11

With recent DDoS incidents related to wikileaks, I can't help but feel that pretty much all sites online are very vulnerable to such attacks. Visa, MasterCard (to name a few) have shut down because of this.

So my questions are:

  1. Is DDoS such a powerful form of attack?
  2. What can a company do to deal with this situation?

EDIT: I think I might have phrased my question too "n00bishly". I know what a DDoS is (from wikipedia and other sites).

My real question is: Why are those Big companies NOT applying anti-DDOS techniques? Don't tell me that Paypal and MasterCard are not afraid of service down or attacks. I have looked over the cost of some of these solutions, but they don't seem that expensive at all compared to how much Paypal or VISA makes a year. The real question is why are they so unprepared? ( Or is the scale of the DDoS that much bigger than what has been expected?)

4
  • @kamil From that site it doesn't appear to be so expensive. But why isn't VISA or MasterCard or Post Finance employing them? I think that article greatly trivialize the impact of DDOS.
    – disappearedng
    Dec 9, 2010 at 2:53
  • I think that ddos stress exposes inefficiencies in architecture and there are plenty of them hidden in larger systems. I think fourth or fifth ddos attack against visa would have much lower chance of succeeding than the first one. Some companies manage to withstand ddos attacks of various scales.
    – Kamil Szot
    Dec 10, 2010 at 20:56
  • Please see my answer below and follow the link to a fuller answer on IT Security Stack Exchange - Many multinationals are using solutions which work well.
    – Rory Alsop
    Dec 11, 2010 at 16:28
  • If you "know" what DDOS is by reading Wikipedia and the like you really have no knowledge on the subject at all. The entire "question" merely confirms that. Dec 13, 2010 at 10:16

6 Answers 6

7

There is a similar question here:

The challenge with this question is that it asks for a solution to a fundamentally unsolveable problem. There's no tool or practice you can adopt that is going to protect you from a moderately competant attacker who is determined to take down your service.

mod_evasive is about as good a solution as you're going to get to this problem in the short term. It implements "best practices" throttling of requests, and will prevent your system from being taken down by a 5 line Perl script.

In the longer term, when your application becomes successful, you'll inevitably wind up deploying a load balancer in front of it. The mainstream commercial load balancers (like F5's Big-IP) all implement "DOS protection" throttling, so you can turn that feature on when you upgrade. But don't upgrade just to get that feature.

The problem with solving modern DDOS attacks is that they are launched from numerous unrelated unpoints (often, from huge botnets). Web application firewalls like Citrix/NetScaler, Imperva, and F5 will do a decent job with the canned attacks, but skilled analysts (preferably from your own team) are going to be needed to stop "real" attackers who know your name; you do that job by analyzing the attack traffic, finding characteristics in it particular to the attacker, and filtering it.

I think you're on the right track with free "plug-and-play" defenses for this, especially with a new application.

@tqbf

1
  • 1
    Not correct - mitigation vendors exist and do a grand job. I have tested a response from a vendor and an ISP for a global bank and it was remarkably effective. Please see my answer below.
    – Rory Alsop
    Dec 11, 2010 at 16:27
4

They are. The thing about DDoS is its power is inversely proportional to the defender's availability and redundancy strategies. The main problem isn't that DDoS can't be mitigated; it's that much of the web relies on centralized architecture, poor redundancy, and cascading single points of failure.

The original internet protocols were designed with availability and redundancy in mind, providing much more fault tolerance at the expense of trust or synchronization. Look at how DNS, BGP, SMTP, and NNTP were originally designed for perfect illustrations.

Moving back to the web, the primary problems with DDoS attacks are ensuring DNS remains available under heavy load, ensuring server redundancy is sufficient to handle stress at peak capacity, and ensuring individual connections can't take a disproportionately high amount of system resources relative to others.

Mitigation thus becomes a matter of rerouting or blackholing the traffic, spreading the impact over as much hardware as possible, providing non-programmatic mirrors, and other service assurance mechanisms relative to your user community. Much of this is rolled into the concept of highly available services and threat modeling, for anyone interested in the field.

I'll close by pointing out that even more answers exist on Server Fault, for anyone interested in the IT perspective of this problem.

2

Please go over to IT Security Stack Exchange for a good discussion about this and valid ways to do it. There are DDoS mitigation partners who are very good at this - I ran tests to validate one for a global bank and the DDoS mitigation cut in within seconds of the attack commencing and it allowed Business as Usual throughout the entire attack, which we ran at a high load. The answer David gives is exactly how it worked in that instance.

1

Yes, DDoS is probably the most powerful brute-force attack. You can't really do anything about it, as any server will break at some point. You can try and circumvent it, provide different services from different servers, thus only getting partially hit. One of the main problems with DDoS is the first "D": Distributed. In nearly all cases a huge botnet is used, so you can't just go around and ban IPs, as this will result in legitimate costumers getting locked out of the service, as a botnet uses overtaken computers to achieve its damage.

You can deal with it by employing measures, like load balancers, firewalls and others, but you'll never be able to completely prevent it.

1

Answer of the question depends how many botnets attackers have. Maybe we are part of that botnet chain who knows. Do you think that people pay for software all over the world ? you should kidding me.. just search for any software in torrents, whatever you downloaded comes with rootkits that hide itself, even though most powerful antivirus systems are used. If rootkits are used, the attackers may control the victims computer as a bot. Sometimes you do not need any rootkits, any preinstalled software may do the same job. The attackers make profit by selling these botnet for different purposes (e.g., sending spams).

Research community invents some techniques in order to stop the malicious activity or prevent hosts to be a part of botnet (before infection phase), however this is never-ending arms race between hackers and defenders. Keep in mind, internet is an open system, so there is not a final solution yet. Probably there will be never, this is the answer of research never stops.

Cisco has some mitigation techniques, check here

0

I would say it is a very powerful attack if you have enough bots that request the site. You can counter it partially with load balancing, firewall, and other defenses. However, enough bots will also cripple the best defenses.

The main issue i would say is that a 'DOS' is always run against a dns name, not an IP address. Thus if the hoster is going to switch servers or such, the dns name will be under attack even under the new server, no escape ...

Not the answer you're looking for? Browse other questions tagged .