제20회_해킹방지워크샵_(이재석)

Size: px

Start display at page:

Download "제20회_해킹방지워크샵_(이재석)"

무열 윤
7 years ago
Views:

1 IoT DDoS DNS (

2 DDoS DNS DDoS /

3 DDoS(Distributed DoS)? B Asia Broadband B Bots connect to a C&C to create an overlay network (botnet) C&C Provider JP Corp. Bye Bye! Systems Become Infected Internet Backbone Bots attack B BM B B Europe Corp B B Controller Botnet master Connects Issues attack Command US Broadband The Peaceful Village 3

4 DDoS : akamai : akamai 4

5 상품화된 DDoS 공격 서비스 5

6 IoT DDoS 6

7 IoT DDoS : dyn Mirai Botnet zombie IoT DDoS -. default user/password, TCP 23/2323 port -. rebooting malware Mirai Botnet DDoS -. SYN flooding -. UDP flooding -. VSE query flooding -. GRE flooding -. ACK flooding -. Water Torture attack : -. HTTP GET,POST,HEAD attack -. IP (spoofed) DDoS. -. source code 7

8 DDoS DNS DDoS /

9 DNS(Domain Name Server) domain name IP Hierachical 9

10 DNS(Domain Name Server) DNS Query Header Format & Query Type identification flags number of questions number of answer RRs number of authority RRs number of additional RRs 12 bytes query name query type query class type value function type value function A 1 IPv4 address PTR 12 pointer record AAAA 28 IPv6 address MX 15 mail exchange record NS 2 name server TXT 16 readable information CNAME 5 canonical name ANY 255 all records 10

DNS(Domain Name Server) Host www.naver.com 변환요청 www.g.naver.com의 IP주소 Resolver DNS www.naver.com 변환요청 com 담당서버 www.naver.com 변환요청 naver.com 담당서버 www.naver.com 변환요청 g.

11 DNS(Domain Name Server) Host 변환요청 IP주소 Resolver DNS 변환요청 com 담당서버 변환요청 naver.com 담당서버 변환요청 g.naver.com 담당서버 Root ns.com 변환요청 ns.naver.com 의 IP 주소 ns.g.naver.com Recursion query 11 Iterative query

12 Simple Flooding ICMP, UDP Flooding -. DNS ISP n 4 ISP A Access Router Much BIGGER Attack 6 Mbps DDoS - teeny tiny attack - well, to Transit ISP, not ISP A GE 10G Collateral Transit Target Damage ISP Target Gone 5 1M Attack 6 Fragmented Flooding -. fragmented packet DNS Resource 12

13 Simple Flooding DNS Query Flooding -. FQDN Query DNS Resource Zombie PC Authoritative Server (sherpain.net) Zombie PC Authoritative Server (sherpain.net) 13

14 DNS Reflection/Amplification hacking & put large garbage record Authoritative Server (sherpain.net) net domain root domain Command DDoS to Botnet Recursive DNS Server spoofed TXT or ANY type query x n Query n Bot Botnet 14 Victim ( )

15 DNS Reflection/Amplification Authoritative Server (sherpain.net) Recursive DNS Server (caching) 1) x n Reply 2) TXT Record n Bot Botnet 15 Victim ( )

16 DNS Water Torture Attack Authoritative Server (sherpain.net) Authoritative Server (sherpain_networks.net) Authoritative Server (sherpa-in.net) Command DDoS to Botnet Recursive DNS Server n Bot Botnet Spoofed or Non-Spoofed 16 random subdomain query abc.sherpain.net xysdfsd.sherpain.net ssdfsdf sher.sherpain.net

17 DNS Water Torture Attack Authoritative Server (sherpain.net) Authoritative Server (sherpain_networks.net) Authoritative Server (sherpa-in.net) Recursive DNS Server n Bot Botnet 17

18 Phantom Domain Attack making phantom domain Root Server Phantom Domain Servers Phantom Phantom1 Phantom2 Phantom3 Phantomxxxx Command DDoS to Botnet Response : phantom.com is Query : Query : never answer to the question Recursive DNS Server Query : Query : Query : Query : Query : n Bot Botnet 18

19 DDoS : Out-of-Path vs. Inline Out-of-Path :, DDoS 2 Inline : L7 DDoS / : DNS ACL IX #1 IX #2 Sinkhole DDoS L4 L4 DNS Server Farm 19 DNS Server Farm

20 DDoS DNS DDoS /

21 IoT 21

22 Spoofing 22

23 Zombie PC ( ) (?) NXDOMAIN Querier 23

24 DNS DDoS Out-of-Path + In-line -. OOP DDoS -. In-line IX #1 IX #2 IX Netflow/sflow DDoS Sinkhole DDoS L4 DDoS 24 DNS Server Farm

25 Q n A jaeseog@sherpain.net 25

KISA-GD

KISA-GD KISA-GD-2011-0002 2011.9 1) RD(Recursive Desired) 플래그 : 리커시브네임서버로하여금재귀적 (recursive) 질의 ( 항목 1.3. 참고 ) 요청을표시함. RD 플레그값이 0 이면반복적 (iterative) 질의를요청 2) AA 플래그 : Authoritative Answer 의약자로써, 네임서버가해당응답데이터를자신이보유하고있는지유무를표시