Speaker 1: Hey there, and welcome to the deep dive. This is
Speaker 1: where we take complex topics and well really dive into
Speaker 1: them for you. We try to bring you the most
Speaker 1: crucial insights, maybe some surprising facts along the way. Today
Speaker 1: we're tackling something that can bring entire online services just
Speaker 1: grinding to a halt. You can disrupt critical infrastructure and
Speaker 1: it's even used in believe it or not, cyber warfare.
Speaker 1: We're talking distributed denial of service ATTACKSS.
Speaker 2: Yeah, it's a phenomenon that's really evolved dramatically since the
Speaker 2: early Internet days. It's become this persistent threat and honestly
Speaker 2: a pretty financially impactful one too. For this deep dive,
Speaker 2: our insights are coming from a really comprehensive source, the
Speaker 2: textbook Distributed Denial of Service Attacks, Real World Detection and
Speaker 2: Mitigation by A. Luker Esselek and Richard Arbrooks.
Speaker 1: Right, So, our mission today is to truly unpack what
Speaker 1: DEAs attacks actually are. You know, why there's still such
Speaker 1: a big problem. We'll get into how these attacks are
Speaker 1: executed and maybe more importantly, what cutting edge strategies are
Speaker 1: out there to detect and mitigate them. Hopefully you'll walk
Speaker 1: away from this well informed, maybe ready to understand those
Speaker 1: headlines a bit better and perhaps with a new appreciation
Speaker 1: for just how complex our digital world is under the hood. Okay,
Speaker 1: so let's unpack this core idea first. When we talk
Speaker 1: about Adidas attack, it's way more than just a website
Speaker 1: crashing temporarily. It's about deliberately denying you, the legitimate user
Speaker 1: access access to an online service or a system. Think
Speaker 1: of it maybe like a digital sit in. Instead of
Speaker 1: blocking a physical door, attackers or just flooding the digital
Speaker 1: entrance to a server making it impossible for anyone else.
Speaker 2: To get in exactly. That's a great analogy. The core
Speaker 2: goal is what we call resource saturation. Attackers basically try
Speaker 2: to consume as much of a victim's critical resources as
Speaker 2: they possibly can. That could be system resources think CPU memory,
Speaker 2: disk space, or network resources like bandwidth, just overwhelming them.
Speaker 2: And what's really striking, I think, is how the motivations
Speaker 2: behind these attacks have changed over time. You know, initially
Speaker 2: it might have just been curiosity pranks even but today
Speaker 2: we're seeing highly organized criminal enterprises, geopolitical aims, even nation
Speaker 2: states getting involved.
Speaker 1: That evolution is pretty stark, isn't it. From like you
Speaker 1: said pranks to actual cyber warfare between nations. It really
Speaker 1: makes you wonder, with how much we rely on the internet. Now,
Speaker 1: why is this still such an ongoing issue. Why is
Speaker 1: it so impactful economically socially? What makes DDAs so hard
Speaker 1: to stop?
Speaker 2: Well, the sources point to three sort of fundamental reasons. First,
Speaker 2: they're relatively easy for attackers to actually pull off. The
Speaker 2: tools and resources are unfortunately quite available. Second, it's incredibly
Speaker 2: difficult to identify and trace the actual attackers. They have
Speaker 2: a lot of anonymity. And Third, despite all the cybersecurity
Speaker 2: advancements we've made, it's still profoundly challenging for organizations to
Speaker 2: fully protect themselves against a really determined, large scale DDoS attack.
Speaker 1: It's interesting too, thinking about the history. The whole idea
Speaker 1: of denial of service actually goes way back, even before computers.
Speaker 1: Groups like the leddie sabotaging automated looms right or civil
Speaker 1: rights movements using sit ins to physically block spaces to disrupt
Speaker 1: normal activities. Digital didas attacks feel almost like a translation
Speaker 1: of that into the network world.
Speaker 2: Indeed, it's a modern echo of those older tactics. The
Speaker 2: first widely documented digital denial of service attack was Back
Speaker 2: in nineteen ninety six, an ISP in New York called
Speaker 2: Panics got hit with something called a syn flood for
Speaker 2: several days.
Speaker 1: S yn flood, what's that exactly?
Speaker 2: Ah right? It exploits the way computers start a connection.
Speaker 2: It's called the TCP three way handshake. The attacker sends
Speaker 2: tons of initial connection requests but never finishes the process,
Speaker 2: so the server gets overwhelmed holding all these half open connections.
