Schneier on Security

Clive Robinson • November 29, 2016 6:00 PM

@ Rob,

How would you go about separating how the legitimate users from the illegitimate trying to access the target website?

It’s not an easy problem to solve at the website as in most cases there is no way to tell if the basic packets are legitimate or not, at that point in the network.

Likewise if the attackers computer is not sending out false addresses, incorrect protocols or datagram formats etc it’s not easy to tell no matter where on the network you instrument. Which is one of the original reasons for Bastion Hosts (firewalls) that understood not just the network level protocols but in some cases the application protocols as well (via wrappers).

Luckily most DoS attackes do involve the sending of false addresses, broken protocols, or the wrong sort of traffic or abnormal volumes of traffic. These behaviours can be fairly easily recognised by instruments just one or two hops away from the attacking host (ie in the ISP’s network).

Which suggests that the likes of ISPs are not doing such instrumentation for some reason, which also means they are not up with “best practice” in this regard.

At the end of the day most “network overloading” DoS attacks can only happen if the attacking computer is alowed to carry out the attack by sending out a lot of abnormal traffic. If the abnormal traffic was throttled or blocked by the ISP then the DoS and DDos issues would be a lot less if not cease to be an issue altogether. Likewise some protocols need to be changed to stop amplification attacks. The real question is why ISP’s are not doing this, and that is a whole different discussion which will drag in such things as “Net neutrality” and QoS etc which can have “sacred cow” status.

Clive Robinson • November 30, 2016 9:21 AM

@ Z.Lozinski,

Heavyweight firewalls with the capacity to deal with 10G and 40G circuits pipes are not cheap.

No they are not, but also they are not a necessity for many things.

If you view an ISP from above they have customers downstream, and a hostile unauthenticated network upstream. In between they have their own network with known characteristics. They should not accept anything from upstream that uses their “managment ports” likewise they should configure their downstream systems not to accept anything that initiates a “managment port” command. Nor should they alow datagrams with known to be false source IP and or port information to be accepted into their own network from either upstream or down stream. Quite simple routers can do this and it would stop a lot of the DoS attacks at the source of the attack. Likewise there is traffic to various infrastructure services, that the ISP should provide to it’s customers, not alow some unautheticated third party upstream service provider to abuse.

I appreciate that not all can be done with cost effective routers and firewalls but quite a bit can be. Just getting the ISPs to “cull some of the sacred cows” and do those bits would be a very significant start.

Unfortunately as I’ve mentioned before there is the legaslitive problem of the “common carrier” status. The ISPs do not want to in any way risk that status because of the legal protections it provides them. Legaslitive bodies likewise do not want to change things either for other reasons, thus we have a form of status quo that suites nobody other than the cyber-criminals… As was once noted “Legislation that is not well thought out carries the risk of unintended consequencies” but likewise so does “Inaction in the face of marked change”.

The Internet with it’s “All you can eat fixed costs only model” is a major game changer as it destroys many of the assumptions of the “common carrier” model that long predates it. It also turns basic economic ideas that have the underlying assumptions of “distance cost metric” and “duplication cost metric” upside down. When these are “zero cost” for cyber-criminals, there is no tangible physical world limits that give us “localisation limit” or “force multiplier limit”, hence an attacker can become “an army of one” from not just “any location” but “as many locations as they wish”.

It’s this “zero cost to attackers” that is the big game changer and we need to change it. Thus the minimum change is to harden the infrustructure uniformly and thus put the cost of this into “fixed costs” for all ISPs. Unfortunatly in a “free market” “race for the bottom” the only way to do this is with legislation.

You will hear people scream out about these increased costs and how Governments must not “stifle the market”, but this is an obvious misdirection because virtually all goverments are using the “fear of terrorism” to vastly inflate an ISPs fixed costs for much much lesser gain with the enforced retention of customer meta-data.

I can understand why sometimes Bruce dispares of the situation and thus “promotes the use of sensible legislation”. But also I can see why others rail against legislation because of the general two faced behaviour of those providing the legislation to the legislators and trying to cover their actions by invoking the “unforseen consequences” excuse.

How we find our way out of this Byzantine Labyrinth of twisty little hidden agenders and empire building I do not honestly know. But to do nothing will only make things worse not just currently but when people finally do have to make changes. Because they will be big changes just like the Patriot Act, made as a knee jerk reaction without mraningfull analysis, that others have been patiently waiting for to put in their own little last minute highly self benificial fixes…

Clive Robinson • November 30, 2016 6:44 PM

@ Z.Lozinski,

I agree, but how do we change it?

That as they say is the question…

In all honesty I don’t actually know. Not because I don’t have ideas on it, but my “thinking hinky” only goes so far. Thus my horizon for “unintended consequences” is limited to my “experience”, and as an engineer by training and disposition, I lack the serious “cork screw” mentality that can hide a single word in half a thousand paged of regulations, that unravels them like a pulled thread on a jumper or stockings etc.

Thus my initial sugestion is “start the conversation” in an open way with the things we do know on the technical side to try to define the problem and potential solutions.

One thing we do know is it is far easier to stop the problem at or shortly after the attack source rather than at the target. Secondly detecting an attack in general is easier the less target specific it is, or the lower it is in the networking stack.

But we also know that detecting specific target application related attack vectors is usually not required in DoS attacks due to the shaping and volume of the traffic generated by the source(s).

This suggests as a technical solution, directing detected low level protocol errors to /dev/null close to the source is a good idea, and that QoS type throttling of unexpected high volumes of traffic might be likewise benificial. As would looking for simple signitures –like rapid starting of TCP handshake but not finishing it etc– that would not be expected in normal usage.

Which leaves us with high level or application specific attacks. They are too high level and target specific to be detected in a general sense thus the target it’s self is the best detector of that type of attack. However in most cases source end rather than target end solutions are prefered to reduce collateral damage.

Care needs to be excercised when looking at possible distant end solutions, and you have to be able to think hinky or like an attacker to spot problems with the ideas. To see why this is necessary the following scenario should give a good indication,

One apparently simple idea for a distant end solution, would be for the target to use some form of feedback to the first hop after the attack source, to “rate limit” or “quench” the attack traffic at source. There are existing mechanisms that could be pressed into service to do this.

However when you think hinky you can see such a simple quench mechanism could be used as the basis of a different style of DoS attack. Or worse it could be self defeating in that as an attacker you could send short bursts from many locations, that do not trigger the local “attack detection”, but triggering the target to rapidly send out quench messages, which do get detected as unusual traffic patterns one or two hops up from the target, which would cause an “attack detection” node to divert the targets legitimate quench messages to /dev/null…

When a potential technical solution is defined it can be tested and if sufficiently robust it can be put forward as a potential solution.

And this is where it starts geting the legislators involved. Whilst it is simple to legislate the collection of meta-data because it is in effect a passive recording activity. Legislating for an active prevention activity is very likely to have edge cases where sneaky lawsmiths can hide their little tricks.

Thus hidden agenders can be brought forth, which is just one reason the “net neutrality” argument makes an apparently logical solution. Only it dors not because of the advantage it gives to atackers…

Thus you need many people to consider how they would gain advantage from any legaslitive proposal to try to prevent it being triggering in what might appear as an “unexpected consequence” that provides direct or indirect benifit to some of the parties involved.