SlideShare uma empresa Scribd logo

Layer 7 denial of services attack mitigation

•
•
Ammar WK
Ammar WK

RISTEK - IT lesehan 12 nov 2011

TecnologiaDesign
1 de 37
Baixar para ler offline
Layer7 Denial Of Sevice Attack Mitigation IT LESEHAN - y3dips Saturday, November 12, 11
Agenda • Introduction • Denial Of Service • Layer 7 Denial Of Service • Case Stories • Demo • Discussion Saturday, November 12, 11
Introduction • Freelance IT Security Consultant • More than 9 years in IT Security • Founder of “ECHO” one of Indonesian Hacker Community, established 2003 • Founder of IDSECCONF - Indonesia Security Conference in Cooperation with DEPKOMINFO • More Info: • me@ammar.web.id • @y3dips Saturday, November 12, 11
Denial of Service Suatu jenis kegiatan yang bertujuan untuk menggagalkan kerja suatu sistem secara maksimal baik sebagian atau seluruhnya. Saturday, November 12, 11
DOS • Stupid Act • Exhausted also yours • Old story, • moby write ddos in 2003 * • I write apache dos in 2003** • Well handle by now *http://ezine.echo.or.id/ezine2/ddos%7EMoby.txt **http://ezine.echo.or.id/ezine2/dos_buat_apache%7Ey3dips.txt Saturday, November 12, 11
Type of Network DOS • Layer 4 • Attack layer 4 protocol • TCP • SYN, FIN, ACK • smurf, TRINOO, stacheldart, teardrop Saturday, November 12, 11
Type of Network DOS • Layer 7 • Attack Layer 7 Protocol • HTTP, FTP, DNS • HTTP-slow post, HTTP-GET Saturday, November 12, 11
Real Life Stories When this all begin Saturday, November 12, 11
DOS Terhadap ECHO • 7 - 8 November 2011 • Unknown Motives • Echo Web Access Down Saturday, November 12, 11
Attack Detection Saturday, November 12, 11
See TKP :) Saturday, November 12, 11
Check Validitas DOS • Only you? • Or for everyone :D • http://downforeveryoneorjustme.com/ Saturday, November 12, 11
Analyze :| Saturday, November 12, 11
Analyze • The Server Down? • Or onlye specific service Down Saturday, November 12, 11
In this Case 80 down Saturday, November 12, 11
Layer 7 DOS Lets Dig arround on 80! Saturday, November 12, 11
See Stats :) Saturday, November 12, 11
Ganti Periode Laporan: 201111 - Bulan Nov 2011 Go Statistik untuk: echo.or.id Terakhir diupdate: 08 Nov 2011 - 14:20 Periode Laporan: Bulan Nov 2011 Kapan: Monthly history Days of month Hari Jam (Waktu Server) Siapa: Countries Daftar Lengkap Host Daftar Lengkap Kunjungan Terakhir Alamat IP yang tidak teresolve Robot/Spider Daftar Lengkap Kunjungan Terakhir Navigasi: Lama kunjungan Jenis File Halaman yang Dilihat Daftar Lengkap Halaman masuk (entry page) Halaman keluar (exit page) Sistem Operasi Versi Tidak Diketahui Browser Versi Tidak Diketahui Referer: Asal Search engine referer Situs referer Pencarian Frase Pencarian Kata Kunci Pencarian Lainnya: Miscellaneous Kode error HTTP Halaman tidak ditemukan (not found) Ringkasan Periode Laporan Bulan Nov 2011 Kunjungan Pertama 01 Nov 2011 - 00:00 Kunjungan Terakhir 08 Nov 2011 - 11:35 Pengunjung Unik Jumlah Kunjungan Halaman Hit Bandwidth 10021 14357 102822 417078 1.45 GB Traffic viewed * (1.43 kunjungan/pengunjung) (7.16 Halaman/Kunjungan) (29.05 Hit/Kunjungan) (105.69 KB/Kunjungan) Traffic not viewed * 88111 145915 395.12 MB * Not viewed traffic includes traffic generated by robots, worms, or replies with special HTTP status codes. Monthly history Jan Feb Mar Apr Mei Jun Jul Agu Sep Okt Nov Des 2011 2011 2011 2011 2011 2011 2011 2011 2011 2011 2011 2011 Bulan Pengunjung Jumlah Halaman Hit Bandwidth Seems all Legit 11/9/11 Saturday, November 12, 11
7, 8 November? Saturday, November 12, 11
7, 8 November? Saturday, November 12, 11
Ask the Logs :) Saturday, November 12, 11
Logs • HTTP/S logs • http-access • http-error Saturday, November 12, 11
A Valid One Saturday, November 12, 11
A Valid One but also http-flood GET Saturday, November 12, 11
Conclusion • Its an HTTP-flood GET • Connection need to be Established • IP need to be valid? Saturday, November 12, 11
Learn from Code :) Saturday, November 12, 11
*Credit to Google for the code, just dig and found Saturday, November 12, 11
Attack Mitigation Saturday, November 12, 11
Mitigation • Always Have your backup • No privil8 access to server; LAPORKAN Saturday, November 12, 11
Mitigation • Had The Privileged • check netstat -n | grep 80 | wc -l • block : • iptables -A INPUT -s x. x. x. x -p tcp - j TARPIT • iptables -A INPUT -s x. x. x. x -p tcp - j DROP Saturday, November 12, 11
TARPITING Care to Send and double the packet :) ? http://www.secureworks.com/research/threats/ddos/ Saturday, November 12, 11
Hardening Apache • TimeOut=Default 300 detik atau 5 Menit, disarankan 10 detik • TimeOut akan melindungi server dari rikues dalam jumlah besar, dan tidak pernah di putus oleh Attacker, dengan adanya TimeOut, apabila tidak terjadi transaksi dalam waktu tersebut (10 detik), maka Apache akan memutus koneksi Saturday, November 12, 11
Hardening Apache • KeepAlive = On • KeepAlive akan mengijinkan Berbagai jenis HTTP rikues dilakukan dalam satu koneksi. • KeepAlive = 15 detik • Setting ini akan melindungi Server dari Rikues Keepalive tanpa transaksi Saturday, November 12, 11
Hardening Apache • AcceptFilter = http/https data • Melindungi dari jenis serangan, dimana attacker membuka koneksi via socket dan membiarkannya tanpa terjadinya transaksi data. Dengan mendefinisikan data pada http dan https akan meminimalisir jenis serangan ini. Saturday, November 12, 11
DeMo Saturday, November 12, 11
Saturday, November 12, 11
Layer7 Denial Of Sevice Attack Mitigation IT LESEHAN - y3dips Saturday, November 12, 11