Speaker 1: Okay, so just clogging the pipes from the very start exactly.
Speaker 2: And in Panics's case, it was apparently retaliation because they
Speaker 2: installed one of the first spam filters on their email system.
Speaker 1: Wow. So even back then it was about digital disruption
Speaker 1: as a response. But then things got really interesting, didn't they.
Speaker 1: The event that sort of shifted public perception you're.
Speaker 2: Probably thinking of February two thousand. Yeah, that's when DIDOS
Speaker 2: really entered a new era. A fifteen year old from Montreal,
Speaker 2: Michael Calcea, alias Mafia Boy, launched attacks that took down
Speaker 2: huge names Yahoo, Amazon, Dell, eBay, CNN.
Speaker 1: Fifteen years old.
Speaker 2: Yeah, and the estimated damage was just staggering. Figures ranged
Speaker 2: from like seven point five million dollars up to maybe
Speaker 2: one point seven billion dollars.
Speaker 1: Incredible. That must have been a massive wake up call.
Speaker 2: Oh, it absolutely was. The Mafia Boy attack wasn't just big.
Speaker 2: It showed how one person, not even particularly sophisticated technically,
Speaker 2: could cripple Internet giants. It permanently shifted cybersecurity from being
Speaker 2: this niche. It worry to well a national imperative. Funding spiked,
Speaker 2: awareness grew, and the reason we see so many large
Speaker 2: scale attacks today, that's largely down to the rise of botanets.
Speaker 1: Right. Botanets those sound ominous, What are they exactly?
Speaker 2: They're essentially privately run networks of compromised machines, hacked computers, servers,
Speaker 2: even IoT devices now all acting as bots, and the
Speaker 2: services of these botnets, the ability to launch attacks using
Speaker 2: them are often sold online for profit.
Speaker 1: So it's a whole criminal ecosystem built around these things,
Speaker 1: It really is.
Speaker 2: The life cycle usually starts with an initial infection, maybe
Speaker 2: your click a bad link, download something sketchy from a
Speaker 2: P to P network, or open a malicious email attachment.
Speaker 2: Then there's a secondary step where the compromise machine downloads
Speaker 2: the actual botnet software, turns into a functioning bot ready
Speaker 2: to take commands.
Speaker 1: In these networks, they can be set up differently, right
Speaker 1: the command and control, the C and C structure exactly.
Speaker 2: You have different topologies. Some are centralized, with one main
Speaker 2: server calling the shots, easy to manage but also a
Speaker 2: single point of failure. Others use multiple servers, maybe spread
Speaker 2: out geographically or across different legal jurisdictions to make them
Speaker 2: harder to take down. Then you've got decentralized ones using
Speaker 2: peer to peer protocols much harder to disrupt, and even
Speaker 2: hybrid models combining approaches.
Speaker 1: It's quite sophisticated, which leads right into this idea of
Speaker 1: d dos for hire, a service people can buy.
Speaker 2: Disturbingly, yes, there's a thriving market. Back in twenty seventeen,
Speaker 2: you could reportedly buy five minutes of a massive one
Speaker 2: hundred and twenty five gigabits per second attack for just
Speaker 2: five euros.
Speaker 1: Five euros. That's alarmingly accessible, it is.
Speaker 2: And the price for renting these botnets has actually been
Speaker 2: falling by about five percent each year since around twenty fourteen.
Speaker 2: It's just widespread availability competition among the bothereders, the people
Speaker 2: who run the botnets. A really notable example was the
Speaker 2: attack on spam House in March twenty thirteen. Spam House
Speaker 2: tracks spam servers, so they made enemies. That attack hit
Speaker 2: three hundred gbps, which was huge at the time, and
Speaker 2: it was amplified partly by exploiting vulnerabilities in DNS, the
Speaker 2: Internet's phone book, and even by infecting home routers.
Speaker 1: Wow. So beyond just making MONEYDIDOS has also become a
Speaker 1: political weapon, right This activism.
Speaker 2: Phenomenon absolutely Groups like the Electronic Disturbance Theater or EDT.
Speaker 2: They sort of pioneered the idea of virtual sit in
Speaker 2: with a tool called flubnet, basically encouraging online line protests
Speaker 2: via flooding.
Speaker 1: Websites, which raises a tricky question, doesn't it. Where's the
Speaker 1: line between legitimate digital protest, maybe civil disobedience, and just
Speaker 1: illegal destruction.
