myITmicroblog

Some time ago I sent question to EU about DOS/DDOS protection because I believe ISPs could do a bit more to protect us: Dear Sirs, I found you are responsible of creating safe, reliable Internet. As you know most of EU companies already had or they will have problems with hackers. One of the attacks is commonly known as Denial of Service Attack or Distributed Denial of Service Attack (DOS, DDOS). 15 years ago one document was published, knows as Best Current Practice 38 (BCP 38 or RFC 2267). I don't know why it has not been widely implemented by ISPs during last 15 years. They complained it is very time consuming and difficult to manage. Let me explain how it works: - every company or home user has IP address or range of IP addresses allocated by ISP (for example 7.7.7.7) - every edge router is managed by the same ISP who allocates these IP addresses - BCP 38/RFC 2267 says: block any traffic from network (company or home) where source IP is different fro...

I would like to talk about defeating DDOS and scenarios how we can actually use it. Let’s get started ! I’m going to talk about two methods: 1) before you forward any packet, check if you know the return path. If you know, forward the packet, if you don’t – drop it. There are two ways of implementation: strict and loose. First one accepts packets only when the return path is through the interface which is the ingress one. The second one accept any packet if the router has the return path via any interface. As you can see you can’t use this solution for transit or multihomed networks. It should be rather singlehomed, stub network. During DDOS attackers spoof a source IP and the solution will work (packets will be dropped) only for those with invalid source IP addresses. If the source IP is a valid, the packet will be forwarded. 2) edge router checks if the source IP is the one, which is allocated for particular ISP client – this is the best, easiest for single homed ...

Today I would like to talk about one technique that helps to mitigate DOS attack - RTBH. The technique is defined by RFC 5635 (2009) which is updated (and extension) of RFC 3882 (2004). As you see it’s quite old document and today we can find much better tools to mitigate such attacks. It isn’t complex technique, the configuration is very simple and the result of it is to send unwanted traffic to interface Null0 (silently drop) on the edge of your network. As you know, routers can easily route packets rather than analyze them and drop based on ACL entries. When DOS attack starts you can see huge number of packets that need to be processed by your router. Route all of them to the Null0 interface, requires less router resources when you compare with filtering based on access list. The main problem is that the technique is not much granular. You can choose source or destination IP, what means you will discard legitimate traffic too. You can’t block the traffic per flow ...

In my last post I presented my concept how to secure the IoT. I’m aware that it is not a full specification or a guide how to do that. I wanted to start a discussion because I see many weaknesses, which can threaten the overall concept of the IoT. As you probably aware every system and network have vulnerabilities. The question is when we discover them. I assume the same scenario will be with the IoT. It doesn’t matter how strong we will secure the end points. There will be always someone who wants to break our protection. Let’s analyze impact of a DDOS attack on the IoT. Today being under attack means you can lose your money, sometimes your reputation, but I don’t think it can really danger your or someone else life. Now, we are just before a big step, which introduces us into the new era. Imagine situation where everything is ‘connected’, what means, it can be targeted by hackers. If you read my previous post you may remember some examples with a TV or a fridge. For suc...

Today I would like to smash your confidence about the security of your organization. You spent hundreds of dollars or euros on your security devices and you think you are safe. I believe there are many organizations like yours that think the same thing. Once they become victims, they realize they are not as safe as they had thought. Let’s talk about DOS/DDOS attacks. I think most people have some knowledge about them. Today we should not talk only about DOS attacks because the risk of being seriously impacted is very low. Most network devices can easily mitigate such attacks because they come from one source IP address. The situation is different when we receive illegitimate traffic from many IP addresses. There are two possibilities here: we can be flooded by traffic from a real, existing source IP address or addresses; or there is one real source IP, but the packets contain random source IPs, which means you are not able to block them easily. We can distinguish the fol...