Category: DoS

ASM Proactive bot detection – Selective URLs

I would love to say that all URLs are created equal but that is not always the case. The same could be said about applying a security policy. Sometimes the logic behind one URL needs to be completely different. With the power of ASM + iRules, we can kick that logic up a notch.

when RULE_INIT {
  # Friends don't let friends log in production.
  # Logging off=0, Logging on =1
  set static::DEBUG_LEVEL 0
  }
when BOTDEFENSE_ACTION {
        if {[HTTP::uri] ends_with "/faq"} {
            if { $static::DEBUG_LEVEL == 1} { 
            log local0.alert "Allowed [HTTP::header User-Agent] to access [HTTP::uri]"
            log local0.alert "*************************************"
            log local0.alert ""
            log local0.alert "" }
            BOTDEFENSE::cs_allowed true
            set res [BOTDEFENSE::action allow]
        }   
        # EXAMPLE 2: Instead of blocking the request with TCP RST, respond with a
        # blocking-page
        if {[BOTDEFENSE::action] eq "tcp_rst" and [HTTP::uri] eq "/bloc_page_test" } {
                # if the custom_response action fails, the tcp_rst action will remain,
                # so we don't need to check the return string in this case
                BOTDEFENSE::action custom_response "sorry\ni am blocking you again\n"
        }
        if {not (([BOTDEFENSE::action] eq "allow") && ([BOTDEFENSE::reason] eq "valid cookie; no need to renew"))}
        {
          if { $static::DEBUG_LEVEL == 1} {
            log local0.alert "Got request from IP [IP::client_addr]"
            log local0.alert "UA is [HTTP::header User-Agent]"
            log local0.alert "Bot action is [BOTDEFENSE::action] because [BOTDEFENSE::reason]"
            log local0.alert "DeviceID is [BOTDEFENSE::device_id]"
            log local0.alert "*************************************"
            log local0.alert ""
            log local0.alert ""}
        }

        # EXAMPLE: Send a CAPTCHA challenge on the login page, and only allow the
        # login if the user passed the CAPTCHA challenge 

            if {[BOTDEFENSE::action] eq "allow"} {
            if {[BOTDEFENSE::captcha_status] ne "correct"} {
                if {[HTTP::uri] eq "/user/login"} {
                    set res [BOTDEFENSE::action captcha_challenge]
                    if {$res ne "ok"} {
                      if { $static::DEBUG_LEVEL == 1} {
                        log local0. "cannot send captcha_challenge: \"$res\"" }
                        BOTDEFENSE::action tcp_rst
                    }
                } elseif {[HTTP::uri] eq "/user/login"} {
                    set res [BOTDEFENSE::action custom_response {
                        login failed because you may not be human
                    }]
                    if {$res ne "ok"} {
                      if { $static::DEBUG_LEVEL == 1} {
                        log local0. "cannot send blocking page: \"$res\"" }
                        BOTDEFENSE::action tcp_rst
                    }
                }
            }
        }

}

As you can see, the power of iRules we can make decisions based on the following:

  • URI
  • DeviceID
  • TCP RST OR DROP
  • CAPTCHA

And that’s just how we do it at F5, stop the bad guys and look good doing it.

Best Regards,

BD

 

Why a 3Gbps DoS can take out your 40Gbps NGFW and 20Gbps Internet Circuit

Denial of Service (DoS Attack) or Distributed Denial of Service (DDoS attack) is still a hot topic in 2016 even though it was discovered in 1994 and began being seen in the wild in September of 1996. There are many solutions that counter these attacks via on premise and off premise solutions. Let’s expand on on-premise solutions.

A DoS attack is an attack that is not necessarily volumetric in nature. Instead is it focused on overwhelming the on premise gear but not  saturating the full internet pipe. A good example of this would be a syn flood that fills up the connection table on your firewall. I know what you are thinking, “But Brian, we have a NGFW that is capable of moving 40Gbps!” but let’s look at this a bit closer. Yes, your firewall is capable of moving a 20GB file but what happens if you break up that 40GB into millions of connections? The real attack vector here is not throughput, it’s connections.

Connections per second (CPS):

Connections per second (CPS) refers to the rate at which a device can establish state parameters for new connections. A stateful device must create and manage connection information on all unique IP streams that transit the device. Typically, the device must handle the first packet of a new connection differently than all subsequent packets so that the device can establish the state parameters for the new connection. Because this process is specialized, it usually occurs in the software process of the devices, as opposed to the normal hardware-based forwarding process.

What firewall administrators usually do not do is to check the max CPS numbers their Internet facing link can carry. This number depends on the Internet link speed. It is the same number as the max frames per second a link can carry. Frames per second is calculated as following:
(Link speed)/(84 Byte * 8bit/Byte) = max frames per second.