Speaker 2: That's a critical point and often a blurry line. Legally
Speaker 2: and ethically, you had groups like Anonymous using DDoS their
Speaker 2: project Schnology against Scientology, Operation Titstorm against the Australian Parliament
Speaker 2: over Internet filtering plans, and Operation Payback targeting credit card
Speaker 2: companies because they blocked donations to wiki leagues. From a
Speaker 2: purely legal standpoint, though participating in a DDoS attack is
Speaker 2: considered illegal pretty much everywhere in the US. You have
Speaker 2: the Computer Fraud and Abuse Act. Internationally, the Convention on
Speaker 2: Cybercrime covers.
Speaker 1: It, and then the stakes get even higher when actual
Speaker 1: nation states use these tactics. That really blurs the line
Speaker 1: between cybercrime and well war.
Speaker 2: Definitely. The conflict between Russia and Estonia back in April
Speaker 2: two thousand and seven is often cited as maybe the
Speaker 2: first real cyber war involving DDoS. Then in two thousand
Speaker 2: and eight, Russia launched large scale adido's floods against Georgian
Speaker 2: news and government sites right as a military invasion was happening.
Speaker 2: In Ukraine, there were ddo's attacks in two thousand and
Speaker 2: eight linked to anti NATO feelings, and in twenty fifteen,
Speaker 2: a major hacking incident, likely involving denial of service elements,
Speaker 2: knocked parts of the Ukrainian power grid offline power grids.
Speaker 1: Wow, that's way beyond.
Speaker 2: Websites exactly, and beyond direct attacks. We also see the
Speaker 2: Internet used for widespread censorship, sometimes through related techniques, things
Speaker 2: like BGP hijacking, which messes with the Internet's core routing.
Speaker 2: Remember Pakistan trying to block YouTube in two thousand and eight.
Speaker 1: Vaguely yeah, what happened there?
Speaker 2: They accidentally re routed YouTube traffic globally, making it unavailable
Speaker 2: worldwide for about two hours, a mistake with massive consequences. Similarly,
Speaker 2: Iranian sensors trying to block pornography sites accidentally blocked access
Speaker 2: for users in India, Russia, Indonesia, Hong Kong. And then
Speaker 2: you have the really alarming Internet blackouts where entire countries
Speaker 2: or regions just go dark online, often done by authoritarian
Speaker 2: governments trying to control information flow during protests or unrest.
Speaker 2: Just in twenty fifteen alone, these kinds of Internet shutdowns
Speaker 2: were estimated to cost the global economy something like two
Speaker 2: point four billion dollars.
Speaker 1: Just dat it's cleared the Internet, which was designed for openness,
Speaker 1: for connection, can easily be twisted into this powerful tool
Speaker 1: for control and disruption. We've seen the impact silencing descent
Speaker 1: global outages. It's huge. But to really grasp how these
Speaker 1: attacks cause such chaos, we probably need to dive deeper
Speaker 1: into the technical side. How do they actually work?
Speaker 2: Let's do it so fundamentally, when attackers go for resource saturation,
Speaker 2: they're just trying to use up all the victims computing
Speaker 2: power or network capacity, simple brute force. Really, these are
Speaker 2: often easy to launch, but notoriously hard to stop once
Speaker 2: they get going. Examples include things like HTTP floods, just
Speaker 2: sending way too many web page requests to exhaust the server,
Speaker 2: or what are called layer seven protocol floods. These are
Speaker 2: a bit more targeted, going after specific weaknesses and applications
Speaker 2: running on the server.
Speaker 1: Layer seven that's the application layer, right, the server software.
Speaker 2: Itself exactly, So instead of just flooding the network pipes,
Speaker 2: they might exploit how the application handles connections, things like
Speaker 2: database connection pool exhaustion making the application run out of
Speaker 2: ways to talk to its database, or SSL exhaustion overwhelming
Speaker 2: the server's ability to handle secure encrypted connections. They're more subtle,
Speaker 2: but can be just as effective.
Speaker 1: Okay, and you mentioned earlier. These volume based attacks fall
Speaker 1: into two main types, symmetric and asymmetric.
Speaker 2: That's right. In a symmetric DDoS attack, the attacker, usually
Speaker 2: using a botnet, directly sends a massive flood of basically
Speaker 2: junk traffic street at the victim. You generally need a
Speaker 2: lot of compromise machines hundreds or thousands to generate enough
Speaker 2: volume to overwhelm the target's network connection.
