normal traffic, but building in some wiggle room is advisable. Building the network gear and net-facing applications to be able to withstand abuse, or at least not fall under it, is critical. From there, the best thing to do is have more than one uplink, and have a good relationship with the ISPs for mitigation.
From your experience, what are the most-used DDoS techniques of late? We've talked to others who note that botnets have allowed for more ferocious, widespread DDoSes, for example.Evron: I can't speak so much about the specific tricks attackers use, but I can say that their methods don't point to any particular trend. Bottom line: They use whatever works and in that regard, it's either over-load the CPU, the memory, or the load checks in applications, or the traffic or capacity in networking.
Estonia seems to have responded forcefully and successfully to what happened to them. Are you able to talk about some of the things the country did in response to those attacks?Evron: Two things made the difference: incident response and global coordination. On incident response, cooperation and coordination were key, and on global coordination, while it sounds obvious, without the help of others around the world such incident response would not have been possible.
This is the second in a series of articles on the return of DDoS attacks. The first article is DDoS Attacks Are Back (and Bigger Than before). A podcast on the subject is also available: The Long, Strange Evolution of DDoS Attacks.