"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk

How we approach DDoS threat research
Threat landscape in 2024
Customer case study: Ukraine, 2022
Agenda

DDoS threat research
Protect Amazon infrastructure and customers,
making AWS an unattractive target for
cyber threats

Our approach
Analyze inbound and outbound internet traffic
Convert research into actionable threat intelligence for our customers
Disrupt the capability of unauthorized users to repeatedly and easily target us

Leverage AWS’s reach and scale to detect threats
600+ points of presence
(POP) across 100+ cities in
50 countries
Exabytes of data
analyzed every 60 sec.
Thousands of DDoS attacks
mitigated every day
100+ billion AWS-managed rules
requests processed per day

0
20,000
40,000
60,000
80,000
100,000
120,000
9/1/22 10/1/22 11/1/22 12/1/22 1/1/23 2/1/23 3/1/23 4/1/23 5/1/23 6/1/23 7/1/23 8/1/23
DDoS
Events
Month
AWS Shield DDoS events detected per month
DDoS isn’t going away
56%
Application layer
40%
YoY growth

From video games to critical public infrastructure

Proxy-based L7 DDoS attacks
Proxy
Proxy driver Target

Botnets
Command &
control
Bots

Tracking DDoS infrastructure

Known offenders

Known offenders
1.2.3.4
2.3.4.5
3.4.5.6
4.5.6.7
AnyAuthority ELB
AnyCompany NLB
AnyOrganization CloudFront Distribution

Tracking known offenders

Available as a Managed Rule for AWS WAF
Amazon CloudFront
AWSManagedIPReputationList
Elastic Load Balancing (ELB) Amazon API Gateway

Internal success stories
Amazon CloudFront AWS Management Console
Amazon.com

AWS Shield automatic mitigation
AWS Shield
detects attack
AWS Shield
deploys L7KO
AWS Shield
analyzes
traffic
AWS Shield
deploys
attack
signature

MadPot

Global-scale threat intelligence
using the AWS Cloud
10k+ sensors deployed globally
Observes 100M+ potential threat
interactions daily
500,000activities classified as
malicious daily

MadPot (Honeypot) network
Amazon GuardDuty
AWS Shield
AWS WAF
Internet
MadPot

We are making a difference
https://www.theregister.com/2023/
10/02/aws_security_madpot/
AWS stirs the MadPot –
busting bot baddies and
eastern espionage
Security exec Mark Ryland spills the tea
on hush-hush threat intel tool

Takedown

Proxy-based L7 DDoS Attacks
Proxy driver Target
🍯
Proxy honeypot

Top talking networks by proxy drivers
Linode Hetzner Online
Digital Ocean
FranTech Solutions
SoftLayer
Technologies
Interserver
Psychz Networks
Scaleway
Dedioutlet-
network-phx DediPath
myLoc
manage
d IT AG
Akamai
Connect
ed Cloud
Edgevirt
Choopa,
LLC
Kamater
a Inc
Hetzner
Online
GmbH
Aggros
Operati
ons…
Worl
dStre
am…
Relia
bleSit
e.N…
Wind
str…
Ad…
Re…
AE…
Or… H… M… A… V…
RW
-…
O…
C…
R…
D…
T… M… L… C… L…
Pe
b…
i…
D…
L…
I…
1… M… N…
D…
S…
C…
1…
W…
D…
U…
R
C
Z A Y T
S C E P I A
H
D
H
C
C
C S C A P
S
u
T
U
H S T C
A
S
C
N 3 B
C T C
D
Linode Hetzner Online Digital Ocean FranTech Solutions
SoftLayer Technologies Interserver Psychz Networks Scaleway
Dedioutlet-network-phx DediPath myLoc managed IT AG Akamai Connected Cloud
Edgevirt Choopa, LLC Kamatera Inc Hetzner Online GmbH
Aggros Operations Ltd. WorldStream B.V. ReliableSite.Net LLC Windstream Communications