Speaker 1: Okay, direct fire, what about asymmetric You said that was
Speaker 1: more insidious.
Speaker 2: It really is. Asymmetric didas attacks are also known as
Speaker 2: reflection and amplification attacks. This is where it gets clever
Speaker 2: and dangerous. Here. The attacker doesn't send traffic directly from
Speaker 2: their box to the victim. Instead, they abuse other innocent
Speaker 2: servers on the Internet, things like public DNS servers, NTP
Speaker 2: time servers, or memcash servers that aren't properly secured or configured.
Speaker 1: How do they abuse them?
Speaker 2: They send small requests to these third party servers, but
Speaker 2: they spoofed the return address, making it look like the
Speaker 2: request came from the victim. These servers then send back
Speaker 2: much larger responses to the victim. That's the reflection part.
Speaker 2: The amplification comes because the response is often many times
Speaker 2: larger than the initial spoofed request.
Speaker 1: Ah So a small effort from the attacker triggers a
Speaker 1: huge flood aimed at the victim, bounced off unsuspecting servers.
Speaker 2: Precisely, this means just a few attacker resources maybe a
Speaker 2: small botnet, can generate absolutely massive amounts of attack traffic.
Speaker 2: Like that attack in March twenty eighteen, they used misconfigured
Speaker 2: mem cased servers. The amplification factor there is huge. That
Speaker 2: attack reached a staggering one point seven terabits per second,
Speaker 2: one of the biggest single attacks ever recorded.
Speaker 1: One point seven terabits. Yeah, that's an unamis adgable amount
Speaker 1: of data.
Speaker 2: It really is. And attackers also exploit fundamental weaknesses in
Speaker 2: core Internet protocols. You mentioned TCP earlier.
Speaker 1: Yeah, this is yn flood thing, exploiting the handshake.
Speaker 2: Right, that's a classic TCP based attack. The attacker sends
Speaker 2: loads of initial syn packets, making the server open connections
Speaker 2: and weight, but the attacker uses fake source addresses and
Speaker 2: never sends the final acknowledgment to complete the handshake. So
Speaker 2: the server just sits there with all these half open connections,
Speaker 2: using up resources until eventually legitimate users can't connect anymore.
Speaker 1: So they're weaponizing the protocol itself exactly.
Speaker 2: And it's not just about flooding networks or protocols. Attackers
Speaker 2: can also use specially crafted packets or applications to hit
Speaker 2: specific software bugs. Remember back in twenty eleven, a security
Speaker 2: researcher released a simple Perl script kill apatch dot pl vaguely. Yeah,
Speaker 2: it's sent very specific types of HTTP requests that could
Speaker 2: basically crash certain versions of the Apache Web server by
Speaker 2: making them consume all the CPU and memory a targeted
Speaker 2: software vulnerable exploit.
Speaker 1: Okay, and beyond traffic and software bugs, there's also this
Speaker 1: idea of filtering based denial of service, right.
Speaker 2: That's a bit broader. It can even include things like
Speaker 2: legal action, maybe authorities demanding a server be taken down.
Speaker 2: That is denying service technically, but technically it also includes
Speaker 2: things like DNS tampering. If an attacker can hijack control
Speaker 2: of your DNS servers or poison the cash of other
Speaker 2: DNS servers.
Speaker 1: They can redirect your users anywhere or nowhere, denying access that.
Speaker 2: Way exactly, or they can misdirect traffic. There are also
Speaker 2: more refined filtering methods, like URL filtering that could be
Speaker 2: based on simple blacklists or whitelists, or it could be
Speaker 2: more analysis based using deep packet inspection, looking inside the
Speaker 2: data packets for specific keywords or content types to block.
Speaker 1: So lots of ways to deny service digitally, but you
Speaker 1: mentioned earlier, it can even extend into the physical realm.
Speaker 2: Yeah, and This is where it gets particularly chilling. We've
Speaker 2: seen how attackers can overwhelm networks or manipulate data flows,
Speaker 2: but denial of service isn't just digital. It can involve
Speaker 2: physical destruction triggered remotely using digital tools. The most famous
Speaker 2: or infamous example is probably the stucks networm back in
Speaker 2: twenty ten, ah.
Speaker 1: Stucks net that targeted Eran's nuclear program. Right it did.
