6

Does a Unified Threat Management appliance (UTM) with Intrusion Prevention (IPS) enabled have the ability to prevent a DDoS attack? I have read some articles and none of them have a perfect explanation.

  • Not sure why it would need to have IPS enabled? A DDoS doesn't usually require getting into a system. – S.L. Barth Apr 29 '15 at 10:48
  • Also, welcome to Stack Exchange! You may want to link, or at least mention, the articles you read. If you can explain how these articles failed to answer your question, that would improve your post even more. You can use the "edit" link below your to edit your question. – S.L. Barth Apr 29 '15 at 10:53
13

No, generally not, although of course they say they can.

  1. DDoS is about volume
  2. UTM is almost always at the local end of Internet access
  3. Therefore, DDoS can usually fill the Internet pipe before even reaching a UTM device.

The reasoning -

By definition a DDoS - being Distributed - is taking advantage of multiple attack points to generate a level of traffic which overwhelms the victim. Unlike a DoS, which may rely upon clever tricks and fragile IP stacks to cause problems based on the parsing of traffic, a DDoS is all about the volume.

Let's say that you've got a big site sitting at the end of a 10 Gigabit link. Your ISP, of course, can handle much higher volume, but when their router connects to your router, they're only allowing 10 Gbps through.

Now an attacker sends 321 Gbps of traffic to you. What's your UTM going to do? It can only work with the meager 10 Gbps trickle, and the most it can do is turn it away - but at that point, the damage has already been done. Your legitimate traffic is already disrupted and probably not making it in to you because the line is busy.

For protection from DDoS, you need to turn to someone like Prolexic (now part of Akamai, but Akamai does other stuff too, so I use their old name to reduce ambiguity). These providers have massive bandwidth, and during an attack your re-route your traffic through them, and only they're allowed to send traffic along to you. They can buffer the attack and try to identify and drop the bad traffic before it traverses your puny 10 Gig link.

I don't doubt many UTM devices still say they can help with DDoS. My car also claims to be rustproof, but I've got rust spots. A true DDoS can't be mitigated at the endpoint, and UTMs are almost always at the endpoint.

  • Not all DDoS is about volume. There are application level attacks (e.g. misuse of range header like in CVE2011-3191 or MS15-034) which don't need much bandwith and can also be triggered from a botnet, i.e. distributed. See also pcworld.com/article/2056805/… – Steffen Ullrich Apr 29 '15 at 14:52
  • 3
    We (as an industry) need better terminology. There is no specific catchy acronym for "volume-based attack leveraging multiple sources", so "DDoS" is the closest we have and that's what it is usually presumed to mean. And, yes, a standard parser DoS attack can be performed by bots, but does that make it a DDoS? CVE2011-3191 says "a modest number of requests can cause very significant memory and CPU usage" so it doesn't need a botnet. (Not agreeing or disagreeing with you here - exploring the implicit and explicit assumptions we make around these terms and activitites). – gowenfawr Apr 29 '15 at 15:03
  • @gowenfawr: And then how would you classify a "resource exhaustion due to half-open connections" attack? What about when the target has countermeasures only tracking a certain number of half-open connections per peer? (Assume that a full mitigation involving stateless cookies is not implemented.) Now a large number of peers are needed to execute the attack, but overall traffic volume remains low. – Ben Voigt Apr 29 '15 at 15:23
  • @BenVoigt I would not characterize that as a DDoS, but I'm sure opinions will vary. – gowenfawr Apr 29 '15 at 16:19
  • 1
    @BenVoigt To me "half-open connections" sound like a SYN-flood, but I assume that is not what you had in mind. After all if that is all you need to protect against, then SYN cookies will mostly solve the problem. If you are concerned with connections which have completed a three-way handshake after which the client simply went silent, then I am not aware of a more specific term than DoS attack. – kasperd Apr 29 '15 at 17:03
1

No single measure can effectively prevent DDoS attacks. You can, however, reroute traffic or reconfigure the network infrastructure (both logical and physical, which might cause a bit of an overhead, but still, availability is key) in attempt to still deliver your content and reduce the incoming DDoS traffic.

The reason why DDoS is such a lingering threat is that, besides from its source being external to your data center, DDoS traffic can also come from within the data center. As such, IDS and IPS, which are traditionally placed at the borders, are both useless in this case. The following is a scenario in which internal DDoS attacks can happen and that alternate preventive mechanisms are needed:

A number of data centers are under-provisioned, which means an uplink connecting multiple subnets have the same transmitting capacity as does a single device residing in each of the subnets. As a result, if four machines start pushing out 1 GB of data each over a 1-GB uplink, the link will be saturated and effectively disconnecting the associated subnets from the rest of the data center. That is an internal DDoS - maybe one by poor architectural design in this case. However, utilizing this design weakness, attackers can simply identify one of these under-provisioned uplinks and the connected subnets, legitimately sign up for an account (say, at Amazon EC2) to host some virtual machines in it, and begin transmitting data to a targeted machine in an adjacent subnet via the vulnerable link. The result is a DDoS attack. There would be no way of telling it is going to happen. No single protective measures can instantaneously "block" the coming traffic.

Some data centers implement the heartbeat protocol to detect congestion. Congestion might happen at the point the novice attacker is probing for vulnerable subnets to flood them, so ideally this is the stage when you should begin rerouting your traffic and reconfiguring the network. However, experienced attackers will be careful in not completely flooding the network with probes. As a result, heartbeat will not detect unusual amount of traffic and therefore will not activate a standby.

1

Actually, the question is about can or cannot, not about how or how much, and therefore IDS and UTM systems claims some level of DDoS defense. Not complete defense, because in theory there is no complete defense against DDoS attack. Almost every modern firewall and intrusion protection system (IPS) claims some level of DDoS defense.

Some Unified Threat Management (UTM) devices or Next Generation Firewalls (NGFWs) offer Anti-DDoS services and can mitigate many DDoS attacks.

UTM devices and IPS devices can effectively identify the DDoS attack messages through use of advanced techniques, most of these devices are usually designed to conduct in-depth stateful inspection of all the messages.

  • 1
    They claim to provide DDoS protection, but they can't follow through. An attacker can always simply overwhelm the device by throwing data faster than it can be dropped. – Mark Apr 30 '15 at 0:08
  • The original question is about can or cannot prevent and attack, not simply to defend, resist, or reduce. – schroeder Apr 30 '15 at 4:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.