Reflected Attacks Abusing Honeypots - Masaryk University · 2013-11-22 · Reflected Attacks...
1
Reflected Attacks Abusing Honeypots Martin Hus´ ak Martin Vizv´ ary Institute of Computer Science Institute of Computer Science Masaryk University Masaryk University Brno, Czech Republic Brno, Czech Republic [email protected] [email protected] We present the observation of a distributed reflected denial-of-service attack abusing honeypots as reflectors. This type of at- tack was observed during massive attacks against internet infrastructure of Czech Re- public in March, 2013. Explanatory notes to the attack schema: 1 Target network is under attack! The flooding traffic is reflected so the victim suspects the random network hosts that were abused as reflectors while the at- tacker is hiding. 2 Random hosts are abused as reflectors to bounce off the flooding traffic. 3 Honeypots are abused as reflectors too, but due to their settings they respond to any incoming packet and reflects almost all the flooding traffic. Possible response to incoming SYN packet is to drop it or respond with ei- ther SYN+ACK or RST. Honeypots are most likely to respond with SYN+ACK on any port to attract the attackers. 4 Attacker controls the botnet and sends commands to start the attack. 5 Botnet is a network of zombies controled by the attacker that generates the flood- ing traffic. DDoS Attacks Against Czech Republic in March 2013 • Attack period: March 4 – 7, 2013, in working hours • Attack type: Brute-force attack using randomly spoofed source IP address with fluctuating rate (see taxonomy [2]) with volume up to 1 Gbps [1] • SYN flood attack on Monday and Tuesday • Reflected SYN flood attack on Wednesday and Thursday • CESNET, the Czech NREN, recorded high number of ac- cepted TCP connections on random ports • 68 % of connections (approximately 1.5 million packets per 5 minutes) were accepted and responded to with SYN+ACK • Hosts in the network of Masaryk University (including honey- pots) reflected approximately 5% of incoming packets • Honeypots in the network of Masaryk University reflected 16 % of incoming packets • Honeypots from another Czech university reflected 93 % of incoming packets Conclusions There is a risk in using honeypots. We still see the benefits of deploying honeypots but we advice against them being as open as possible. Honeypots are capable of reporting false positives although they were believed to be free of it. We present lessons learned in area of both honeypots and handling of security incidents. Our conclusions are supported by the observation and analysis of real high-scale reflected DDoS attacks. Overall information sharing needs to be revised to replace observed ad-hoc solutions. There is still room for improvement in communication and data sharing associated with mitigation of attacks. Acknowledgements This work has been supported by the project “Cybernetic Proving Ground” (VG20132015103) funded by the Ministry of the Interior of the Czech Republic. References [1] Pavel Baˇ sta. DDoS - lessons learned - technical aspects. http://www.afcea.cz/img/clanky_next/ ITTE/Basta_DDOS.pdf, 2013. [2] Jelena Mirkovic and Peter Reiher. A taxonomy of DDoS attack and DDoS defense mechanisms. SIGCOMM Comput. Commun. Rev., 34(2):39–53, April 2004.
Transcript of Reflected Attacks Abusing Honeypots - Masaryk University · 2013-11-22 · Reflected Attacks...
Reflected Attacks Abusing Honeypots
Martin Husak Martin Vizvary
Institute of Computer Science Institute of Computer ScienceMasaryk University Masaryk University
Brno, Czech Republic Brno, Czech [email protected] [email protected]
We present the observation of a distributedreflected denial-of-service attack abusinghoneypots as reflectors. This type of at-tack was observed during massive attacksagainst internet infrastructure of Czech Re-public in March, 2013.
Explanatory notes to the attack schema:
1 Target network is under attack! Theflooding traffic is reflected so the victimsuspects the random network hosts thatwere abused as reflectors while the at-tacker is hiding.
2 Random hosts are abused as reflectors tobounce off the flooding traffic.
3 Honeypots are abused as reflectors too,but due to their settings they respond toany incoming packet and reflects almostall the flooding traffic.
Possible response to incoming SYNpacket is to drop it or respond with ei-ther SYN+ACK or RST. Honeypots are
most likely to respond with SYN+ACKon any port to attract the attackers.
4 Attacker controls the botnet and sendscommands to start the attack.
5 Botnet is a network of zombies controledby the attacker that generates the flood-ing traffic.
DDoS Attacks Against Czech
Republic in March 2013
• Attack period: March 4 – 7, 2013, in working hours
• Attack type: Brute-force attack using randomly spoofedsource IP address with fluctuating rate (see taxonomy [2])with volume up to 1 Gbps [1]
• SYN flood attack on Monday and Tuesday
• Reflected SYN flood attack on Wednesday and Thursday
• CESNET, the Czech NREN, recorded high number of ac-cepted TCP connections on random ports
• 68% of connections (approximately 1.5million packets per5minutes) were accepted and responded to with SYN+ACK
• Hosts in the network of Masaryk University (including honey-pots) reflected approximately 5% of incoming packets
• Honeypots in the network of Masaryk University reflected16% of incoming packets
• Honeypots from another Czech university reflected 93%
of incoming packets
Conclusions
There is a risk in using honeypots. We still see the benefitsof deploying honeypots but we advice against them being asopen as possible.
Honeypots are capable of reporting false positives althoughthey were believed to be free of it.
We present lessons learned in area of both honeypots andhandling of security incidents.
Our conclusions are supported by the observation and analysisof real high-scale reflected DDoS attacks.
Overall information sharing needs to be revised to replaceobserved ad-hoc solutions.
There is still room for improvement in communication anddata sharing associated with mitigation of attacks.
Acknowledgements
This work has been supported by the project “CyberneticProving Ground” (VG20132015103) funded by the Ministryof the Interior of the Czech Republic.
References
[1] Pavel Basta. DDoS - lessons learned - technicalaspects. http://www.afcea.cz/img/clanky_next/
ITTE/Basta_DDOS.pdf, 2013.
[2] Jelena Mirkovic and Peter Reiher. A taxonomy of DDoSattack and DDoS defense mechanisms. SIGCOMM Comput.
Commun. Rev., 34(2):39–53, April 2004.
