amplification attacks とは送信元を偽装した dns query による攻撃帯域を埋める smurf attacks に類似攻撃要素は IP spoofing amp 2006/07/14 Copyright (C) 2006 Internet Initiative Jap

Size: px

Start display at page:

りえあきます
5 years ago
Views:

6 amplification ANY?xxx.example.com Sender xxx.example.com IN TXT XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX XXXXXXXXXXXXXXXX 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 6

9 view of bot #1 Internet 過負荷輻輳 bot #1 queries size: =~60bytes src IP: victim(ip spoofed) dst IP: various( amp) protocol: udp src port: various dst port: 53 QR: standard query QNAME: (specific one) 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 9

10 view of bot #2 a bot behind NAT box reply src IP: various( amp) dst IP: NAT Router Internet query after NAT NAT テーブルの溢れ ICMP unreach の生成 NAT src IP: NAT Router dst IP: various( amp) query before NAT bot #2 src IP: victim(ip spoofed) dst IP: various( amp) 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 10

11 view of stub-resolver queries Internet full-resolvers victim bot#2(nat) size: =~60bytes src IP: victim bot#2(nat) dst IP: stub-resolver QNAME: (specific one) 過負荷輻輳 stub-resolverにcache 機能がなければ全てのqueryは full-resolverに転送される stub-resolver replies size: =~4000bytes (ip fragmented) src IP: stub-resolver dst IP: victim bot#2(nat) QNAME: (specific one) 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 11

12 view of full-resolver queries Internet root-servers tld-servers example-servers victim bot#2(nat) stub-resolvers size: =~60bytes src IP: victim bot#2 stub-resolver dst IP: full-resolver QNAME: (specific one) 過負荷輻輳 RRのTTLが短ければコンテンツサーバへのquery 数が増加する full-resolver replies size: ~4000bytes (ip fragmented) src IP: full-resolver dst IP: victim bot#2(nat) stub-resolver QNAME: (specific one) 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 12

14 対策は Attacker IP spoofed dns queries resolvers IP spoofed パケットを破棄 = Source Address Validation dns replies 外部からの recursive query を破棄 = Disable Open Recursive victim 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 14

16 Source Address Validation BCP38/RFC2827 All providers of Internet connectivity are urged to implement filtering described in this document to prohibit attackers from using forged source addresses /07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 16

19 CISCO urpf configuration urpf strict mode interface GigabitEthernet0/0 ip verify unicast source reachable-via rx urpf loose mode interface GigabitEthernet0/0 ip verify unicast source reachable-via any 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 19

20 Juniper urpf configuration urpf strict mode interface { ge-0/0/0 { unit 0 { family inet { rpf-check; } } } } urpf loose mode interface { ge-0/0/0 { unit 0 { family inet { rpf-check { mode loose; } } } } } 2006/07/14 Copyright (C) 2006 Internet Initiative Japan Inc. 20

untitled

untitled Peers Working Together to Battle Attacks to the Internet JANOG17 20 Jan 2006 Matsuzaki Yoshinobu Tomoya Yoshida Taka Mizuguchi NSP-SEC/NSE-SEC-JP Agenda

amplification attacks とは 送信元を偽装した dns query による攻撃 帯域を埋める smurf attacks に類似 攻撃要素は IP spoofing amp 2006/07/14 Copyright (C) 2006 Internet Initiative Jap

amplification attacks とは送信元を偽装した dns query による攻撃帯域を埋める smurf attacks に類似攻撃要素は IP spoofing amp 2006/07/14 Copyright (C) 2006 Internet Initiative Jap