Recomendados

CSS Power Tools
CSS Power ToolsCSS Power Tools
CSS Power ToolsNicole Sullivan
 
Deploying large payloads at scale
Deploying large payloads at scaleDeploying large payloads at scale
Deploying large payloads at scaleramonvanalteren
 
Conquistando el Servidor con Node.JS
Conquistando el Servidor con Node.JSConquistando el Servidor con Node.JS
Conquistando el Servidor con Node.JSCaridy Patino
 
Distributed "Web Scale" Systems
Distributed "Web Scale" SystemsDistributed "Web Scale" Systems
Distributed "Web Scale" SystemsRicardo Vice Santos
 
Spotify: behind the scenes
Spotify: behind the scenesSpotify: behind the scenes
Spotify: behind the scenesRicardo Vice Santos
 
WPS Shootout
WPS ShootoutWPS Shootout
WPS ShootoutJody Garnett
 
Create a Professional Blog with WordPress: Chapter 2 Installing Wordpress
Create a Professional Blog with WordPress: Chapter 2 Installing WordpressCreate a Professional Blog with WordPress: Chapter 2 Installing Wordpress
Create a Professional Blog with WordPress: Chapter 2 Installing WordpressAtit Patumvan
 
Spotify: P2P music-on-demand streaming
Spotify: P2P music-on-demand streamingSpotify: P2P music-on-demand streaming
Spotify: P2P music-on-demand streamingRicardo Vice Santos
 

Recomendados

CSS Power Tools
CSS Power ToolsCSS Power Tools
CSS Power ToolsNicole Sullivan
 
Deploying large payloads at scale
Deploying large payloads at scaleDeploying large payloads at scale
Deploying large payloads at scaleramonvanalteren
 
Conquistando el Servidor con Node.JS
Conquistando el Servidor con Node.JSConquistando el Servidor con Node.JS
Conquistando el Servidor con Node.JSCaridy Patino
 
Distributed "Web Scale" Systems
Distributed "Web Scale" SystemsDistributed "Web Scale" Systems
Distributed "Web Scale" SystemsRicardo Vice Santos
 
Spotify: behind the scenes
Spotify: behind the scenesSpotify: behind the scenes
Spotify: behind the scenesRicardo Vice Santos
 
