2007年爱沙尼亚网络攻击：最致命的七种防御挑战

需积分: 9 126 浏览量更新于2024-07-18 收藏 6MB PDF 举报

"《七大致命网络攻击》是一本探讨网络安全领域中最危险的七种攻击类型的英文电子书。该章节详细介绍了DoS（拒绝服务）攻击的原理、其带来的严重后果以及防御措施。2007年4月26日，爱沙尼亚遭受了一次大规模的DoS攻击，全国范围内的互联网服务几乎瘫痪，包括政府机构、银行系统、新闻媒体和民众日常生活都受到了严重影响。尽管爱沙尼亚在数字化方面处于欧洲前沿，通过Tiigrihüpe项目实现了高度联网，但这次攻击揭示了即使是最先进的基础设施也难以抵挡此类攻击。 DoS攻击的原理在于通过向目标服务器发送大量无效请求，消耗其系统资源，导致合法用户无法访问服务。它可能看似无足轻重，但实际上对依赖互联网运营的业务来说，一旦发生，可能会造成严重的经济损失和信任危机。防御DoS攻击的方法通常包括但不限于升级防火墙规则、采用负载均衡技术、实施流量清洗和部署DDoS防护设备。此外，章节还提到了防范DoS攻击的未来趋势，即随着技术发展，新的攻击手段和防御策略将持续演变。这包括利用机器学习和人工智能来识别异常流量，以及采用零信任安全模型，以最小化攻击面。随着网络攻击的复杂性和频率的增加，保持网络安全的更新和适应性变得至关重要。这一章节深入剖析了DoS攻击的危害，强调了网络安全的重要性，并提供了针对这种威胁的防御策略。对于任何关注网络安全的组织和个人而言，理解和掌握这些关键知识点是确保网络环境稳定和数据安全的基础。"

CHAPTER 1 Denial of Service16

DDoS Appliances

DDoS appliances are network hardware with specialized ﬁrmware to detect anoma-

lous network trafﬁc and divert or drop that trafﬁc to mitigate a DDoS attack. Many

models also offer screening of outbound trafﬁc, so that you aren’t the source of a

DDoS attack. Cisco Systems, Inc,

RioRey, Inc.,

Top Layer Security, Inc.,

and

others sell DDoS appliances.

These appliances rely on detecting anomalous network trafﬁc. While it is easy

for legitimate users to generate legitimate-looking trafﬁc, automatically generated

trafﬁc tends to have statistical characteristics that make it easier to spot. As a simple

example, if your server is receiving a series of requests for a login from a particular

host, all faster than any human could type, this trafﬁc is probably part of a DDoS

attack and can be dropped.

This approach has limits. If you know the method used to detect the anomalous

trafﬁc, you can work around it and still achieve the desired effect. For example, with

more machines you can send requests to log in more slowly from each machine, but

maintain the same overall rate. One way to do this is to simply purchase your vic-

tim’s DDoS appliance, or network monitoring software, install it, and then craft your

attack so that it is not detected. Despite these limits, deploying software or hardware

to detect and block DDoS trafﬁc can prevent many DDoS attacks.

www.cisco.com/

www riorey.com/

www.toplayer.com/

Address Use

0.0.0.0/32

See RFC-1700.

10.0.0.0/8

Private network addresses, as per RFC-1918.

127.0.0.0/8

Loopback addresses, as per RFC-1700.

169.254.0.0/16

“Link local” block. These addresses are typically assigned when

another address cannot be obtained, such as when DHCP fails.

172.16.0.0/12

Private network addresses, as per RFC-1918.

192.0.2.0/24

Test network addresses. These addresses are for use in example

code or documentation.

192.88.99.0/24

These addresses are reserved for relay anycast. See RFC-3068.

192.168.0.0/16

Private network addresses, as per RFC-1918.

192.18.0.0/15

Reserved for benchmarking tests of network devices, as per

RFC-2544.

224.0.0.0/4

Reserved for IPv4 multicast. See RFC-3171.

240.0.0.0/4

The original class E address space is still reserved. This includes

the special address 255.255.255.255 used for limited broadcast.

See RFC-1700.

Table 1.1 AddressesnotontheInternet

CHAPTER 1 Denial of Service18

respond to intrusion attempts and block them transforms this system into one known

as an intrusion prevention system (IPS).

Another strategy for detecting intrusion attempts is to create a honeypot. A hon-

eypot is a carefully monitored machine or address that is used only to detect attacks.

Normal, legitimate trafﬁc is never directed to the honeypot machine, so any trafﬁc

that is detected at the honeypot is likely malicious trafﬁc. Thus, by monitoring the

honeypot, an IDS can detect when a network intrusion is being attempted. A simple

example of a honeypot is an e-mail address created for the sole purpose of collecting

spam. Since the e-mail address does not go to any legitimate recipient, any e-mail

that arrives at the address is spam, and should be ﬁltered from the rest of the e-mail.