Speaker 2: It's spread through Windows networks, but specifically targeted Siemens industrial
Speaker 2: control software Step seven. It's estimated to have physically destroyed
Speaker 2: over nine hundred uranium enrichment centrifuges in Iranian facilities by
Speaker 2: subtlely manipulating their speeds, cause something like a thirty percent
Speaker 2: efficiency loss.
Speaker 1: Physically destroying hardware through software.
Speaker 2: It shows how these threats evolved, blurring the lines between
Speaker 2: cyber and physical. Attackers are constantly finding new angles, new weaknesses.
Speaker 1: And to launch all these different types of attacks, they've
Speaker 1: got a whole toolkit.
Speaker 2: Right, Oh, absolutely, a whole arsenal. Historically, back in ninety nine,
Speaker 2: you had tools like TRINDS zero and Tribe Flood Network
Speaker 2: or TFN. They exploited common vulnerabilities like buffer overflows to
Speaker 2: launch various flood attacks. More recently, you've seen tools like
Speaker 2: GoldenEye from around twenty twelve. That one focused on HTTP
Speaker 2: and HTTPS doss testing. It cleverly exploited things like HTB
Speaker 2: keep Alive and no cash settings to make servers exhaust
Speaker 2: their resources keeping connections open. Then there's hoechule K, also
Speaker 2: from twenty twelve. That's an application layered doss tool designed
Speaker 2: to be sneaky. It generates unique requests each time and
Speaker 2: can randomize source IP addresses to try and bypass detection systems.
Speaker 2: And of course, for simpler attacks often used in those
Speaker 2: activist campaigns, there's the well known low orbit Ion canon
Speaker 2: or LOIC. Pretty basic but can be effective in numbers.
Speaker 1: So arrange from simple flutters to quite sophisticated.
Speaker 2: Tools definitely, and tools like H and three are like
Speaker 2: Swiss army knives for network packets. They let users craft
Speaker 2: custom TCPIP packets to launch all sorts of layer three
Speaker 2: or layer four floods hitting the network in transport layers.
Speaker 2: And for those reflection amplification attacks we talked about, there
Speaker 2: are specific tools too, like the Saddam d DOS tool.
Speaker 2: It can be configured to use d or NTP servers
Speaker 2: for that amplification effect. You can actually see it working.
Speaker 2: If you capture the network traffic on the victims in
Speaker 2: you'll see all the DNS or NTP replies flooding in.
Speaker 1: It's kind of amazing and scary how many tools are
Speaker 1: out there.
Speaker 2: It is, and it raises that crucial question of again,
Speaker 2: what's the shared vulnerability? Why are so many different protocols
Speaker 2: DNS ANDTP, memecash, even TCP itself seemingly so easy to
Speaker 2: exploit for these attacks. Why haven't we fixed these fundamental issues.
Speaker 1: That's a great question, and it really speaks to the
Speaker 1: scale of this challenge. Okay, so we know the attacks
Speaker 1: are very sophisticated and the tools are available. How on
Speaker 1: earth do we defend against all this? It must start
Speaker 1: with just knowing you're under attack, right detection exactly.
Speaker 2: Detection is the first critical step, and generally detection methods
Speaker 2: fall into three main categories. First is signature detection. This
Speaker 2: works kind of like your antivirus software. It looks for
Speaker 2: known patterns or signatures of DDoS attack traffic. Good for
Speaker 2: known threats, but useless against new ones.
Speaker 1: Right it needs to have seen the attack precisely.
Speaker 2: Second is anomaly detection. This approach doesn't look for specific signatures. Instead,
Speaker 2: it establishes a baseline of what your normal network traffic
Speaker 2: looks like and then watches for significant deviations from that baseline.
Speaker 2: It looks at statistics like sudden spikes in packet arrival rates,
Speaker 2: or changes in the distribution of source IP addresses, or
Speaker 2: even the randomness of certain data fields in the packet headers.
Speaker 2: And the third type hybrid systems. As the name suggests,
Speaker 2: these try to combine the strength of both signature and
Speaker 2: anomaly detection. Use signatures for known attacks, anomaly detection to
Speaker 2: catch the unknown ones.
Speaker 1: Anomaly detection sounds really powerful, especially for those zero day attacks,
Speaker 1: the brand new ones. You mentioned entropy earlier. Can you
Speaker 1: break that down a bit more? How does measuring randomness
Speaker 1: help spot and attack?