WPS Shootout
WPS ShootoutWPS Shootout
WPS ShootoutJody Garnett
 
Create a Professional Blog with WordPress: Chapter 2 Installing Wordpress
Create a Professional Blog with WordPress: Chapter 2 Installing WordpressCreate a Professional Blog with WordPress: Chapter 2 Installing Wordpress
Create a Professional Blog with WordPress: Chapter 2 Installing WordpressAtit Patumvan
 
Spotify: P2P music-on-demand streaming
Spotify: P2P music-on-demand streamingSpotify: P2P music-on-demand streaming
Spotify: P2P music-on-demand streamingRicardo Vice Santos
 
password series
password seriespassword series
password seriesAmmar WK
 
backdooring workshop
backdooring workshopbackdooring workshop
backdooring workshopAmmar WK
 
Mastering Network HackingFU - idsecconf2008
Mastering Network HackingFU - idsecconf2008Mastering Network HackingFU - idsecconf2008
Mastering Network HackingFU - idsecconf2008Ammar WK
 
Web Hacking (basic)
Web Hacking (basic)Web Hacking (basic)
Web Hacking (basic)Ammar WK
 
bluetooth [in]security
bluetooth [in]securitybluetooth [in]security
bluetooth [in]securityAmmar WK
 
Pentesting with linux
Pentesting with linuxPentesting with linux
Pentesting with linuxHammad Ahmed Khawaja
 
Had sec mikrotik administrator
Had sec mikrotik administratorHad sec mikrotik administrator
Had sec mikrotik administratormuhammad pailus
 
Penetrasi Jaringan
Penetrasi JaringanPenetrasi Jaringan
Penetrasi JaringanDigital Echidna
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hackingKhairi Aiman
 
Linux Exploit Research
Linux Exploit ResearchLinux Exploit Research
Linux Exploit ResearchDan H
 
Workshop 101 - Penetration testing & Vulnerability assessment system
Workshop 101 - Penetration testing & Vulnerability assessment systemWorkshop 101 - Penetration testing & Vulnerability assessment system
Workshop 101 - Penetration testing & Vulnerability assessment systemDan H
 
Backtrack 5 - network pentest
Backtrack 5 - network pentestBacktrack 5 - network pentest
Backtrack 5 - network pentestDan H
 
Backtrack 5 - web pentest
Backtrack 5 - web pentestBacktrack 5 - web pentest
Backtrack 5 - web pentestDan H
 
Seminar Hacking & Security Analysis
Seminar Hacking & Security AnalysisSeminar Hacking & Security Analysis
Seminar Hacking & Security AnalysisDan H
 
Clouds against the Floods (RubyConfBR2011)
Clouds against the Floods (RubyConfBR2011) Clouds against the Floods (RubyConfBR2011)
Clouds against the Floods (RubyConfBR2011) Leonardo Borges
 
Caridy patino - node-js
Caridy patino - node-jsCaridy patino - node-js
Caridy patino - node-jsStarTech Conference
 
Image and Music: Processing plus Pure Data with libpd library
Image and Music: Processing plus Pure Data with libpd libraryImage and Music: Processing plus Pure Data with libpd library
Image and Music: Processing plus Pure Data with libpd libraryPETER KIRN
 
Technical Debt
Technical DebtTechnical Debt
Technical DebtKmanthei
 
Mobile? WT... F?
Mobile? WT... F?Mobile? WT... F?
Mobile? WT... F?Vicker Leung
 
Content focused web design
Content focused web designContent focused web design
Content focused web designEddie Monge
 
HTML5 and Sencha Touch
HTML5 and Sencha TouchHTML5 and Sencha Touch
HTML5 and Sencha TouchPatrick Sheridan
 
Iwmn architecture
Iwmn architectureIwmn architecture
Iwmn architectureLenz Gschwendtner
 

Mais conteúdo relacionado

Destaque

password series
password seriespassword series
password seriesAmmar WK
 
backdooring workshop
backdooring workshopbackdooring workshop
backdooring workshopAmmar WK
 
Mastering Network HackingFU - idsecconf2008
Mastering Network HackingFU - idsecconf2008Mastering Network HackingFU - idsecconf2008
Mastering Network HackingFU - idsecconf2008Ammar WK
 
Web Hacking (basic)
Web Hacking (basic)Web Hacking (basic)
Web Hacking (basic)Ammar WK
 
bluetooth [in]security
bluetooth [in]securitybluetooth [in]security
bluetooth [in]securityAmmar WK
 
Had sec mikrotik administrator
Had sec mikrotik administratorHad sec mikrotik administrator
Had sec mikrotik administratormuhammad pailus
 