Botnet C2 Case Study
free.bot.c2

0
5
10
15
20
25
30
35
40
5/14/23
12:00
5/14/23
13:00
5/14/23
14:00
5/14/23
15:00
5/14/23
16:00
5/14/23
17:00
5/14/23
18:00
5/14/23
19:00
5/14/23
20:00
5/14/23
21:00
5/14/23
22:00
5/14/23
23:00
5/15/23
0:00
5/15/23
1:00
5/15/23
2:00
5/15/23
3:00
5/15/23
4:00
5/15/23
5:00
5/15/23
6:00
5/15/23
7:00
5/15/23
8:00
5/15/23
9:00
5/15/23
10:00
5/15/23
11:00
5/15/23
13:00
5/15/23
14:00
5/15/23
15:00
5/15/23
16:00
5/15/23
17:00
5/15/23
18:00
5/15/23
19:00
5/15/23
20:00
5/15/23
21:00
5/15/23
22:00
5/15/23
23:00
5/16/23
0:00
5/16/23
1:00
5/16/23
2:00
5/16/23
3:00
5/16/23
4:00
5/16/23
5:00
5/16/23
6:00
5/16/23
7:00
5/16/23
8:00
5/16/23
9:00
5/16/23
10:00
5/16/23
11:00
5/16/23
12:00
5/16/23
13:00
5/16/23
14:00
5/16/23
15:00
5/16/23
16:00
5/16/23
17:00
5/16/23
18:00
5/16/23
19:00
5/16/23
20:00
5/16/23
21:00
5/16/23
22:00
5/16/23
23:00
5/17/23
0:00
5/17/23
1:00
5/17/23
2:00
5/17/23
3:00
5/17/23
4:00
5/17/23
5:00
5/17/23
6:00
5/17/23
7:00
5/17/23
8:00
5/17/23
9:00
5/17/23
10:00
DDoS Attacks per Hour Orchestrated by C2

0 50 100 150 200 250 300 350
China Telecom
xTom
Hangzhou Alibaba Advertising Co.,Ltd.
China Unicom
China Mobile
Tencent cloud computing
China Telecom Guangdong
Overland Storage
xTom Hong Kong Limited
VMISS
Plus Provedor De Internet Ltda
OVH SAS
OVH Hosting
Metfone
Amazon.com
Level 3 Communications
Web Lacerda Provedor De Internet Ltda
Akamai Technologies
DDoS Attacks by Targeted Networks Orchestrated by C2

Proxy driver takedown

Threat Landscape Per Industry

P A R I S O L Y M P I C S
34
Threat Landscape Olympics
The Olympics is a known WW target of massive and systemic
cyberattacks
• London 2012 : 200 million cyberattacks
• Rio 2016 : 400 million cyberattacks
• Tokyo 2020 : 450 million cyberattacks

P A R I S O L Y M P I C S
35
Threat Landscape Olympics
We expect eight to 12 times the Tokyo numbers of cyber
attacks ”
• Mr. Franz Regul
• CISO of the Paris Olympic organizing committee
I have no doubt whatsoever that Russia would try to target the
Paris Olympics
“
”
Emmanuel Macron
President of France

R E T A I L
36
Threat Landscape

Threat Data

Last 12 months statistics
212k 842 Gbps
155 M RPS 221 M PPS
Total
Attacks
Largest request
flood attack
Largest bandwidth
heavy attack
Largest packet
attack

© 2024, Amazon Web Services, Inc. or its affiliates. All rights reserved. 39
Infrastructure and Application (HTTP) layer DDoS events
application
infrastructure
2021
2020 2022 2024
Count
of
events

2024 – DDoS events in the numbers
Infrastructure DDoS events
360 thousands events
detected in 2024
-1.0% YoY decrease
Application (HTTP) DDoS
events
526 thousands events
detected in 2024
52.1% YoY increase
63,000 61,000
136,000
100,000
Q1 Q2 Q3 Q4
Infrastructure
Layer
DDoS
events
Quarter
Infrastructure DDoS Events 2024
100000
118000
143000
164000
Q1 Q2 Q3 Q4
Application
DDoS
events
Quarter
Application (HTTP) DDoS Events 2024

0 20,000,000 40,000,000 60,000,000 80,000,000 100,000,000 120,000,000 140,000,000 160,000,000 180,000,000
2023
2022
2021
2020
2019
Request Per Second
Year
1.5M rps
41
Largest Request Flood Events, As seen by AWS, by year
2.9M rps
4.3M rps
8.4M rps
155M rps

Infrastructure Layer DDoS Events in 2024 – Distribution by top vectors
30.6%
25.0%
15.5%
11.0%
7.7%
6.0%
2.7%
0.0%
5.0%
10.0%
15.0%
20.0%
25.0%
30.0%
35.0%
S
Y
N
_
F
L
O
O
D
D
N
S
_
R
E
F
L
E
C
T
I
O
N
S
S
D
P
_
R
E
F
L
E
C
T
I
O
N
N
T
P
_
R
E
F
L
E
C
T
I
O
N
M
E
M
C
A
C
H
E
D
_
R
E
F
L
E
C
T
I
O
N
S
N
M
P
_
R
E
F
L
E
C
T
I
O
N
G
E
N
E
R
I
C
_
U
D
P
_
R
E
F
L
E
C
T
I
O
N
Share
of
all
events
Event Vectors

