Hello, my name is Bruno Cerqueira, I’m a network analyst here at Made4it and today I’m going to explain about DDoS attacks and some ways to protect your company from these attacks.

First and foremost, it is important to understand what “Denial of Service” means and what the consequences of such an attack are. A “Denial of Service” attack is an attempt to make a system’s resources unavailable to its users. Its main targets are web servers, routers, Layer 3 switches, or any device with a public IP address.

Two of the best-known consequences of DDoS attacks:

> Consuming all of the host’s resources (such as memory and CPU), to the point where the system can no longer be used (such as a web server that is unavailable)

> Use all available bandwidth between users and the system, so that the Host does not communicate correctly with the user.

Now that you know what “DoS – Denial of Service” is, you need to know “DDoS – Distributed Denial of Service”, which translates as Distributed Denial of Service, that is, the attack comes from several different sources. DDoS can be commanded from a computer that sends orders to thousands of infected devices, such as computers, cameras, IPTV systems, servers, creating an army of enslaved machines, generating attacks on one or several target IPs. And these compromised equipment are called ‘botnets’, which can steal data, send spam and also carry out DDoS attacks. To better understand what DDoS attacks are, go to this content where we explain what they are and the main reasons for attacks

There are several types of DDoS attacks, the most well-known being:

Distributed Attack:

It is characterized by an attack originating from several different locations, all targeting a common destination, with the purpose of exhausting all the resources of the target host or using up all available bandwidth, thereby preventing the host from connecting to other devices on the Internet. This type of attack can also affect other company devices, such as routers and switches along the path to the target host.

Amplification Attack:

As the name suggests, the purpose of this attack is to amplify the amount of traffic reaching a given network. It is quite common in this type of attack for the packet’s source IP address not to match the original IP address—a practice known as spoofing— allowing the attacker to send thousands of requests to a server using a forged source IP address, causing the server to respond to the request and send multiple responses to a host that did not make any request to that server. The key to this type of attack is to use DNS, NTP, and other servers that can amplify the packet size. If the source sends a request of 64 bytes, the server might respond with 640 bytes, for example, amplifying the attack size by a factor of 10 and making the attack more effective.

There are still several other types of attacks, some that can abuse a vulnerability of a specific equipment, making it a new equipment to generate attack or it can consume all available resources of that equipment, so that it becomes inoperative for other services.

And now, what do we do to protect the network from these DDoS attacks?

Just as there are tools used by attackers, we also have tools and methods to protect the service provider or company.

What we need is to mitigate the attack, which consists of protecting the target from DDoS attacks. There are several ways to do the mitigation, among them, there are diversion techniques using routing.

The 2 most used are:

• BGP Routing: We can divert traffic to a mitigation service that will analyze the traffic and allow only legitimate traffic to pass through
• DNS routing: We can point the IP of the mitigation service to the DNS server instead of the real IP. The Mitigation Service will scan traffic and block malicious traffic, redirecting legitimate traffic to the server

Considering routing using BGP, we have some options that the provider or company can use to protect themselves from attacks at the network layer:

• Use of Local Appliance: Detects and directs traffic to a local server for protection.
  • Advantage:
    • Does not require purchase of Link Protected or Link Clean Pipe

• IP Advertisement via BGP for Blackhole: Makes an IP unusable on the internet!
  • Advantage:
    • Does not require purchase of Link Protected or Link Clean Pipe

• Disadvantage:
  • Will stop all browsing and connectivity to the advertised IP for Blackhole

• /24 prefix advertisement for Clean Pipe Link/Mitigation Link/Anti-DDoS Link/Protected Link
  • Advantage:
    • It will not stop connectivity from any of the IPs on the network

• Disadvantage:
  • Depending on the solution purchased, latency may increase

• Use of 100% protected link
  • Advantage:
    • Does not require any tools for attack detection

• Disadvantage:
  • Higher costs with the use of protected link

How to ensure that your ISP is not the source of a DDoS attack?

Most attacks are done by Amplification, Spoofing, infected equipment, among others. A good practice is to apply settings and firewall to prevent this from happening within your company, such as:

• Configure Recursive DNS Server, NTP, to respond only to your internal network
• Anti Spoofing Filters (known as RPF)
• Firewall blocking service ports towards residential customers (for ISP cases)
• Participate in the MANRS program, so that your network is monitored from the outside
• Track vulnerabilities through the Qrator website
• Avoid using public IP addresses on local servers (using network management software), and if you do have one, you must always keep your software up to date and ensure that a properly configured firewall is in place to protect the services on those servers

And I cannot fail to mention a tool that can detect attacks and take action to protect your network, Made4Flow. If you want more information, you can consult it here.

Anyway, any network on the internet is subject to DDoS attacks, but it is important to always maintain good operational practices, know the types of attacks and the means to protect yourself, in case you are a victim of this crime one day.