Linux Exploit Research
Linux Exploit ResearchLinux Exploit Research
Linux Exploit ResearchDan H
 
Workshop 101 - Penetration testing & Vulnerability assessment system
Workshop 101 - Penetration testing & Vulnerability assessment systemWorkshop 101 - Penetration testing & Vulnerability assessment system
Workshop 101 - Penetration testing & Vulnerability assessment systemDan H
 
Backtrack 5 - network pentest
Backtrack 5 - network pentestBacktrack 5 - network pentest
Backtrack 5 - network pentestDan H
 
Backtrack 5 - web pentest
Backtrack 5 - web pentestBacktrack 5 - web pentest
Backtrack 5 - web pentestDan H
 
Seminar Hacking & Security Analysis
Seminar Hacking & Security AnalysisSeminar Hacking & Security Analysis
Seminar Hacking & Security AnalysisDan H
 

Destaque (14)

password series
password seriespassword series
password series
 
backdooring workshop
backdooring workshopbackdooring workshop
backdooring workshop
 
Mastering Network HackingFU - idsecconf2008
Mastering Network HackingFU - idsecconf2008Mastering Network HackingFU - idsecconf2008
Mastering Network HackingFU - idsecconf2008
 
Web Hacking (basic)
Web Hacking (basic)Web Hacking (basic)
Web Hacking (basic)
 
bluetooth [in]security
bluetooth [in]securitybluetooth [in]security
bluetooth [in]security
 
Pentesting with linux
Pentesting with linuxPentesting with linux
Pentesting with linux
 
Had sec mikrotik administrator
Had sec mikrotik administratorHad sec mikrotik administrator
Had sec mikrotik administrator
 
Penetrasi Jaringan
Penetrasi JaringanPenetrasi Jaringan
Penetrasi Jaringan
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
Linux Exploit Research
Linux Exploit ResearchLinux Exploit Research
Linux Exploit Research
 
Workshop 101 - Penetration testing & Vulnerability assessment system
Workshop 101 - Penetration testing & Vulnerability assessment systemWorkshop 101 - Penetration testing & Vulnerability assessment system
Workshop 101 - Penetration testing & Vulnerability assessment system
 
Backtrack 5 - network pentest
Backtrack 5 - network pentestBacktrack 5 - network pentest
Backtrack 5 - network pentest
 
Backtrack 5 - web pentest
Backtrack 5 - web pentestBacktrack 5 - web pentest
Backtrack 5 - web pentest
 
Seminar Hacking & Security Analysis
Seminar Hacking & Security AnalysisSeminar Hacking & Security Analysis
Seminar Hacking & Security Analysis
 

Semelhante a Layer 7 denial of services attack mitigation

Clouds against the Floods (RubyConfBR2011)
Clouds against the Floods (RubyConfBR2011) Clouds against the Floods (RubyConfBR2011)
Clouds against the Floods (RubyConfBR2011) Leonardo Borges
 
Image and Music: Processing plus Pure Data with libpd library
Image and Music: Processing plus Pure Data with libpd libraryImage and Music: Processing plus Pure Data with libpd library
Image and Music: Processing plus Pure Data with libpd libraryPETER KIRN
 
Technical Debt
Technical DebtTechnical Debt
Technical DebtKmanthei
 
Content focused web design
Content focused web designContent focused web design
Content focused web designEddie Monge
 
Play concurrency
Play concurrencyPlay concurrency
Play concurrencyJustin Long
 
Modern HTML & CSS Coding: Speed, Semantics & Structure
Modern HTML & CSS Coding: Speed, Semantics & StructureModern HTML & CSS Coding: Speed, Semantics & Structure
Modern HTML & CSS Coding: Speed, Semantics & StructureRaven Tools
 
JS-Everywhere - SSE Hands-on
JS-Everywhere - SSE Hands-onJS-Everywhere - SSE Hands-on
JS-Everywhere - SSE Hands-onBrice Argenson
 
Fast & Furious: Speed in the Opera browser
Fast & Furious: Speed in the Opera browserFast & Furious: Speed in the Opera browser
Fast & Furious: Speed in the Opera browserAndreas Bovens
 
Rails ORM De-mystifying Active Record has_many
Rails ORM De-mystifying Active Record has_manyRails ORM De-mystifying Active Record has_many
Rails ORM De-mystifying Active Record has_manyBlazing Cloud
 
