Identifying DDoS Attack Traffic on a Corporate Network
19/10/2023
By Lizzette Pérez, Computer Weekly Executive Editor for Latin America
Originally published in Computer Weekly on 3 October 2023
During the first day of LACNOG 2023, an expert explained how traffic from denial-of-service attacks can be detected and shared some tools that can help with this task.
Fortaleza, Brazil. – LACNIC 40 is being held this week in Northern Brazil. Within the framework of this event, the Latin American and Caribbean Network Operators Group (LACNOG) has scheduled various working sessions.
Highlights of LACNOG 2023 include the conference by Rich Compton, member of the Latin American and Caribbean Anti-Abuse Working Group (LAC-AAWG), who gave a remote presentation on how to identify spoofed Denial-of-Service (DDoS) amplification attacks in a network.
Rich Compton is an expert on DDoS attack detection and mitigation, botnet control, and BGP security who works at Charter Communications, where he is responsible for network infrastructure security.
In his presentation, Compton explained that the most common UDP DDoS amplifications include DDoS attacks on DNS, NTP, WS-Discovery, LDAP, Apple Remote Desktop, Multicast DNS (mDNS), and Plex. Amplifications have also been observed using only SYN/ACK, PSH, and RST.
(Free access, no subscription required)
According to the expert, TCP Middlebox Amplification is a new type of attack that began to be noticed recently. In his opinion this type of threat should actually be called “HTTP Middlebox Amplification,” as it attacks the middleboxes on the network by sending large amounts of HTTP traffic so that some packets will be lost, and then injecting traffic to block the connections. In this case, pornographic content is typically used, he explained.
Why is this such a problem? According to the speaker, when customers with open amplifier have slow internet speed, they usually contact customer service. However, if no unusual activity is detected, the suggestion will be to purchase more bandwidth, which does not solve the problem and can sometimes affect other customers.
“New vulnerable devices are added to the network every day. We can’t get everyone to fix their devices. And even if 99% of devices are fixed, the remaining 1% will still be a problem,” Compton said.
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of LACNIC.