Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Cloud

Cloud DDoS Mitigation Services Can Be Easily Bypassed (softpedia.com) 40

Posted by Soulskill from the your-computer-is-broadcasting-an-IP-address dept.
An anonymous reader writes: A recent research paper shows that most Cloud-Based Security Providers are ineffective in protecting websites from DDoS attacks, mainly because they cannot entirely hide the origin website's IP address from attackers. As five security researchers from Belgium and the U.S. are claiming, there are eight methods through which these mitigation services can be bypassed. The techniques of obtaining a website's origin IP address rely on hackers searching through historical Web traffic databases, in DNS records, subdomains that resolve to the main domain directly, the site's own source code, when the main website triggers outbound connections, via SSL certificates, via sensitive files hosted on the website's server, and during migration or maintenance operations on the mitigation service itself, which leaves the target website temporarily exposed.
This discussion has been archived. No new comments can be posted.

Cloud DDoS Mitigation Services Can Be Easily Bypassed More

Cloud DDoS Mitigation Services Can Be Easily Bypassed

Comments Filter:

  • have your origin accessible to only your provider (Score:3, Interesting)

    by Anonymous Coward on Sunday October 11, 2015 @06:56AM (#50703311)

    Akamai sells as an add-on for "origin cloaking", called "Site Shield", inwhich the origin to limits access to only a subset of akamai systems (which then distribute to the rest of akamai), and drops the rest of the internet. I wonder if that is effective against these attacks?

    • As long as the servers dropping the traffic can keep up with both the legit traffic and the bad traffic. If an attacker can overload the server which is dropping non-akamai traffic then even legit traffic wont be able to get through. Since the akamai server has to read a packet to know whether or not to drop it it is still possible to overload that part of the system.
      • Levels of increasing protection:
        1. 1. Use a CDN and hope no one finds the origin domain or ips the CDN uses.
          Which as we can see from the article doesn't work due to the many ways they can be leaked.
          E.g., for www.example.com, try origin.www.example.com, ftp.example.com or IPs used in the past for www.example.com.
        2. 2. Have the origin servers only respond to white-listed IPs. That white-list needs to include those of the CDN.
          Still suspectible to a volumetric bandwidth attack. I.e., attacks with enough packets t

  • Paper finds most webmasters don't have a clue (Score:3, Insightful)

    by neorush ( 1103917 ) on Sunday October 11, 2015 @06:59AM (#50703319) Homepage
    Wow, revelations here. I guess the point of the paper is to really show most webmasters don't know what they're doing. All of these things can totally be avoided if you do your job carefully and methodically. e.g. maybe change the IP address of the server after launching your DDoS mitigation service, oh look, now half that list is moot.

    • All of these things can totally be avoided if you do your job carefully and methodically. e.g. maybe change the IP address of the server after launching your DDoS mitigation service, oh look, now half that list is moot.

      One "hole" that they missed is that a lot of sites send confirmation emails when creating an account, and that can reveal the IP in the email headers.

      • Re: (Score:2)

        by Bengie ( 1121981 )
        Some of the higher end DDOS services involve not announcing your blocks on the Internet, but making sure the routes between your and your DDOS service has your blocks announced. This way only your DDOS service can talk directly to you. They act as your gateway to the Internet for your hosted services.

        P.S. I love the point you made. I did not think of that hole in the armor.

        • What I did at first to fix this potential hole was to catch the incoming email and then do a manual activation and reply from a Yahoo account. Later I had the email trigger a script that sent a signal to a different server and that server sent the email.*

          Of course, if they were really determined they'd just start DDOSing that server which would crash other sites I own, but I figured they'd be watching the original site to see if it was being affected, and when it wasn't (because they weren't hitting the ri

  • Easily? (Score:5, Insightful)

    by IamTheRealMike ( 537420 ) on Sunday October 11, 2015 @07:09AM (#50703335)

    Let me summarise the key findings of the paper. The headline figure is stunning: over 70% of all sites they tested leaked their origin IP in some way.

    But. It's not quite as simple as that. Virtually all websites that are DDoS protected are using CloudFlare, probably because it's a free service. The vast majority of the times they were able to find the origin IP address, it was due to basic oversights by the website admin, typically, having subdomains that resolve to the origin IP or simply never moving the server after signing up for CloudFlare at all. The most common subdomain that leaked the IP was called "ftp".