Scaling Pinterest
Scaling PinterestScaling Pinterest
Scaling PinterestC4Media
 
iOS Prototyping with Xcode Storyboards
iOS Prototyping with Xcode StoryboardsiOS Prototyping with Xcode Storyboards
iOS Prototyping with Xcode StoryboardsKyle Oba
 
soft-shake.ch - Data grids and Data Caching
soft-shake.ch - Data grids and Data Cachingsoft-shake.ch - Data grids and Data Caching
soft-shake.ch - Data grids and Data Cachingsoft-shake.ch
 
Multiplatform, Promises and HTML5
Multiplatform, Promises and HTML5Multiplatform, Promises and HTML5
Multiplatform, Promises and HTML5C4Media
 
DruplCampNYC 10 - Energy.gov Case Study
DruplCampNYC 10 - Energy.gov Case StudyDruplCampNYC 10 - Energy.gov Case Study
DruplCampNYC 10 - Energy.gov Case Studyzroger
 
I Love Techno - the site
I Love Techno - the siteI Love Techno - the site
I Love Techno - the sitePeter Arato
 

Semelhante a Layer 7 denial of services attack mitigation (20)

Clouds against the Floods (RubyConfBR2011)
Clouds against the Floods (RubyConfBR2011) Clouds against the Floods (RubyConfBR2011)
Clouds against the Floods (RubyConfBR2011)
 
Caridy patino - node-js
Caridy patino - node-jsCaridy patino - node-js
Caridy patino - node-js
 
Image and Music: Processing plus Pure Data with libpd library
Image and Music: Processing plus Pure Data with libpd libraryImage and Music: Processing plus Pure Data with libpd library
Image and Music: Processing plus Pure Data with libpd library
 
Technical Debt
Technical DebtTechnical Debt
Technical Debt
 
Mobile? WT... F?
Mobile? WT... F?Mobile? WT... F?
Mobile? WT... F?
 
Content focused web design
Content focused web designContent focused web design
Content focused web design
 
HTML5 and Sencha Touch
HTML5 and Sencha TouchHTML5 and Sencha Touch
HTML5 and Sencha Touch
 
Iwmn architecture
Iwmn architectureIwmn architecture
Iwmn architecture
 
Play concurrency
Play concurrencyPlay concurrency
Play concurrency
 
Modern HTML & CSS Coding: Speed, Semantics & Structure
Modern HTML & CSS Coding: Speed, Semantics & StructureModern HTML & CSS Coding: Speed, Semantics & Structure
Modern HTML & CSS Coding: Speed, Semantics & Structure
 
JS-Everywhere - SSE Hands-on
JS-Everywhere - SSE Hands-onJS-Everywhere - SSE Hands-on
JS-Everywhere - SSE Hands-on
 
Fast & Furious: Speed in the Opera browser
Fast & Furious: Speed in the Opera browserFast & Furious: Speed in the Opera browser
Fast & Furious: Speed in the Opera browser
 
Rails ORM De-mystifying Active Record has_many
Rails ORM De-mystifying Active Record has_manyRails ORM De-mystifying Active Record has_many
Rails ORM De-mystifying Active Record has_many
 
Pocket Knife JS
Pocket Knife JSPocket Knife JS
Pocket Knife JS
 
Scaling Pinterest
Scaling PinterestScaling Pinterest
Scaling Pinterest
 
iOS Prototyping with Xcode Storyboards
iOS Prototyping with Xcode StoryboardsiOS Prototyping with Xcode Storyboards
iOS Prototyping with Xcode Storyboards
 
soft-shake.ch - Data grids and Data Caching
soft-shake.ch - Data grids and Data Cachingsoft-shake.ch - Data grids and Data Caching
soft-shake.ch - Data grids and Data Caching
 
Multiplatform, Promises and HTML5
Multiplatform, Promises and HTML5Multiplatform, Promises and HTML5
Multiplatform, Promises and HTML5
 
DruplCampNYC 10 - Energy.gov Case Study
DruplCampNYC 10 - Energy.gov Case StudyDruplCampNYC 10 - Energy.gov Case Study
DruplCampNYC 10 - Energy.gov Case Study
 
I Love Techno - the site
I Love Techno - the siteI Love Techno - the site
I Love Techno - the site
 

Mais de Ammar WK

Vvdp-fgd-bssn
Vvdp-fgd-bssnVvdp-fgd-bssn
Vvdp-fgd-bssnAmmar WK
 
Pen-testing is Dead?
Pen-testing is Dead?Pen-testing is Dead?
Pen-testing is Dead?Ammar WK
 
How To [relatively] Secure your Web Applications
How To [relatively] Secure your Web ApplicationsHow To [relatively] Secure your Web Applications
How To [relatively] Secure your Web ApplicationsAmmar WK
 
