Investigating DDOS - Architecture Actors and Attribution
summary
Deploys distributed UDP honeypots and indexes PCAPs with Moloch, collecting about 8 million records in 2016 and 30,000 targeted IPs in July; finds booters reuse PHP frontends/MySQL backends with simple HTTP API keys, sell service for ~$5–$50 (VIP to ~$200), and primarily use amplification (NTP, DNS, SSDP) and IoT/Linux bots. Live testing shows many services either don’t deliver or produce short bursts, and measured victim throughput tops out near 30 Gbps ceiling, typically 1–10 Gbps.
AI-written summary · about
chapters (34)
- 0:00Introduction
- 1:38Welcome
- 2:13Questions
- 2:45Agenda
- 7:00What happened to DDoS
- 10:05Whats going on right now
- 11:42The amplifier list
- 14:02The architecture
- 17:34Honeypots
- 19:20Moloch
- 20:14Indexing
- 21:02Results
- 22:30Protocols
- 23:32NTP
- 24:03NCP
- 24:24Request
- 24:51DNS
- 26:06Reply
- 26:29Charging
- 27:08SMP
- 27:31HTTP
- 29:00UDP Flood
- 29:46Attack Testing
- 33:46Hack Forums
- 34:40Top Seller
- 36:58Landing Page
- 37:18Turnkey DDoS Service
- 38:01Whos doing this
- 40:17Database Leaks
- 41:05Computer Crime Computer Fraud
- 42:28United Kingdom
- 42:56Twitter Post
- 43:37What Do You Think
- 45:11Take Questions
related talks
37mAnatomy of a DDoS
40mResearch on New Vectors of UDP-Based DDoS Amplification Attacks of IoT
56mDismantling DDoS - Lessons in Scaling
45mBarbarians at the Gate(way)
47mThe Secret Life of Enterprise Botnets
45mAnatomy of a DDoS
59mCatching Malware En Masse: DNS and IP Style
25mHow to Pull Off a Near Undetectable DDoS Attack...