8

We are receiving a large load of connections, over 10 million per day, over multiple ports (80, 443, 8080, 8888, and 4072).

This has been going on for 4 days now and it does not look like it is going down.

99.9% of those are blocked at our firewall, a few go to Apache. It is difficult to say how much of our system it uses, I would say less than 3%.

Now, it feels like the attack is not going to stop by itself any time soon. Once you protected your system, do you generally contact the ISPs that "participate" in the attack to ask them to stop the offenders?

The attack encompasses well over 2,000 IP addresses from many different providers. So it looks like a rather daunting task to work on such a large number of people, especially because they generally are suspicious of you rather than the attackers/offenders... (i.e. maybe I'm trying to stop a competitor's business and not a hacker.)

Would there instead be a blacklist place were I can provide all the offending IP addresses?

  • Why is some of the traffic blocked at the firewall? Too many connection reqs per IP? Can it inspect the HTTP request/response? Is the same resource being accessed (slashdot effect) or different resources? – user2320464 Oct 21 '16 at 17:38
  • 3
    @user2320464 The greatest amount of the hits target port 8080 and 8888 which are blocked by default since we do not open such. They are trying (from what I can tell on port 80 and 443) to run through a proxy. The GET is followed by a URI instead of just a path. – Alexis Wilke Oct 21 '16 at 19:38
  • 4
    @Alexis.... As traffic is coming on port 8080 and 8888 (and on these ports you are not running public service), then there are two outcomes of this - 1. Random attack and it may fade away with time 2. Attacker may want to choke your internet link – Gaurav Kansal Oct 22 '16 at 2:46
  • 2
    And attacker can change the pattern also, means they can generate an attack on port 80 & 443 also. And if this happens, then it will be tough for you to protect your server. – Gaurav Kansal Oct 22 '16 at 2:48
4

Its not just like this, you should always report such incidents to abuse mail ids of concerned infrastructure.

Many a times the machines involved in DDoS is not known to the owner of the machine, like for ex :-
1. person hosted DNS server and unknowingly left it open for world (open resolver kind of stuff).
2. machine is under the control of RAT or TROJAN

Informing such incidents will help all of us to overall reduce the impact of DDoS which has gone up to 1 Tbps in the recent past.

Moreover you can contribute to centralised repositories too.

  • Yes. I can see that the GET they send to the HTTP server are Proxy Requests. So they were hoping to get an open HTTP proxy... About centralized repositories, do you know of such? I can easily find some for emails, but for DDoS I have not found something of much interest yet. – Alexis Wilke Oct 21 '16 at 19:49
4

In DDoS attack, most of the traffic (in majority of the cases) is of UDP, which is a connection-less protocol. Connectionless means, anyone can spoof anyone else IP address and can send a packet to you.

For example - I can send a UDP packet towards your server with a source IP of google.com (or from any other IP).

In case, you are receiving a TCP session/traffic on your server (traffic which you are considering as a malicious traffic), then you can collect the complete logs with the proper timestamps and can send the same to the ISP.

I works for one of the large ISP in my region and we generally use to receive lots of unwanted traffic from across the world and we report the same to the originator.

Reporting of abuse traffic is done in below mentioned manner --
Collect the logs of the malicious traffic and send it to the abuse handling team of the corresponding originator IP address. You can easily find out the details of the abuse handling team on Incident Response Team section of the WHOIS data of the originating IP address.

As far as your concern of having lot many IP addresses as the originator of the malicious traffic, there are many open source tool available which can parse the logs, do the whois and can send a mail to the originator. And writing a code for this is also not a big task; it can be done in-house also.

Now comes the last part of your query, about the blacklist place where you can submit these IP addresses; There is no such place, if we talk in plain vanilla language. But what you can do is, you can ask your Upstream provider to block traffic from those IP addresses towards your network (if you want to block those IP addresses for your network). There can be a side-effects of this approach also. so please think before blocking the addresses completely.
Also, you can collaborate with IT security companies for further analysing of the traffic.

Hope this explains the things!!!

  • I've rarely seen an abuse email in the WHOIS database. But that's a good idea to check there first, I suppose. Much faster than looking for such on their website! – Alexis Wilke Oct 21 '16 at 19:45
  • And at this point my UDP traffic is very small. – Alexis Wilke Oct 21 '16 at 19:46
  • 1
    @alexis.... Just see the IRT section of whois data. – Gaurav Kansal Oct 22 '16 at 1:46
  • 2
    If majority of the traffic is TCP, then it somehow a good news as we can be sure that originator's IP address is not spoofed. Try to inform the originator as a best practice and generally this helps. – Gaurav Kansal Oct 22 '16 at 2:42
-5

Reporting it is quite pointless. The "offenders" are very likely part of a botnet, so they aren't even aware they are part of the attack.

In many jurisdictions, privacy laws forbid ISPs from even looking at the traffic of their customers without a search warrant, so they can not confirm your accusation. And besides, they have better things to do than alienate their paying customers for you.

  • So more or less what I've done so far is the extend of it... Oh, well... – Alexis Wilke Oct 19 '16 at 22:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.