A Journey Into Pen-tester land: Myths or Facts!
A Journey Into Pen-tester land: Myths or Facts!A Journey Into Pen-tester land: Myths or Facts!
A Journey Into Pen-tester land: Myths or Facts!Ammar WK
 
Cybercrime: A threat to Financial industry
Cybercrime: A threat to Financial industryCybercrime: A threat to Financial industry
Cybercrime: A threat to Financial industryAmmar WK
 
Bugbounty vs-0day
Bugbounty vs-0dayBugbounty vs-0day
Bugbounty vs-0dayAmmar WK
 
Advanced Persistent Threat
Advanced Persistent ThreatAdvanced Persistent Threat
Advanced Persistent ThreatAmmar WK
 
Mobile hacking, pentest, and malware
Mobile hacking, pentest, and malwareMobile hacking, pentest, and malware
Mobile hacking, pentest, and malwareAmmar WK
 
Hacker? : it's not about Black or White
Hacker? : it's not about Black or WhiteHacker? : it's not about Black or White
Hacker? : it's not about Black or WhiteAmmar WK
 
Introduction to IOS Application Penetration Testing
Introduction to IOS Application Penetration TestingIntroduction to IOS Application Penetration Testing
Introduction to IOS Application Penetration TestingAmmar WK
 
Burp suite
Burp suiteBurp suite
Burp suiteAmmar WK
 
Network Packet Analysis
Network Packet AnalysisNetwork Packet Analysis
Network Packet AnalysisAmmar WK
 
Packet analysis (Basic)
Packet analysis (Basic)Packet analysis (Basic)
Packet analysis (Basic)Ammar WK
 
Network security
Network securityNetwork security
Network securityAmmar WK
 
Penetration testing
Penetration testingPenetration testing
Penetration testingAmmar WK
 
Information Security Professional
Information Security ProfessionalInformation Security Professional
Information Security ProfessionalAmmar WK
 
Handout infosec defense-mechanism-y3dips
Handout infosec defense-mechanism-y3dipsHandout infosec defense-mechanism-y3dips
Handout infosec defense-mechanism-y3dipsAmmar WK
 
How To Become A Hacker
How To Become A HackerHow To Become A Hacker
How To Become A HackerAmmar WK
 
y3dips - Who Own Your Sensitive Information?
y3dips - Who Own Your Sensitive Information?y3dips - Who Own Your Sensitive Information?
y3dips - Who Own Your Sensitive Information?Ammar WK
 
idsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 networkidsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 networkAmmar WK
 

Mais de Ammar WK (20)

Vvdp-fgd-bssn
Vvdp-fgd-bssnVvdp-fgd-bssn
Vvdp-fgd-bssn
 
Pen-testing is Dead?
Pen-testing is Dead?Pen-testing is Dead?
Pen-testing is Dead?
 
How To [relatively] Secure your Web Applications
How To [relatively] Secure your Web ApplicationsHow To [relatively] Secure your Web Applications
How To [relatively] Secure your Web Applications
 
A Journey Into Pen-tester land: Myths or Facts!
A Journey Into Pen-tester land: Myths or Facts!A Journey Into Pen-tester land: Myths or Facts!
A Journey Into Pen-tester land: Myths or Facts!
 
Cybercrime: A threat to Financial industry
Cybercrime: A threat to Financial industryCybercrime: A threat to Financial industry
Cybercrime: A threat to Financial industry
 
Bugbounty vs-0day
Bugbounty vs-0dayBugbounty vs-0day
Bugbounty vs-0day
 
Advanced Persistent Threat
Advanced Persistent ThreatAdvanced Persistent Threat
Advanced Persistent Threat
 
Mobile hacking, pentest, and malware
Mobile hacking, pentest, and malwareMobile hacking, pentest, and malware
Mobile hacking, pentest, and malware
 
Hacker? : it's not about Black or White
Hacker? : it's not about Black or WhiteHacker? : it's not about Black or White
Hacker? : it's not about Black or White
 
Introduction to IOS Application Penetration Testing
Introduction to IOS Application Penetration TestingIntroduction to IOS Application Penetration Testing
Introduction to IOS Application Penetration Testing
 
Burp suite
Burp suiteBurp suite
Burp suite
 
Network Packet Analysis
Network Packet AnalysisNetwork Packet Analysis
Network Packet Analysis
 
Packet analysis (Basic)
Packet analysis (Basic)Packet analysis (Basic)
Packet analysis (Basic)
 