Speaker 2: Sure? So, anomaly detection is crucial for zero days, even
Speaker 2: though it can sometimes generate more false positives. Flagging normal
Speaker 2: traffic is bad. One common statistical method used is cumulative
Speaker 2: sum or CUS. It's good at detecting small but persistent
Speaker 2: increases in traffic volume that might get lost in the
Speaker 2: usual noisy bursts of Internet traffic. Then there's entropy. This
Speaker 2: comes from information theory, and basically it's a measure of
Speaker 2: disorder or unpredictability in data. Think about source IP addresses
Speaker 2: in normal traffic. They tend to come from all over
Speaker 2: the place, fairly randomly distributed, high entropy. But during many
Speaker 2: types of DEDOS attacks, especially from botanets, you might suddenly
Speaker 2: see a huge flood of traffic coming from a relatively
Speaker 2: small predictable set of source ips.
Speaker 1: The randomness drops, ah, so the entropy the source iepiece goes.
Speaker 2: Way down exactly. That sudden drop in entropy is a
Speaker 2: strong signal that something unnatural, something non random, is happening,
Speaker 2: like an attack. The tricky part with detection, though, is
Speaker 2: where you do it. It's most accurate closer to the target
Speaker 2: where you see the traffic consolidation, but by then.
Speaker 1: It might be too late to actually stop it effectively.
Speaker 2: Right the flood might already be overwhelming your connection or
Speaker 2: your servers.
Speaker 1: Which leads us straight into mitigation. Once you detect that attack,
Speaker 1: what can you actually do and how do you balance
Speaker 1: needing strong defenses with the cost and complexity of it all.
Speaker 2: That's the million dollar question. Mitigation strategies get classified in
Speaker 2: lots of ways. You can think about when they happen.
Speaker 2: Are they preventative, do they react during an attack or
Speaker 2: is it clean up after? Or how they're deployed centralized
Speaker 2: defense or distributed, or where they're located protecting at the
Speaker 2: source of the traffic near the destination, somewhere in the
Speaker 2: network core or a hybrid, and increasingly where the reaction happens.
Speaker 2: Is it equipment on your own premises where services running
Speaker 2: in the cloud. A lot of modern mitigation heavily leverages
Speaker 2: the cloud. Content delivery networks CDNs are a big one.
Speaker 1: CDNs yeah, like Akamaine cloud Flare are those guys. They're
Speaker 1: used for speeding up websites.
Speaker 2: Mostly right primarily, Yes, their main job is to cache
Speaker 2: website content on servers all around the world closer to
Speaker 2: users to improve load times and performance. But that distributed
Speaker 2: architecture inherently makes them pretty good at absorbing DEDOS attacks too.
Speaker 2: Running the incoming traffic across this huge network of servers,
Speaker 2: they can dissipate the effect of an attack. It makes
Speaker 2: it much harder for an attacker to overwhelm any single point.
Speaker 1: So their structure provides a kind of built in resilience.
Speaker 1: Even if that wasn't the primary goal exactly.
Speaker 2: They offer significant d'dos protection as a side benefit, and
Speaker 2: now many CDNs offer specific DIDOS mitigation services too.
Speaker 1: But I seem to remember hearing about cases where even
Speaker 1: big CDNs struggled or maybe even dropped clients during massive
Speaker 1: attacks because it was just too much or too expensive.
Speaker 2: That's a valid point and a real challenge. CDN's specially
Speaker 2: robust DEDOS protection from them can be expensive, and relying
Speaker 2: solely on one CDN provider does create a potential single
Speaker 2: point of failure, or at least a single point of
Speaker 2: financial pain. You mentioned Krebs on security Brian Krebb's security
Speaker 2: news site back in twenty sixteen. It got hit by
Speaker 2: a massive DIDAS attack, largely from the Maria botnet. Akamai.
Speaker 2: His CDM provider at the time was mitigating it, but
Speaker 2: the sheer scale and costs led them to eventually drop
Speaker 2: his site from their free to protection. It highlighted the
Speaker 2: economic limits, right, So.
Speaker 1: Relying on one provider, even a big one, isn't foolproof.
Speaker 2: It forces organizations to think about more complex strategies, maybe
Speaker 2: using multiple CDMs or combining cloud protection with some defenses
Speaker 2: on their own premises. It adds layers, but also complexity and.