Infrastructure Layer DDoS Events in 2022 vs 2024 – top emerging events
401.3%
349.2%
122.2%
105.7%
91.0%
24.9%
8.8%
0%
50%
100%
150%
200%
250%
300%
350%
400%
450%
R
I
P
_
R
E
F
L
E
C
T
I
O
N
H
T
T
P
_
R
E
F
L
E
C
T
I
O
N
R
E
Q
U
E
S
T
_
F
L
O
O
D
D
N
S
_
R
E
F
L
E
C
T
I
O
N
U
D
S
_
R
E
F
L
E
C
T
I
O
N
G
E
N
E
R
I
C
_
U
D
P
_
R
E
F
L
E
C
T
I
O
N
N
T
P
_
R
E
F
L
E
C
T
I
O
N

Quarterly P99 Request per second, by year
0
20,000
40,000
60,000
80,000
100,000
120,000
140,000
160,000
180,000
200,000
Q1 Q2 Q3 Q4
2019
2020
2021
2022
2023
P99 Request per second
19.9% YoY increase

DDoS from the Front Row

© 2024, Amazon Web Services, Inc. or its affiliates. All rights reserved. Amazon Confidential and Trademark.
Customer responsibility
• Design resilient architectures:
§ Use AWS services with better protection against DDoS attacks
§ Reduce the attack surface
§ Build scalable applications
• Use application level security controls such as AWS WAF.
• Ensure observability and monitor the traffic to understand baseline
• Detect anomaly, prepare run book for incident response which involves
platform support
46

Protecting web applications
47
Private subnet
Amazon CloudFront
Amazon Route 53
AWS WAF
AWS Cloud
Public subnet
ALB
AWS Edge Services Region
AWS WAF Compute Capacity
Amazon S3
VPC
Shield Advanced
protected resource

Protecting on-premise applications
48
Private subnet
Amazon CloudFront
Amazon Route 53
AWS WAF
AWS Cloud
Public subnet
Application Load
Balancer
AWS Edge Services Region
Corporate data center
TGW
Customer
Gateway
DX/VPN
Internet
Compute Capacity
Shield Advanced
protected resource

AWS Shield Advanced Features
49
AWS Shield
Advanced
Near real-time
events visibility
and alerting
24/7 Support of
AWS Shield
Response Team
Health-based
detection and
proactive event
response
Infrastructure
and application
protection (L3-7)
Application attack
detection and
automatic mitigation
with AWS WAF
Cost protection
for scaling during
an attack
Amazon
Route53
Amazon
CloudFront
AWS Global
Accelerator
Elastic Load
Balancing
Elastic IP
Protected Resources
AWS Firewall Manager
for Centralized
Management
AWS WAF for
Application protection

February 15th, 2022
50
On the 15-16th February a number of Ukrainian websites were taken offline due to Distributed Denial-of-
Service (DDoS) attacks. The impacted sites included Banks, Government and Military websites.

Attack profile
51
• Mirai botnet (actually – forked “Katana” network)
• Mikrotiks, Avtech network cameras, etc
• Not just DDoS:
• Fake SMS messages about ATM issues
• A denial of service attack against the .gov.ua
DNS servers; and
• A BGP hijacking attack against the
Privatbank IP space causing difficulties
routing traffic to their network.

Customer ingress architecture
52

Chronology
53
Feb 15.02
12:00 - attack started (first wave)
18:00 - customer reaches out AWS account team
18:20 - internal escalation inside AWS
19:26 - customer case created
19:46 - AWS war room created
22:00 - WAF configured for mobile endpoint
23:00 - WAF configured for web endpoint
Feb 16.02
00:00 - attack peak (first wave)
3:00 - attack stopped (first wave)
10:00 - attack start (second wave)
11:50 - Shield Advanced activated
12:00 - attack stopped (second wave)

GA overloaded -> AWS outage in GRU (Brazil)
54

WAF to the rescue
56

WAF to the rescue
57
• Block Brazil traffic
• Reputation list - block
• Core rule set
• Rate-limit - 2000 requests

WAF to the rescue
58

WAF to the rescue
59

So, why do we still need Shield Advanced?
Shield Advanced enabled
60

L3/L4 attacks
61

Stats
62

Stats
63
Wave 1:
mobile:
1.5Mrps - total blocked
1.266Mrps - rate-limited - most efficient rule
333Krps - county block (Brazil)
web:
20Gbps - incoming bandwidth
Wave 2:
mobile:
not affected
web:
40Gbps - incoming bandwidth

It’s not over yet…
64

Thank you!
Please complete the
session survey

"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk

Recommended

Recommended

More Related Content

Similar to "Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk

Similar to "Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk (20)

More from Fwdays

More from Fwdays (20)

Recently uploaded

Recently uploaded (20)

"Frontline Battles with DDoS: Best practices and Lessons Learned", Igor Ivaniuk