    Who the heck actually still runs an FTP server as part of their website, in this day and age? No big websites do that's for sure.

    And sure enough the paper concludes, not surprisingly, that bigger more important websites are much less likely to leak their origin IPs than smaller ones.

    I think all this paper really says is that CloudFlare have a lot of small non-paying customers who aren't really playing in the big leagues and aren't being attacked by sophisticated attackers ... or possibly aren't being attacked at all .... and as a result are more likely to have made simple errors.

    So when the headline says these protections are "easily" bypassed, all it's really saying is that if someone using a defensive system makes mistakes, they can still be attacked. That's not really news and doesn't tell us anything about the efficiency of these services when the people using them have done their homework.

    • Re:Easily? (Score:5, Insightful)

      by ThatsMyNick ( 2004126 ) on Sunday October 11, 2015 @07:33AM (#50703423)

      I think all this paper really says is that CloudFlare have a lot of small non-paying customers who aren't really playing in the big leagues and aren't being attacked by sophisticated attackers ... or possibly aren't being attacked at all .... and as a result are more likely to have made simple errors.

      Or they are using it as a free caching CDN like me, and dont care about IP being exposed.

      • To expand upon this a little, for those not in the know you can sign up for AWS free tier which is valid for one year and try most of their services. They've got over 40 different products. Pretty neat infrastructure they've got setup with excellent documentation to boot.

    • Who the heck actually still runs an FTP server as part of their website, in this day and age?

      More than I care to admit or remember... I've seen a lot of advertising firms using FTP for transferring material to/from clients all over the place. They figure user/pass and origin IP are secure enough. Well, maybe their data isn't important enough to transfer with any level of encryption.

      So when the headline says these protections are "easily" bypassed, all it's really saying is that if someone using a defensive system makes mistakes

      Very true, but many smaller websites may not have the luxury of moving their IPs about.

    • Re: (Score:3)

      by Khyber ( 864651 )

      "Who the heck actually still runs an FTP server as part of their website, in this day and age? No big websites do that's for sure."

      Every site that provides downloadable drivers for your hardware almost certainly has an FTP mirror.

  • Email Headers (Score:5, Insightful)

    by XXeR ( 447912 ) on Sunday October 11, 2015 @08:41AM (#50703617)

    One other detection method not specifically called out is via email headers. Often times automated emails are sent from the same origin IP (not always, of course). Even if the email is routed through an email service before delivery, you can still see the origin in the full header.

    • One other detection method not specifically called out is via email headers. Often times automated emails are sent from the same origin IP (not always, of course). Even if the email is routed through an email service before delivery, you can still see the origin in the full header.

      Dang, you beat me to it. :)

      I posted a slightly longer explanation, but yes, you are exactly right. Email confirmation messages can reveal the IP.

  • All of what they described is true, plus one that they didn't cover explicitly.

    Even if you have your site behind something like cloudflare, if you allow people to sign up for an account and your site sends a confirmation email, that email can reveal the source IP.

    I've experienced this with one of my sites that had became somewhat popular. The owner of a competing site got his panties in a twist over the fact that my site was doing better and he started to DDOS my site. I changed the IP of my site and put it

  • Only applies to 'Proxied' Cloud DDOS services (Score:4, Informative)

    by cdogg4ya ( 198266 ) on Sunday October 11, 2015 @09:49AM (#50703843) Homepage

    This only applies if you are using a proxied service instead of a routed or tunneled service where you can't route around the proxy scrubbers. Most carrier DDOS service offerings allow you to route the traffic either through BGP steering or GRE tunneling such that your traffic must pass through the Cloud DDOS scrubbing center because the 'real' ip is routed that way.

  • I actually work for one of the DDoS mitigation providers mentioned in this research paper. (Incapsula)

    Speaking as an "insider" I can tell you that, while the statistical study is very interesting, none of the origin-exposing vectors it mentions are particularly new.

    In fact all of these could be countered by few well-known best practices, which we are suggesting for years.

    I've put up a list of things you can do to immunize your website from origin-exposing attacks. https://www.incapsula.com/blog... [incapsula.com]

Slashdot Top Deals

Your own mileage may vary.

Close