Network security
Network securityNetwork security
Network security
 
Penetration testing
Penetration testingPenetration testing
Penetration testing
 
Information Security Professional
Information Security ProfessionalInformation Security Professional
Information Security Professional
 
Handout infosec defense-mechanism-y3dips
Handout infosec defense-mechanism-y3dipsHandout infosec defense-mechanism-y3dips
Handout infosec defense-mechanism-y3dips
 
How To Become A Hacker
How To Become A HackerHow To Become A Hacker
How To Become A Hacker
 
y3dips - Who Own Your Sensitive Information?
y3dips - Who Own Your Sensitive Information?y3dips - Who Own Your Sensitive Information?
y3dips - Who Own Your Sensitive Information?
 
idsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 networkidsecconf2010-hacking priv8 network
idsecconf2010-hacking priv8 network
 

Último

How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...apidays
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobeapidays
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesBoston Institute of Analytics
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProduct Anonymous
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessPixlogix Infotech
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slidevu2urc
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?Igalia
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoffsammart93
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfsudhanshuwaghmare1
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptxHampshireHUG
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdflior mazor
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Neo4j
 

Último (20)

How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, AdobeApidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
Apidays New York 2024 - Scaling API-first by Ian Reasor and Radu Cotescu, Adobe
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
HTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation StrategiesHTML Injection Attacks: Impact and Mitigation Strategies
HTML Injection Attacks: Impact and Mitigation Strategies
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
Advantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your BusinessAdvantages of Hiring UIUX Design Service Providers for Your Business
Advantages of Hiring UIUX Design Service Providers for Your Business
 
Histor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slideHistor y of HAM Radio presentation slide
Histor y of HAM Radio presentation slide
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?A Year of the Servo Reboot: Where Are We Now?
A Year of the Servo Reboot: Where Are We Now?
 
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data DiscoveryTrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
TrustArc Webinar - Unlock the Power of AI-Driven Data Discovery
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot TakeoffStrategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
Strategize a Smooth Tenant-to-tenant Migration and Copilot Takeoff
 
Boost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdfBoost Fertility New Invention Ups Success Rates.pdf
Boost Fertility New Invention Ups Success Rates.pdf
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
04-2024-HHUG-Sales-and-Marketing-Alignment.pptx
 
GenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdfGenAI Risks & Security Meetup 01052024.pdf
GenAI Risks & Security Meetup 01052024.pdf
 
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
Workshop - Best of Both Worlds_ Combine KG and Vector search for enhanced R...
 

