DOSarrest

The main reason to test your defenses is to obviously see if your website can withstand a DDoS attack. More importantly is, what happens if it doesn’t ? Are you subscribed to a fully managed service that is responsive enough to get things rectified in a few minutes or will it take hours and multiple tickets with no updates followed by numerous calls into your solution provider’s SOC. Now if you’re sure that there will be minimal or no delay on making your site available you may just forgo testing your defenses and leave it up to your provider, also known as the “blind faith” method.

This is analogous to asking a contractor if they use a hammer. When the contractor uses the hammer and on what is far more important. Machine learning, or any other buzzword, will never be the solution to every problem. Some problems will require a machine learning solution, some problems will require a hammer.

The attacks generated by the latest amplification attack methodology, eponymously named Memcache (a popular open source distributed memory caching system), have so far generated the largest DDoS attacks to date. Within a one week period, Memcache has created two attacks registering at 1.3 Tbps and 1.7 Tbps, both eclipsing the previous high watermark set by the Mirai Botnet in 2016 that targeted and disrupted the DYN DNS infrastructure. To date, over 17,000 Memcache vulnerable servers have been identified, with each server potentially having an amplification factor of 50,000, and this list is growing. If there is any silver lining to this situation, it is that it is much easier to patch and mitigate these vulnerable Memcache servers than it is for the Mirai Botnet.

Building a single sign-on feature (SSO) for stateless applications can be challenging. Stateless applications are the new way of building web applications. Back in the day, web applications would hold a session for each logged in user; this led to many issues in the area of scalability, availability and security. As modern web applications get more sophisticated, the need for stateless and micro-services increases.

When one thinks of SSL and Encryption, the de facto assumption is that it automatically makes IT systems safer, and for the most part, this assumption is mostly true: SSL/TLS encryption has been instrumental in providing users the confidence for online data transactions over the last 20 years. However, cybercriminals have recently started using SSL/TLS as part of their attack strategies, resulting in an increase of SSL based attacks, ranging from:

Named “Code Injection-Bot Blocker” in our DSS2(DOSarrest’s customer portal), this feature dynamically injects code that’s attractive to botnets but remains unseen by human website visitors, this injected code directs the bots to a honeypot, where as soon as they begin to make requests the traffic is analyzed and blocked. https://www.dosarrest.com/solutions/ddos-protection/

Traditional firewalls evaluate network layer information, comparing traffic against a list of criteria.For any public web application, the network firewall will be able to block certain attacks but any attacks that use valid web traffic are invisible to the network firewall.Application layer attacks like SQLi and XSS are able to pass through the network firewall unchallenged because they are indistinguishable from normal traffic at the network layer.

This month we launched a new exciting product called the DOSarrest Traffic Analyzer (DTA), taking an inhouse platform that has been essential in providing real time security analytics and actions for the DOSarrest network, and making it available for customers to help with their own networks. In a nutshell, the DTA operates by ingesting Sflow/Netflow/Jflow records from any device capable of sending this type of data (routers and switches), indexing the data, and providing real time and historical data. A simple one-line config to export these flows is all that is required by anyone wanting to utilize this service.

Wordpress plugin, Social Warfare exposes sites to XSS attacks, was the alert that went out on March 21st 2019. A plugin named "Social Warfare" used by Wordpress sites allowed hackers to inject code into their websites, its estimated that 70,000 websites were effected. It was labelled as A "Zero-Day" Attack which has always confused me because at one time every exploit was a "Zero-Day" attack. It was reported that many hackers were already out there in the wild looking for websites that had the unpatched version of Social Warfare.

I'll take a recent case of a mixed network downstream of DOSarrest, with a focus on hosting that received a decent sized and sustained DDoS. The customer is sending Jflow from three flow sources, with a sample rate 1:2000 (pretty standard for larger traffic networks). During the attack, we were able to see a number of unique vectors that provided detail for the customer’s netops team to take appropriate action.

468, in particular, is assigned to filters that block based on IP reputation. There are a few optional filters available that use this: Block Bot, Block TOR, Block Region, and the newest Block Proxy.

Your data, and I stress this is your data, can be classified as Public, Private, and Confidential. Public data is the information that you want to disclose to the world, things that are required for basic services to function, like your address for mail, or pizza. On the other end of the scale is confidential information, this is information that you wouldn’t tell anyone unless it was absolutely critical to the process, like your Social Security Number for taxes. Somewhere in between is Private data. This is information that you don’t necessarily tell everyone, but it wouldn’t be disastrous if it was known, things like an unpublished phone number.

Since launching our cloud-based flow traffic analyzer, we’ve seen a lot of interesting takes and strategies on how to employ the DOSarrest Traffic Analyzer(DTA) from our customers. Whether Netops/Secops is focusing on an enterprise network or a multi-tenant hosting provider, DTA has been used to identify and monitor these security threats to their respective network operations

For a few years now, we here at DOSarrest started to field enquiries into hybrid DDoS defense setups, where customers wanted to leverage their existing on-premise DDoS mitigation infrastructure to work in co-ordination with the cloud scrubbing capabilities that our network infrastructure protection service, which we call “Data Center Defender” aka DCD is able to provide.

Asymmetrical traffic, specifically on the Internet, is when the routing path from host A to host B is different from host B to host A. While it seems that this would be a detriment, this by itself does not pose any problems, as evidenced by the fact that the majority of Internet traffic is asymmetrical.

When we first started providing DOSarrest Traffic Analyzer (DTA) product, we initially just wanted to take advantage of the capabilities of the DCD platform and provide a basic traffic analysis tool for customer NetOps teams and their respective networks. As we continued to develop the DTA, we looked around at some of the leaders in the Network Traffic Analysis industry to see what they were doing. There were a couple of well known names (eg. Kentik, Cisco Stealthwatch, Nagios Network Analyzer, Darktrace), and some not so well known names (Plixer Scrutinzer, Awake Security Platform, Lastline Defender). While each of these tools have various strengths, our analysis revealed that there seemed to be challenges and hurdles in successfully introducing them into a customer’s network operation, notably:

Reflection attacks are nothing new, having been around since the early 2000’s. But there was some recent activity where we saw disparate customers, with disparate services all attacked within a few days of each other with the same attack vectors, with varying differences in the size and duration of the attack. Customers ranged from: