- Test - lists.nanog.org

Re: A modest proposal
by Vadim Antonov 18 Sep '96

18 Sep '96

Robert E. Seastrom <rs(a)bifrost.seastrom.com> wrote: >Not worth the trouble. The far ends of the earth where not even the >network admins speak English are on the ends of wet strings; it isn't >worth the aggreivation to telnet through them, and launching a >source-routed synflood through them would be self-defeating. Ah. That's changing faster than you think (can you say OC-3 to places like Singapore? Not a pipe dream anymore). And most of us don't speak German either. --vadim

1 0

Re: router syn/syn-ack/ack alarming...
by Vadim Antonov 18 Sep '96

18 Sep '96

Regis Donovan <regisdo(a)microsoft.com> wrote: >um... maybe i'm missing the clue here, but if the router vendors add >something that shuts down an interface if the SYN/SYN-ACK/ACK ratio >becomes too bad make it *easier* for me if i'm doing a denial of service >attack on a host? No, you took the "anti-SYN" shut-off in opposite direction. ISPs could install the asymmetry shut-off (why stop at SYNs / SYN-ACK pairs?) enforcing rough balance of SYNs coming from customer and SYN-ACKs coming back to customer. If the traffic is legitimate, the balance will hold. Any attempt to flood by that customer (intentional, or unintentional, by a broken software) will cause massive disbalance. The equivalent filter on victim's side won't see those SYNs and SYN-ACKs, simply because thet are going in opposite direction. >instead of denying service to a given host, all i have to do is drive >the router into alarm mode so it shuts off the interface and then i get >to deny service to an entire segment and everything downstream from that >segment... Yes, the defense may be multi-staged. I.e. if a local ISP does not enable anti-flooding defenses on its own customer links, it'll risk backbone ISP shutting its entire operation. BTW, telcos use the statistical traffic analysis (bit-density monitors is the most trivial example) to isolate troubles for years. --vadim

1 0

Re: SYN floods
by Leonid Egoshin 18 Sep '96

18 Sep '96

>From: Michael Dillon <michael(a)memra.com> > [Copyrighted text was deleted] Source address checking ... hm-m, pretty idea, but it do not very large help - it is very simple to make login to some public (or not very protected) host and produce SYN flood from legitimate address. At least one day server would be blocked. And after that - force shutdown communication between server and this public host (net) BY SERVER OWNER HANDS ! - Leonid Yegoshin, LY22

1 0

Re: New Denial of Service Attack on Panix
by Leonid Egoshin 17 Sep '96

17 Sep '96

>From: "Forrest W. Christian" <forrestc(a)iMach.com> > > 5 minute SYNS: 123423 5 minute SYN-ACKS: 50000 > >Then, if the ratio got too high, it can start yelping about "Potential SYN >D-O-S Atttack in progress on Interface Serial 1" I suggest to check not only ratio (assymetric routing !), but high number of SYNs to single host. - Leonid Yegoshin, LY22

1 0

Re: New Denial of Service Attack on Panix
by Kent W. England 17 Sep '96

17 Sep '96

At 11:02 AM 9/17/96 -0400, Guy T Almes wrote: >Nathan, > I'm afraid that Kent is right about this one. > I wish that it were not so, but after reading the clever and insightful approaches to tracking down the denial-of-service perps, I am pessimistic about our ability to stay ahead in the escalation of this counter-counter- measure warfare. I think that if we were able to trace the Panix attacker that a future attacker would hit simultaneously from a half-dozen free dial-up connections with a real random number generator and synthetic SYNs to fool the router stat collector (or whatever it takes). I think we are on the short end of the technology stick here. If the fit hits the shan and the attacks begin to escalate, we need to be ready to cooperate on source address filtering at the periphery. It's one of those cases of hang together or hang separately. Should we wait, like the cell phone industry did with the cloning fiasco, until this gives us a black eye? It's just too inviting to expect that we don't have plenty of folks out there ready to pull this trigger on us. We need a general consensus in order for any one of us to justify the effort required to install source address filters. That means that representatives from major backbone ISPs must announce that they will install filters (not at the MAEs) in response to this new threat and that they expect that their peers will too. I'm not one of those major backbone ISP network engineers, but I would hope that for the sake of all of us, that those who are will roll their eyes heavenward, take a deep breath, and do what needs to be done. I know it's easy for me to say, but nevertheless ... This is an excellent example of what the NANOG and IEPG are really good for. --Kent

2 1

Re: SYN floods
by Kent W. England 17 Sep '96

17 Sep '96

At 10:47 AM 9/17/96 -0700, Michael Dillon wrote: >Some part of the discussion involves the technical details of hardening OS >kernels as well as a couple of alternate solutions for defending against >the attacks involving either a SYN proxy or a machine feeding RST's. These >technical details belong on the firewalls list because the people on that >list work with building DEFENSIVE mechanisms. Except that what we need are routers implementing traffic filtering on ISP input ports rather than firewalls defending customer premises from attacks coming from the ISPs. I think we are dealing with two different markets and two different groups of people. I don't think that ISPs will protect themselves from this denial of service attack with firewalls. This is a router requirement. > >inet-access and other ISP mailing lists are most relevant for the >PREVENTION of SYN flood attacks. This is where we need to hammer home the >need for filtering outgoing routes. Filtering incoming traffic against legitimate source addresses. The most important point is that if we all decide that defense and tracing are of limited utility and that filtering is the only way to stop these attacks, then we need a few people who read the nanog and iepg lists to stand up and say "I will filter and I expect you to do the same if you want to peer with me." Otherwise, it will be difficult for any single ISP to justify being the first to install peripheral filtering. We must have a consensus to move on this issue. Call it "peer pressure". :-) --Kent