Speaker 1: Cost, and this challenge, I guess, spurred development of other
Speaker 1: approaches like dynamic dios mitigation or DDM.
Speaker 2: What's the idea there exactly? DDM tries to address those
Speaker 2: single provider limitations and cost issues. The core idea is
Speaker 2: to leverage resources from multiple different cloud service providers dynamically,
Speaker 2: so when an attack hits, the system can automatically scale
Speaker 2: up defenses, distributing the attack traffic across a much wider
Speaker 2: surface area, maybe using capacity from AWS, Azure, Google Cloud
Speaker 2: and specialized scrubbing centers, simultaneously.
Speaker 1: Spreading the load even further right.
Speaker 2: To dissipate the effect more effectively, and crucially, when the
Speaker 2: attack subsides, it can scale those resources back down on
Speaker 2: amadically to reduce the operational costs. It aims for more
Speaker 2: flexibility and resilience.
Speaker 1: Okay, that makes sense. Another defense concept that sounds really interesting,
Speaker 1: almost futuristic is moving target defense or MTD. What's that about?
Speaker 2: MTD is a fascinating area. The basic philosophy is if
Speaker 2: the target is constantly changing, it's much harder for an
Speaker 2: attacker to hit it successfully. Instead of building static fortress
Speaker 2: like defenses, you make the system itself dynamic and unpredictable.
Speaker 1: How do you do that? Like constantly changing IP addresses.
Speaker 2: That's one example. Yeah, Dynamically mutating IP addresses makes it
Speaker 2: harder for attackers to even find the target, let alone
Speaker 2: sustain an attack against it. Other MTD techniques might involve
Speaker 2: frequently changing network paths, randomizing system configurations, or even presenting
Speaker 2: attackers with deceptive fake views of the network topology to
Speaker 2: confuse their reconnaissance efforts.
Speaker 1: It's about creating uncertainty for the attacker, Yeah, making their
Speaker 1: planning and execution much more difficult.
Speaker 2: Precisely, it aims to increase the attack workload and reduce
Speaker 2: their window of opportunity. While it adds complexity to your
Speaker 2: own system management, it can be very effective, especially against
Speaker 2: automated attack tools that rely on static information.
Speaker 1: Okay, shifting gears a bit. Software defined networking SDN. This
Speaker 1: is a pretty major change in how networks are built
Speaker 1: and managed. How does SDN impact DDoS defense? Is it
Speaker 1: good news or bad news?
Speaker 2: Well, it's both. SDN definitely presents huge opportunities, but also
Speaker 2: new challenges. The big change with SDN is that it
Speaker 2: separates the network's control logic the brain from the actual
Speaker 2: hardware that forwards traffic the muscle you get the centralized
Speaker 2: software controller that manages the entire network.
Speaker 1: Centralized control sounds powerful.
Speaker 2: It is, and it's programmable. This gives you incredible flexibility
Speaker 2: to create adaptive security solutions. You could, for instance, use
Speaker 2: the SDN controller to implement MTD techniques like that dynamic
Speaker 2: IP mutation we just talked about, or you could program
Speaker 2: it to quickly reroute traffic around attack points, or even
Speaker 2: generate fake networks to deceive attackers trying to map your infrastructure.
Speaker 2: The potential for dynamic defense is.
Speaker 1: Huge, but that centralization sounds like it could also be
Speaker 1: a weakness, right, A single target for attackers.
Speaker 2: Absolutely, that's the flip side. The SDN controller itself becomes
Speaker 2: a very attractive, high value target. A successful DIDOS attack
Speaker 2: against the controller could potentially paralyze the entire network. It's
Speaker 2: a single point of failure and the programmability.
Speaker 1: Could that be misused?
Speaker 2: Yes, If an attacker could somehow compromise the controller or
Speaker 2: exploit its programming interfaces, they could potentially reconfigure the network maliciously,
Speaker 2: causing widespread disruption. A different kind of denial of service Also,
Speaker 2: SDN often goes hand in hand with network function virtualization,
Speaker 2: running things like firewalls and routers as software on scattered servers.
Speaker 2: This softization means you might have multiple critical network functions
Speaker 2: running on the same physical box that creates high value
Speaker 2: targets and potentially a broader attack surface if one component
Speaker 2: gets compromised.
Speaker 1: So powerful potential, but also new risks to manage.
Speaker 2: Exactly it requires careful design and robust security for the
Speaker 2: SDN components themselves.