Project Honey Pot uses exactly this technique to monitor spammers.

Reacting to DDoS Attacks

Once a DDoS attack is underway, you have several options. You can attempt to block

the hosts generating the trafﬁc. Because of spooﬁng and the large number of hosts

used in a DDoS attack, this may be difﬁcult.

To block hosts, you must ﬁrst identify them. If you are running an IDS, you will

already have a list of addresses provided by the tool. Otherwise, you have to capture

network trafﬁc and analyze it. To capture network trafﬁc, you can use tcpdump.

This

is a packet sniffer that can observe and record network trafﬁc on an interface.

In the following example, we capture 1,000 packets using tcpdump.

$ tcpdump –c 1000 –w record.tcp eth0

tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture

size 96 bytes

1000 packets captured

1000 packets received by ﬁlter

0 packets dropped by kernel

An easier way to analyze network trafﬁc is to use an actual network trafﬁc

analyzer, such as Wireshark.

Wireshark is available for most platforms and is rela-

tively easy to use. Figure 1.5 shows packets captured using Wireshark.

It is also possible to conﬁgure some routers to provide this information. Cisco

routers, for instance, keep a total of the number of times each rule is matched. In the

following, we create a rule to match echo and one to match echo reply (pings).

access-list 169 permit icmp any any echo

access-list 169 permit icmp any any echo-reply

Including log-input at the end of a rule will also create a log of matching network

trafﬁc. Use show log to see the log. We can now get the number of times each rule is

matched via the show access-list command, which gives the number of times each

rule is matched by network trafﬁc.

http://projecthoneypot.org/

While tcpdump is common on UNIX and Linux machines, on Windows you can use WinDump, an

open-source clone of tcpdump.

www.wireshark.org/

CHAPTER 1 Denial of Service20

An alternative if you use an ISP is to purchase additional capacity for the duration

of the DDoS attack. This adaptive provisioning can be provided via burstable circuits,

which can carry additional capacity if necessary. You typically pay a rate based on

your average use of the connection. Since attackers often “tune” the attack while it is

in progress, you will still need to carefully monitor the attack to determine how best

to respond. For example, an attack may change from trying to overload a server to

exploiting a network protocol.

THE FUTURE OF DENIAL OF SERVICE

Malware is now big business, and operating botnets has become a source of signiﬁ-

cant income. Developing a large botnet is a ﬁnancial investment. Likewise, consider-

able economic activity is moving onto the Internet, with some companies completely

dependent on the Internet for their business, including Google and Amazon.com. All

this creates a marketplace to supply more advanced attack and defense capabilities.

Attack

Based in St. Petersburg, the Russian Business Network (RBN) is a hosting organiza-

tion that offers “bulletproof ” hosting and a variety of other services, including botnet

rental, so you don’t even need to create your own botnet.

If you can lease time on

an existing botnet, and use it effectively for a DDoS attack, you have successfully

reduced a technical challenge to a simple matter of paying some money.

This is probably the shape of the future in DDoS. Creating and controlling a large

botnet is still somewhat challenging, and also presents legal risks. It is also the case

that botnets can be “hijacked” if someone else, perhaps another criminal enterprise,

gets access to the command and control channels.

Current trends show that the malware world is becoming less vertically integrated

and more specialized. Many components of successful malware are not, by them-

selves, illegal. It is thus perfectly reasonable to set up shop and develop and sell

software to enable DDoS attacks, so long as the software has a potential legal appli-

cation, as well. For example, software used to protect intellectual property and thwart

reverse engineering can also be used to harden malware against reverse engineering,

making it hard to discover just what a particular kind of malware is doing, and how

to counteract it. Digital rights management (DRM) techniques can cloak a malware

payload until the time arrives to launch a DDoS attack. While the tools to conduct a

DDoS attack are improving, fortunately so are the tools to defend against an attack.

RBN is the originator of the MPack malware kit, which you can purchase for between $500 and

$1000 (at the time of writing). Included with this kit is technical support and regular updates to the

vulnerabilities it can exploit. Additional functionality can be purchased to target speciﬁc vulnerabilities

or to cloak the software against antimalware and antivirus programs. MPack includes a Web-based

management console to allow you to track its progress as it infects machines.

剩余136页未读，继续阅读

-Q-

粉丝: 13
资源: 18

2007年爱沙尼亚网络攻击：最致命的七种防御挑战

HMI-S71200使用手册V1.2.pdf OPC PLC

基于LVS+keepalived群集

东软NetEye Web应用防护系统（WAF）快速配置手册_2016

Seven Deadliest Social Network Attacks

seven deadliest web application attacks

Seven_Deadliest_Web_Attacks

1基于STM32的智能气象站项目.docx

技术资料分享SH-HC-05蓝牙模块技术手册很好的技术资料.zip

【路径规划】改进的人工势场算法机器人避障路径规划【含Matlab源码 1151期】.zip

链表HuffmanTree.zip

最新资源