Each frame can be a new connection (UDP), therefore max FPS = max CPS Here an overview of how many CPS a link can transport related to link speed:

Link SpeedMax CPS
100 Mbps148, 809
1,000 Mbps (1Gbps)1,488,906
10,000 Mbps (10Gbps)14,880,960

Maximum Concurrent Connections (MCC)

The number of concurrent connections is directly related to the max CPS number. When a Firewall hits it’s concurrent connection limits it does not accept new connections for any service and all services behind this firewall are not accessible for new requests. This number shows also the time a DDOS attack needs to take a firewall down and also the time the firewall has to take countermeasures against the attack. If for example, a firewall processes a DDOS mitigation run every 30 seconds but the firewall is overloaded in 10 seconds then it is too late for countermeasures.

So, why does it bother me? My Firewall does 40Gbps!

Well, what firewall vendors advertise is the throughput of the system for transferring large files. Unfortunately DDOS attacks do not use regular traffic. The frontend Internet facing firewall should be designed to handle the Internet facing threat potential. This is the reason why Administrators do not choose a 200 Mbps firewall to protect against a 1 Gig link. The same sizing guides should be taken into account for CPS.

Action Item for you: Go to your Firewall vendor product specification list and check the CPS numbers they publish.

What is the result?

Your Firewall cannot protect you. Even more: even if you upgrade to the strongest appliance model your Firewall vendor offers, it will not protect your datacenter because it can not handle the CPS threat. Please note, this post isn’t here to pick on your current firewall. At the end of the day, these are complementary solutions. Most likely you did not buy your NGFW for DoS/DDoS mitigation however advertised speeds tend to give a false sense of security.
Here are some real life examples (state of Dec 2015):

Vendor Name1 Gbps Threat Protection10 Gbps Threat Protection
Cisco ASA 5585-X CPS: 350,000
CC: 10M		23.5% threat protection Exhausted in 7 sec2.3% threat protection Exhausted in 0.7 sec
Juniper SRX 5800 CPS: 450,000
CC: 100M		30.2% threat protection Exhausted in 67 sec3% threat protection Exhausted in 6,7 sec
Checkpoint 61000 CPS: 3,000,000 CC: 210M100% threat protection Exhausted in 141 sec20.1% threat protection Exhausted in 14 sec
Fortinet Fortigate 5001D CPS: 565,000
CC: 23M		38% threat protection Exhausted in 16 sec3.8% threat protection Exhausted in 1.6 sec

Please note: all the Firewalls are High End Firewalls and partially marked as Carrier class devices, which means, they are also priced as carrier class devices.

How do I protect my perimeter firewall?

F5 is the only vendor that offers high speed Firewall protection at midsize appliances. Here an overview of possible F5 Firewall solutions:

BIG-IP 5205vBIG-IP 12250vVIPRION B2250VIPRION B4300
Throughput30 Gbps80 Gbps320 Gbps640 Gbps
CPS700k1.5M4.0M11.2M
CC24M80M192M288M
SYN Cookie40M80M240M640M

It’s interesting to note that 5250v (smallest appliance) is only a 2U  that is capable of cleaning just about anyone’s internet circuit. I am unaware of anyone in the southwest with pipe greater than 20Gbps.

Do I migrate my existing perimeter firewall to a F5 firewall?

In short, no. A F5 System could be installed in parallel with the existing Firewall. However, in recent efforts, I have deployed the F5 as a L2 Transparent DoS/DDoS mitigation device in front of the existing firewalls. The draw for this is the  deployment is simple, easy to manage, you keep your existing policy on your firewalls, and utilize the F5 for mitigation only.

 Credit: Vladimir Bojkovic

In 2015, I personally worked on two projects where customers used the F5 as a L2 Transparent DDoS mitigation device after suffering outages.

Project #1: Customer had a pair of PA-7050’s( App ID and Threat Detection enabled) on the perimeter and a 1 Gbps internet circuit. They were hit with a NTP reflection attack that caused an outage and the Palo Alto boxes to fall over. Post mortem, the NTP reflection attack was on 230 Mbps in size but exhausted the CPS on the PA. For those of you wondering, the box only had 478 Mbps running thru it at the time.

We positioned the 5250v box at the perimeter for mitigation. Currently the network and security team sees the F5 as their first line of security for any and all L3/L4 attacks.

Project #2: This customer has a mixture of technologies in their environment which lead to a false sense of security. At the perimeter, they had Cisco 5585-40’s along with 20Gbps internet circuits. Early in the fall, they were hit with a 3Gbps TCP SYN flood (3 million unique client IPs) that took the down the PA’s.

We positioned the VIPRION B2250 as a L2 transparent DDoS firewall.  The beautiful part of this solution was, it went directly into production and it did not associate a single helpdesk ticket; it truly went in as a bump on the wire.

If you have any questions or comments, feel free to leave your thoughts below.

Regards,

BD