Speaker 1: And we've touched on this, but it bears repeating. This
Speaker 1: isn't just about websites or corporate networks anymore. DDAs is
Speaker 1: increasingly threat to cyberphysical systems cps.
Speaker 2: Absolutely. Cps are systems that integrate computing and networking with
Speaker 2: physical processes. Think smart manufacturing, smart buildings, intelligent transportation systems.
Speaker 1: And the big one, the smart grid.
Speaker 2: The smart grid is a prime example. It relies heavily
Speaker 2: on real time data flowing over networks from sensors out
Speaker 2: in the field, things like phaser measurement units or pmus,
Speaker 2: which monitor the health of the power grid.
Speaker 1: So if you disrupt that data flow.
Speaker 2: You can cause serious problems. Studies have shown that even
Speaker 2: if the communication is encrypted, say, using VPN tunnels, attackers
Speaker 2: might still be able to disrupt things using side channel attacks.
Speaker 1: Side channel what does that mean here?
Speaker 2: It means looking at characteristics other than the encrypted data itself,
Speaker 2: like analyzing the size of the packets being sent or
Speaker 2: the timing between packets. Even without decrypting the data, attackers
Speaker 2: might be able to identify which data streams belong to
Speaker 2: specific critical pmus just based on these patterns.
Speaker 1: And then what block just those specific packets.
Speaker 2: Potentially, yes, they could selectively drop or delay just the
Speaker 2: data from crucial pmus. This could make the control center
Speaker 2: think the PMU is still online and connected, but it's
Speaker 2: not receiving the vital real time measurements about grid stability.
Speaker 2: If that happens, the system operators might not see an
Speaker 2: impending problem, potentially leading to instability or even blackouts.
Speaker 1: That is genuinely unsettling. It really drives home that the
Speaker 1: lines are blurring. It's not just about data loss anymore.
Speaker 1: It's about potentially catastrophic physical consequences.
Speaker 2: Right and think about those BGP hijacking or DNS poisoning
Speaker 2: attacks we mentioned earlier. If attackers can redirect Internet traffic,
Speaker 2: they could potentially intercept or block communication for financial services,
Speaker 2: government agencies, even theoretically systems involved in manage critical national
Speaker 2: security assets. The potential impact is enormous.
Speaker 1: Wow, Okay, we have covered a ton of ground in
Speaker 1: this deep dive. It's really quite a journey. We went
Speaker 1: from the earliest sort of conceptual denial of service, the
Speaker 1: Luddites and sit ins, all the way to these massive
Speaker 1: global DEDOS attacks we see today impacting everything. We've looked
Speaker 1: at the motivations from just messing around to organized crime,
Speaker 1: political anctivism, and even full blown state sponsored cyber warfare.
Speaker 2: Yeah, and we unpacked the tech behind it too, the
Speaker 2: simple symmetric floods, the much sneakier reflection and amplification attacks,
Speaker 2: exploiting protocol weaknesses, software bugs, even extending into the physical
Speaker 2: realm with things like stucksnet.
Speaker 1: And then the defense side, the detection methods using signatures,
Speaker 1: looking for anomalies with stats like entropy, and the mitigation
Speaker 1: strategies leveraging CDNs, the cloud elasticity with DDM trying to
Speaker 1: be unpredictable, with moving target defense and navigating the complexities
Speaker 1: of SDN.
Speaker 2: It truly is an ongoing arms race. Attacker constantly innovate,
Speaker 2: finding new vulnerabilities, new ways to cause disruption, and defenders
Speaker 2: are racing to keep up, developing new techniques to protect
Speaker 2: our digital lives and increasingly, our critical physical infrastructure. The
Speaker 2: stakes just keep getting higher.
Speaker 1: They really do it touches almost everything now. Okay, before
Speaker 1: we wrap up, let's leave our listeners with a final
Speaker 1: provocative thought to chew on. Considering everything we've discussed and
Speaker 1: how reliant we're becoming on interconnected smart systems, smart homes,
Speaker 1: smart cities, smart grids, how might the very nature of
Speaker 1: denial of service attacks change in the coming years as
Speaker 1: everything gets connected? What new kinds of vulnerabilities might emerge
Speaker 1: when your fridge, your car, the traffic lights, the power
Speaker 1: grid are all talking to each other. And how will
Speaker 1: our defenses need to evolve to protect these incredibly complex,
Speaker 1: interconnective next generation targets