In the first two quarters of 2020, the number of DDoS attacks increased almost threefold, with 65% of them being primitive attempts at 'load testing' that easily 'take down' defenseless sites of small online stores, forums, blogs, and media outlets.
How to choose a hosting service protected against DDoS attacks? What should you pay attention to and what should you prepare for, so as not to find yourself in an unpleasant situation?
(A vaccine against 'gray' marketing internally)
The availability and variety of tools for conducting DDoS attacks compel online service owners to take appropriate measures to counter the threat. It's essential to consider DDoS protection not only after the first failure or even as part of measures to enhance the resilience of the infrastructure, but also at the stage of choosing a platform for hosting (provider or data center).
DDoS attacks are classified according to the protocols involved, the vulnerabilities exploited, and the levels of the Open Systems Interconnection (OSI) model:
- link (L2),
- network (L3),
- transport (L4),
- application (L7).
From the perspective of security systems, they can be broadly categorized into two groups: infrastructure-level attacks (L2-L4) and application-level attacks (L7). This relates to the sequence of traffic analysis algorithms and computational complexity: the deeper we look into the IP packet, the more computational resources are required.
In general, the task of optimizing computations when processing traffic in real-time is a topic for a separate series of articles. For now, let's just imagine that there is some cloud provider with conditionally unlimited computing resources, which can ensure protection for websites against application-level attacks (including ).
3 key questions to determine the level of DDoS protection of hosting
Let's take a look at the conditions for DDoS protection service and the Service Level Agreement (SLA) of the hosting provider. Do they provide answers to the following questions:
- what technical limitations the service provider claims?
- what happens when the customer exceeds those limitations?
- How does a hosting provider establish protection against DDoS attacks (technologies, solutions, providers)?
If you couldn't find this information, it's either a sign to reconsider the seriousness of the service provider or to implement basic DDoS protection (L3-4) on your own. For example, you could order a physical connection to a specialized protective service provider.
Important! There's no point in providing application-level attack protection using a Reverse Proxy if your hosting provider can't offer infrastructure-level attack protection: network equipment will become overloaded and inaccessible, including for the proxy servers of the cloud provider (Figure 1).
Figure 1. Direct attack on the hosting provider's network
Don't let anyone tell you the myth that the real IP address of the server is hidden behind the security provider's cloud, making it impossible to attack directly. In nine out of ten cases, the attacker can easily find the real IP address of the server or at least the hosting provider's network to 'take down' an entire data center.
How hackers search for the real IP address
Under the spoilers — several methods for discovering the real IP address (provided for informational purposes).
Method 1: Searching in open sources
You can start the search with the online service: it searches for information in the dark web, on document exchange platforms, processes Whois data, leaks of publicly available data, and many other sources.
If you can determine that the website is protected by Cloudflare based on certain indicators (HTTP headers, Whois data, etc.), you can start searching for the real IP from the, which contains about 3 million IP addresses of websites located behind Cloudflare.
Using an SSL certificate and the service , you can find a lot of useful information, including the real IP address of the site. To formulate a request for your resource, go to the Certificates tab and enter:
_parsed.names: nameof the site AND tags.raw: trusted
To find IP addresses of servers using an SSL certificate, you'll need to manually sift through the dropdown list with a few tools (go to the 'Explore' tab, then select 'IPv4 Hosts').
Method 2: DNS
Searching through the history of DNS record changes is an old, proven method. The previous IP address of the website can indicate which hosting provider (or data center) it was located in. Among online services, the user-friendliness is highlighted by and .
When changing settings, the website will not immediately use the IP address of the cloud security provider or CDN, and will operate directly for a while. In this case, there is a chance that online services storing the history of IP address changes contain information about the original address of the website.
If there is nothing except the name of the old DNS server, you can use special utilities (dig, host, or nslookup) to query the IP address by the domain name of the website, for example:
_dig @old_dns_server_name namethe website
Method 3: email
The idea of the method is to receive an email through a feedback/registration form (or any other way that initiates sending an email) and check the headers, particularly the 'Received' field.
In the email header, the real IP address of the MX record (mail exchange server) is often found, which can serve as a starting point for searching other target servers.
Tools for automating searches
Software for finding IPs behind Cloudflare usually operates on three tasks:
- scanning for misconfigured DNS using DNSDumpster.com;
- scanning the Crimeflare.com database;
- brute-forcing subdomains using a dictionary method.
Searching for subdomains often turns out to be the most effective option of the three — the website owner might have protected the main site while leaving subdomains operational directly. The easiest way to check is to use .
Additionally, there are utilities designed solely for finding subdomains using brute force and searching open sources, for example: or .
How the search works in practice
For example, let’s take the site seo.com, which uses Cloudflare, and we will find it using the well-known service (allows for identifying technologies / engines / CMS used by the site as well as searching for sites based on the technologies used).
When navigating to the 'IPv4 Hosts' tab, the service will display a list of hosts using the certificate. To find the one you need, look for an IP address with an open port 443. If it redirects to the desired site, the task is complete; otherwise, you need to add the domain name of the site in the 'Host' header of the HTTP request (for example, *curl -H "Host: site_name" *).
In our case, searching the Censys database yielded no results, so we proceed.
We'll conduct the DNS search through the service.
By iterating through addresses mentioned in the DNS server lists using the CloudFail utility, we can find working resources. The result will be ready in just a few seconds.
Using only open data and simple tools, we identified the real IP address of the web server. The rest is a matter of technique for an attacker.
Let's return to selecting a hosting provider. To assess the service's value to the client, we'll consider possible methods of protection against DDoS attacks.
How the hosting provider builds its protection
- In-house protection system with filtering equipment (Figure 2).
Requires the following:
1.1. Equipment for traffic filtering and licenses for software;
1.2. In-house specialists to support and operate it;
1.3. Sufficient internet access channels to handle attacks;
1.4. Significant pre-paid bandwidth to handle 'junk' traffic.
Figure 2. Hosting provider's own protection system
Considering this described system as protection against modern DDoS attacks in the hundreds of Gbps, such a system would cost a substantial amount of money. Does the hosting provider have such protection? Are they willing to pay for 'junk' traffic? It is evident that such an economic model is unprofitable for the provider unless additional charges are included in the rates. - Reverse Proxy (only for websites and certain applications). Despite a number of , the provider does not guarantee protection against direct DDoS attacks (see Figure 1). Hosting providers often present such a solution as a panacea, shifting the responsibility to the protection provider.
- Services of a specialized cloud provider (using its filtering network) for DDoS attack protection at all OSI levels (Figure 3).
Figure 3. Comprehensive protection against DDoS attacks with a specialized provider
implies deep integration and a high level of technical competence from both parties. Outsourcing traffic filtering services allows the hosting provider to reduce the cost of additional services for the customer.
Important! The more detailed the technical specifications of the service provided are, the greater the chances of enforcing them or obtaining compensation in the event of downtime.
In addition to the three main methods, there are numerous combinations and variations. When choosing a hosting provider, it's important for the customer to remember that the decision will affect not only the volume of guaranteed blocked attacks and the accuracy of filtration but also the response speed and the informativeness (list of blocked attacks, overall statistics, etc.).
Remember that only a few hosting providers in the world can offer an acceptable level of protection independently; in other cases, cooperation and technical competence come to the rescue. Understanding the basic principles of organizing protection against DDoS attacks will help the website owner avoid marketing tricks and not buy a "pig in a poke."
Source: habr.com
