Security Attacks and Detection on OC12 and above Backbones

1
Security Attacks and Detection on OC-12 and above
Backbones
Y. John Jiang, Internet Security Cable
Wireless yjj_at_cw.net

• Problems
• Current Solutions and Remedies
• Possible Solutions

2
Problems Incident report statistics 4/3-5/2/1999
To From Total
Smurf 21 1 22 SYN 9 0 9 Other
DOS 6 2 8
Port/address scan 67 17 84 Login attempts
Hacked 7 1 8
Mail Relay/Spam 29
Other 3
3
Problems Managed Firewall alerts 5/1-5/7/1999
Port/Address Scanning/mapping ICMP 1 DNS/UDP
1 RPC/TCP 8 Netbus 3 Back
Oriffice 9 IMAP 7 1080/TCP 2 Other
scans 58 Mail replay/spam 4
4
"Solutions"
Alert Incident Reporting -- screaming Tracing D
oSTracker Blocking Edge Router ACL
5
DosTracker
Victim
Src
- ACL - Debug - Next hop
Attacker
6
Smurf
Victim
Amplifier
Attacker
7
Possible Solutions?
Prevention ??? Early alert Attack Detection
System? Tracing ?? Blocking Edge Router ACL?
8
Attack Detection
How to deal with high speed network? How to deal
with non-broadcasting network?
- Giga Ethernet IDS - Splitting ATM PVC -
vBNS/Internet2 Traffic Monitor
9

• Prevention?

• Blocking?