Layer 7 denial of services attack mitigation

  • 1. Layer7 Denial Of Sevice Attack Mitigation IT LESEHAN - y3dips Saturday, November 12, 11
  • 2. Agenda • Introduction • Denial Of Service • Layer 7 Denial Of Service • Case Stories • Demo • Discussion Saturday, November 12, 11
  • 3. Introduction • Freelance IT Security Consultant • More than 9 years in IT Security • Founder of “ECHO” one of Indonesian Hacker Community, established 2003 • Founder of IDSECCONF - Indonesia Security Conference in Cooperation with DEPKOMINFO • More Info: • me@ammar.web.id • @y3dips Saturday, November 12, 11
  • 4. Denial of Service Suatu jenis kegiatan yang bertujuan untuk menggagalkan kerja suatu sistem secara maksimal baik sebagian atau seluruhnya. Saturday, November 12, 11
  • 5. DOS • Stupid Act • Exhausted also yours • Old story, • moby write ddos in 2003 * • I write apache dos in 2003** • Well handle by now *http://ezine.echo.or.id/ezine2/ddos%7EMoby.txt **http://ezine.echo.or.id/ezine2/dos_buat_apache%7Ey3dips.txt Saturday, November 12, 11
  • 6. Type of Network DOS • Layer 4 • Attack layer 4 protocol • TCP • SYN, FIN, ACK • smurf, TRINOO, stacheldart, teardrop Saturday, November 12, 11
  • 7. Type of Network DOS • Layer 7 • Attack Layer 7 Protocol • HTTP, FTP, DNS • HTTP-slow post, HTTP-GET Saturday, November 12, 11
  • 8. Real Life Stories When this all begin Saturday, November 12, 11
  • 9. DOS Terhadap ECHO • 7 - 8 November 2011 • Unknown Motives • Echo Web Access Down Saturday, November 12, 11
  • 11. See TKP :) Saturday, November 12, 11
  • 12. Check Validitas DOS • Only you? • Or for everyone :D • http://downforeveryoneorjustme.com/ Saturday, November 12, 11
  • 14. Analyze • The Server Down? • Or onlye specific service Down Saturday, November 12, 11
  • 15. In this Case 80 down Saturday, November 12, 11
  • 16. Layer 7 DOS Lets Dig arround on 80! Saturday, November 12, 11
  • 17. See Stats :) Saturday, November 12, 11
  • 18. Ganti Periode Laporan: 201111 - Bulan Nov 2011 Go Statistik untuk: echo.or.id Terakhir diupdate: 08 Nov 2011 - 14:20 Periode Laporan: Bulan Nov 2011 Kapan: Monthly history Days of month Hari Jam (Waktu Server) Siapa: Countries Daftar Lengkap Host Daftar Lengkap Kunjungan Terakhir Alamat IP yang tidak teresolve Robot/Spider Daftar Lengkap Kunjungan Terakhir Navigasi: Lama kunjungan Jenis File Halaman yang Dilihat Daftar Lengkap Halaman masuk (entry page) Halaman keluar (exit page) Sistem Operasi Versi Tidak Diketahui Browser Versi Tidak Diketahui Referer: Asal Search engine referer Situs referer Pencarian Frase Pencarian Kata Kunci Pencarian Lainnya: Miscellaneous Kode error HTTP Halaman tidak ditemukan (not found) Ringkasan Periode Laporan Bulan Nov 2011 Kunjungan Pertama 01 Nov 2011 - 00:00 Kunjungan Terakhir 08 Nov 2011 - 11:35 Pengunjung Unik Jumlah Kunjungan Halaman Hit Bandwidth 10021 14357 102822 417078 1.45 GB Traffic viewed * (1.43 kunjungan/pengunjung) (7.16 Halaman/Kunjungan) (29.05 Hit/Kunjungan) (105.69 KB/Kunjungan) Traffic not viewed * 88111 145915 395.12 MB * Not viewed traffic includes traffic generated by robots, worms, or replies with special HTTP status codes. Monthly history Jan Feb Mar Apr Mei Jun Jul Agu Sep Okt Nov Des 2011 2011 2011 2011 2011 2011 2011 2011 2011 2011 2011 2011 Bulan Pengunjung Jumlah Halaman Hit Bandwidth Seems all Legit 11/9/11 Saturday, November 12, 11
  • 19. 7, 8 November? Saturday, November 12, 11
  • 20. 7, 8 November? Saturday, November 12, 11
  • 21. Ask the Logs :) Saturday, November 12, 11
  • 22. Logs • HTTP/S logs • http-access • http-error Saturday, November 12, 11
  • 23. A Valid One Saturday, November 12, 11
  • 24. A Valid One but also http-flood GET Saturday, November 12, 11
  • 25. Conclusion • Its an HTTP-flood GET • Connection need to be Established • IP need to be valid? Saturday, November 12, 11
  • 26. Learn from Code :) Saturday, November 12, 11
  • 27. *Credit to Google for the code, just dig and found Saturday, November 12, 11
  • 29. Mitigation • Always Have your backup • No privil8 access to server; LAPORKAN Saturday, November 12, 11
  • 30. Mitigation • Had The Privileged • check netstat -n | grep 80 | wc -l • block : • iptables -A INPUT -s x. x. x. x -p tcp - j TARPIT • iptables -A INPUT -s x. x. x. x -p tcp - j DROP Saturday, November 12, 11
  • 31. TARPITING Care to Send and double the packet :) ? http://www.secureworks.com/research/threats/ddos/ Saturday, November 12, 11
  • 32. Hardening Apache • TimeOut=Default 300 detik atau 5 Menit, disarankan 10 detik • TimeOut akan melindungi server dari rikues dalam jumlah besar, dan tidak pernah di putus oleh Attacker, dengan adanya TimeOut, apabila tidak terjadi transaksi dalam waktu tersebut (10 detik), maka Apache akan memutus koneksi Saturday, November 12, 11
  • 33. Hardening Apache • KeepAlive = On • KeepAlive akan mengijinkan Berbagai jenis HTTP rikues dilakukan dalam satu koneksi. • KeepAlive = 15 detik • Setting ini akan melindungi Server dari Rikues Keepalive tanpa transaksi Saturday, November 12, 11
  • 34. Hardening Apache • AcceptFilter = http/https data • Melindungi dari jenis serangan, dimana attacker membuka koneksi via socket dan membiarkannya tanpa terjadinya transaksi data. Dengan mendefinisikan data pada http dan https akan meminimalisir jenis serangan ini. Saturday, November 12, 11
  • 37. Layer7 Denial Of Sevice Attack Mitigation IT LESEHAN - y3dips Saturday, November 12, 11