Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is there any way in which you can stop a DDoS attack(or any measure that you can take), if the packets sent by the attacker look like normal traffic?
I got the question on an interview (how would you block a DDoS attack if the malicious traffic looks like the normal traffic?) and I didn't knew how to answer.
Thank you very much!
In most cases, it is very hard to mitigate DDoS attacks on your own. Most banks and large companies will engage the service of professional DDoS mitigation service providers. The latter will detect anomaly traffic patterns and reroute all traffic to their scrubbing centers for filtering out the bad traffic. The following filtering-based mechanisms are commonly used to mitigate such attacks:
1) Whitelisting recognized IP addresses. e.g., if your company is located in the US and so are most of your clients located, then it could be reasonable to filter our network traffic coming from other parts of the world during an attack so that most of your clients can still be able to access your service.
2) Blacklisting traffic coming from known "spammer" regions.
3) Deploy progressive challenge mechanism like CAPTCHA to prove that the traffic came from a human source and not some program.
4) Rate limiting by destination IP address. Each IP address is only allowed to send a fixed number of requests and the rest of the requests will be simply dropped.
5) Signature-based anomaly detection and subsequent IP blocking. Even if the malicious packets appear normal, there could still exist distinct patterns in the overall traffic. e.g., an average user will only send traffic continuously for 5 minutes each day but the traffic sent by the attacker just keep coming in for long periods of time.
And finally, increase your network resources to survive the attack or temporary rent extra cloud-based resources to "absorb" the attack. Such a counter measurement is used by DDoS Mitigation service providers like Incapsula, Akamai and Verisign to prevent themselves from becoming victims.
Use of a scrubbing provider can potentially help, depending on the type of "normal" traffic and how much control you have over it. In the best case, that traffic would be human-initiated http or https traffic, and scrubbing could consist of using JavaScript based tests and CAPTCHA spash screens to whitelist the legitimate traffic.
If the legitimate traffic is also machine generated, then you look for quirks in the implementations to differentiate the traffic, and you exploit those to fingerprint the traffic. Generate errors, fingerprint based on the reaction. Chances are, the attacker did not build a complete, robust implementation of whatever application legitimately generates that traffic, and so you might be able differentiate by how the legitimate application handles errors and produce whitelists from that to use in scrubbing.
If all other means of identifying the traffic fail, there's still a fair chance that the bulk of traffic is concentrated within certain source networks, In which case, you can identify what interface is being saturated, contact the upstream provider for that interface, and have them do the same, repeating on down the line until the heaviest source ranges of the attack can be identified with some degree of accuracy, and route advertisements can be selectively withdrawn.
Another useful means to counteract on your own (without the need for third party services), is to specify low DNS' A record TTLs, which will allow the victim to direct traffic somewhere else relatively quickly.
