How to stop a service denial attack before it stops you

It's not easy to defend a federal Web server against distributed service denial attacks, but it's not impossible either.

| SPECIAL TO GCNIt's not easy to defend a federal Web server against distributed service denial attacks, but it's not impossible either.For years now, the government has been under the gun in an undeclared cyberwar with hackers around the globe. The simplest and so far the most common attack is denial of service, which keeps a server so busy with fake data traffic that it can't do its real job.A distributed denial-of-service attack pits multiple computers across the Internet against a single target server. Most serious attacks today orchestrate the use of hundreds of machines and take the target server out of commission for the duration of the attack.Site managers are busy searching for ways to defend themselves. It will take a more centralized effort to make a real difference, plus a commitment from Internet service providers to truly put a lid on the monster.The first defensive step is understanding how the game is played.It used to be possible to tell who was sending too much data traffic by examining the data packets. But hackers have taken up IP spoofing, which conceals the address of the originating machine. The Internet, designed to share data openly, is very trusting. Dump a data packet anywhere on the Net, and it will be delivered without prejudice.When a server comes under attack, it's important to recognize the style of attack. Sometimes it's a combination of styles.Captus Networks Corp. of Woodland, Calif., has identified four types of attacks as most common:These four types of attacks involve incoming traffic. At a higher and more serious level, a target server is compromised and used to attack machines elsewhere. It becomes necessary to monitor the server's outgoing traffic, too.Many agencies have installed two basic defenses:Firewalls and intrusion detection systems are reactive measures. They won't stop an attack, and they can shut only part of it down.Bad traffic can be shut down at two points:A traffic-limiting IDS can also reframe data communications between two points by asking the sender to slow down the rate of data acknowledgment. Legitimate servers will do so. Those that don't are deemed untrustworthy, so their packets are then filtered out.This method is mainly effective against what security expert Steve Gibson has dubbed 'script kiddies,' who work within Microsoft Windows and download hacking scripts from the Internet. Such hackers don't know sophisticated methods of concealing their IP addresses.In theory, a traffic-limiting device installed outside the firewall should strip out and redirect bad traffic without becoming a choke point for good traffic. It could also deny inbound data from specified IP addresses, either for a set time or until an attack stops. The denial automatically ends when traffic flow returns to normal.Managers with such systems in place can set thresholds and policies for various triggers, as well as alerts and filters for bad traffic.But this approach won't rid the network of unwanted packets. Only the Internet provider can keep them out. Also, it's nearly impossible for the straight traffic-limiting approach to succeed with heavily spoofed packets because each can arrive with a different fake IP address. The best overall bet is a multilevel approach:XXXSPLITXXX-If you suspect a distributed denial-of-service attack is under way, reconfigure your network for real-time capture of packet traffic, then log the traffic. An intrusion detection system can do this.In a limited data sample, you likely will see either large fragments of improperly formed packets aimed at any server port or large User Datagram Protocol packets aimed at some nonexistent port. You also might see Internet Control Message Protocol debris from large-packet ping commands.It's likely your local router and firewall can discard this garbage, keeping it out of your main Web servers. But the data flood will still block legitimate traffic by using up bandwidth. Your true bandwidth is the limit of what your routers can handle.The best place to filter out bad packets is before they leave the router of your main Internet connection. You should have a 24-hour engineering contact there, and keep the phone numbers handy.A secondary and quicker solution is to install a traffic-limiting intrusion detection system, but it can't be done after an attack has begun.Show the provider your analysis of the attack pattern, then ask for filters to be applied for specific UDP and ICMP traffic shown in your analysis. This should reopen your connection while you work with the provider to try to trace the bad traffic further upstream.The only real way to trace spoofed traffic upstream is to hop from router to router, involving other network administrators. This is a lengthy effort.Generally speaking, distributed service denial attacks die out over time as other sites shut down their compromised servers. The flow gets shut off before traffic can be traced all the way back to the source. XXXSPLITXXX-There's only one sure way of stopping the spread of distributed denial-of-service attacks: Take away hackers' ability to spoof IP addresses.It then becomes possible to trace and shut down the offenders'and to prosecute them.'The processing power of the Internet is distributed, and so is the responsibility,' said security expert Steve Gibson of Gibson Research Corp. of Laguna Hills, Calif. 'Everyone needs to take some.'He supports widespread configuration of routers for so-called egress filtering. If a packet leaving a network doesn't have a proper originating IP address within that network, then the router drops it before it can reach the Internet.Often egress filtering requires adding only one line of code to a router configuration.'If the major Internet service providers took responsibility for traffic egress from their networks, then no one could spoof an IP address from within those networks,' Gibson said. 'Even if a zombie [program] got into one of their customers' machines, it would be limited to the range of addresses in a specific section of a network.'Of course, it's tough to get the entire Internet to cooperate. But Gibson has set up the Spooferino project to push things in that direction.Spooferino is a downloadable software tool that sends a spoofed packet from the user back to Gibson's site, at . From the data returned by Spooferino, Gibson is building a directory of providers that are not blocking spoofed traffic.'It will start a discussion about who does and who doesn't filter,' Gibson said. 'ISPs that do not allow spoofed traffic out on the Internet are taking responsibility. Now look at my list of the ones that are not being good neighbors. Why not? It's certainly easy enough to do the filtering.'He said he hopes for an eventual confrontation. Some parts of the Internet will threaten to close themselves off from the parts that are not trustworthy. That could mean big trouble for heedless providers.Gibson believes they will fall into line to avoid being boycotted by the rest of the Net.Big backbone providers could amend their contracts to say they won't renew bandwidth agreements unless the providers take responsibility for the dirt they're now allowing on the Net.Government agencies can participate in this cleansing effort by requiring egress filtering on their routers.
BY SHAWN P. MCCARTHY













