ITSY

Protecting Network Traffic

  • Importance of Encryption

  • All data sent over a network should be encrypted to ensure security regardless of whether the network is protected or wireless.

  • Encryption protects information from being intercepted and understood.

  • Common Insecure Protocols

  • Many everyday protocols lack encryption:

    • Telnet - A protocol used for remote command-line access.

    • FTP (File Transfer Protocol) - Used for file transfers without encryption.

    • SMTP (Simple Mail Transfer Protocol) - Used for email transmission in plaintext.

    • IMAP (Internet Message Access Protocol) - Allows email retrieval without encryption.

  • Packet Capturing

  • To assess the security of your network traffic, capture the packets:

    • Examine the headers and the data enclosed within the packets.

    • Unencrypted data can indicate insecure protocols in use.

  • Consequences of Insecure Protocols

  • Using insecure protocols can lead to exposure at events like DEFCON, where attendees may appear on a "Wall of Sheep" displaying their usernames and partial passwords.

Secure Protocol Alternatives

  • Using SSH instead of Telnet

  • HTTPS instead of HTTP - For secure web browsing.

  • IMAPS instead of IMAP - For secure email retrieval.

  • SFTP instead of FTP - For secure file transfers.

DDoS Attacks Overview

  • Recent DDoS Attack on GitHub

  • GitHub suffered the largest DDoS attack recorded, involving:

    • Traffic Volume: 1.35 terabytes per second.

    • Packet Rate: Approximately 127 million packets per second.

  • The attack lasted between five to nine minutes and was mitigated using Akamai.

  • Attack Type: UDP Amplification

  • UDP (User Datagram Protocol) is exploited in DDoS attacks due to its ease of spoofing, as it does not require a return packet.

  • Attackers utilize UDP services to amplify the attack, sending small requests that elicit large responses.

Memcache Attack

  • Description

  • The recent attack on GitHub involved memcache, a database caching system, leading to an amplification effect.

  • Small packets resulted in greater payloads being sent to the target, indicative of amplification techniques.

Recommendations for Protection

  • Seek DDoS Protection Services:

  • Implement hybrid DDoS protection solutions combining hardware and service measures.

  • Example: WatchGuard's Firebox, which can provide basic DDoS protection by denying harmful traffic.