3 2

Re: New Denial of Service Attack on Panix
by Paul Ferguson 17 Sep '96

17 Sep '96

I would personally like to see this topic added as an agenda item at the upcoming Ann Arbor NANOG meeting. At least a brief discussion of conventional wisdom (filter on valid source prefixes at periphery, etc.) should be in order. - paul At 04:14 PM 9/16/96 -0700, Kent W. England wrote: >Dear NANOG/IEPG Folks; > >As you should know by now from reading the papers, Panix, the first ISP in >NYC, has come under a new denial of service attack. The Wall Street Journal >quoted Bill Cheswick to the effect that the attack is "unstoppable". Almost, >but not quite, true. > >It's true that there isn't anything that Panix can do on its own to stop >this attack. It's true that it would be hard to verify source addresses at >MAEs and NAPs. But we could all verify source addresses at the first hop >entry points. And get default route and unauthorized transit protection to boot. > >I'd like to know what the community thinks can be done to deal with an >escalation of these attacks should this occur. Are you doing any source >address verification now? Are you doing anything to help Panix? Could you? > >How seriously do you take this threat? If Panix were to go out of business >and Bob Metcalfe wrote a column on it, ( :-) do you think we would have to >deal with it together then, or can we sit tight and expect it to blow over? >After all, it's easy to dump chemicals in the reservoir, but we still drink >the water, right? > >Thanks. > >--Kent > > >~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~ >Kent W. England Six Sigma Networks >1655 Landquist Drive, Suite 100 Voice/Fax: 619.632.8400 >Encinitas, CA 92024 kwe(a)6SigmaNets.com >Experienced Internet Consulting ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~~ ~~~~ > > >

4 3

Re: New Denial of Service Attack on Panix
by Vadim Antonov 17 Sep '96

17 Sep '96

This is the excellent idea! Actually, router vendors may simply add a feature which shuts down the interface if SYN/SYN-ACK balance is too bad -- thus disconnecting the hacker-to-be. Of course, that balance may be decaying with time, so repeated unsuccessful attempts to connect won't trigger alarms. --vadim Forrest W. Christian <forrestc(a)iMach.com> wrote: Maybe I'm missing something here, but wouldn't these Denial of Service attacks cause a severe mismatch in the numbers of SYNs and SYN-ACKs on a given router interface? If so, then couldn't we just sweet-talk cisco into providing 5 minute counts of syns and syn-acks on an interface?

2 1

Re: SYN flood messages flooding my mailbox
by Vadim Antonov 17 Sep '96

17 Sep '96

Curtis Villamizar <curtis(a)ans.net> wrote: >2. Filter based on source address on inbound packets from singly >homed sites. >A singly homed site cannot have assymetric routing since there is no >ohter path. The site does not have to be single-homed for filtering to be applicable. If you relax criteria for reverse-route filtering to "known route" instead of "best route" then any customer (non-transit) AS can be filtered safely at border routers. Making that the default behaviour on customer-access routers would eliminate scource-address spoofing completely. As a remark -- the SYN flooding attack is by far not the only one which benefits from source address spoofing. There are far more destructive attacks (like, resetting BGP sessions; or Steve Bellovin's blind TCP spoofing) which do not require high packet voulmes and therefore are not easily traceable. As for traceability -- fat load of good it does to you if you discover that the hacker was smart enough to use an unprotected box somewhere in Taiwan or Brazil as a staging poing for attack. I've had situations when i traced attacks to places like that and was anything but unable to explain local sysadmins what i wanted from them. Simply because they don't speak English at all. There are places where they simply don't have any laws in regard to computer crime, and no Interpol offices. Any really malicious attacker with more than two neurons would be out of your reach, and unhindered. BTW, the enforcement of source address authenticity allows for automated SYN flooding attack defenses -- if your host sees a stream of SYNs at a rate more than X pps it simply starts to ignore the SYNs from that particular source! (A simple algorithm would take care of roaming sources within some network -- you just sort SYNs by buckets of different sizes and shut down those which have SYN rate counts higher than some threshold). --vadim

3 2

Re: New Denial of Service Attack on Panix
by Leonid Egoshin 17 Sep '96

17 Sep '96

From my expirience: There is one (not very complex) additional way to determine the real source of attack - DNS. If you configure DNS servers (you and secondaries also) to write log of requests and after that change your server IP address, you can fix the time then attacker change address to new. Manual analize of logs can very limit the number of potential attackers - look at the time of requests. - Leonid Yegoshin, LY22

1 0