Styles of attack






  • Internet Control Message Protocol flooding. An ICMP ping on a server produces an echo response to confirm the server's presence. When enough pings are sent, the target server can do nothing but respond to the requests.


  • Smurf attack. It appears to originate from the target server's own IP address or somewhere on its network. Targeted correctly, it can flood the network with pings and multiple responses.


  • User Datagram Protocol flood. UDP diagnostic services generate characters that are echoed back from the receiving end to the host. This can swamp the network with useless data.


  • TCP SYN flood. Multiple spoofed requests for Transmission Control Protocol connections force the server to keep ports open, waiting for responses.















Incoming! Be alert for four common raid styles







' Internet Control Message Protocol flooding. Numerous pings overtake a server.

' Smurf attack. This attack method makes it possible for the offending request to masquerade as queries from a user's own server.

' User Datagram Protocol flood. UDP diagnostic services create characters that swamp the network with useless data.

' TCP SYN flood. Multiple spoofed TCP connection requests force the server to keep ports open.

DOS Artwork







  • A firewall where the agency LAN connects to an Internet service provider or other network access point. A firewall can keep hackers out, but it's not good at stopping a distributed service denial attack.


    Many firewalls can be configured to act as packet-filtering routers, which means they strip out bad packets and still let legitimate traffic through. But by the time the bad traffic reaches the firewall, it's already clogging the Internet connection.



  • A network-based intrusion detection system. An IDS is generally set to so-called promiscuous mode so it can see all passing data. It can log improper data or trigger an alarm. A host-based IDS is similar, but set to monitor a single service on a host.


    Both types of intrusion detection systems can be configured to look for specific data signatures or anomalies. They don't react directly to the intrusion, but they can trigger separate filtering systems.


    One disadvantage is that they, like PC antivirus software, must constantly be updated with suspect data signatures.









  • The most effective roadblock is to work with the Internet provider to filter out the flow of bad data, based on analysis of the arriving packets. This is time-consuming but worthwhile because it keeps the network free of unwanted traffic.


  • A quicker but less effective method is to install a traffic-limiting intrusion detection system that looks for unusual or anomalous traffic. It takes advantage of a feature in TCP/IP to confirm whether traffic comes from a nonspoofed source.















Only provider can bar packets




  • A filtering and traffic-limiting device at the agency firewall will limit inbound service-denial traffic. If it does egress filtering, it can prevent agency servers from being used in an attack.


  • A similar setup at the highest bandwidth point will do even more. Large government networks have a slight advantage here because they don't have to count on commercial providers to install such devices.


  • Finally, having two or more gateways will make the agency's network redundant and therefore harder to shut down.



Shawn P. McCarthy designs products for a Web search engine provider. E-mail him at smccarthy@lycos-inc.com.








Apply filters











'Shawn P. McCarthy





Stop outgoing packets









www.grc.com



Shunning some ISPs











'Shawn P. McCarthy
X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.