>> The speaker coming up right now is Blake and cisc0ninja, they are going to be talking about Don’t DDoS Me Bro.  Let’s give them a big hand, a Def Con welcome, come on. 
	>>  Testing, 1, 2, 3.  Alright, first off I want to apologize to you guys.  I’ve been sick for the past few days so my throat is kind of jacked up.  So, I know a lot of you guys are having a good time out in Vegas.  I know my good times have been like hot totties and cough drops but Blake is going to be doing most of the talking so, you know, really out of the two of us he is kind of like the better half so to speak so you you’ll be really glad about him talking anyways.  The bottom line for our talk is kind of like, it’s practically DDoS defense.  It’s all about the cost, we want to drive the attackers cost up without driving your cost up.  So, we’re not actually trying to promote and high cost stuff.  It’s like, pretty much, open source so we’re going to go and first off we’re going to start off by showing you some of the attacks we’ve seen, we’re going to show you some of the mitigation efforts and then if we have time for it, talk about some lulls we’ve had in the process.  I never would have thought something of death would be like, so popular and cause so much damage.  Now days it’s been revamped with daedric armor and the former get post request coming from every bot net you can think of.  In fact, there was a guy that came up to us yesterday and was more or less, man, you got on that soul direct shirt, I DDoS’d the shit out of those guys.  I’m like, ok, what for?  They had all my information messed up, all that HDB and just everything was all wrong.  I was like, did you hit up the admin?  He’s like, no man I just DDoS’d them man.  Ok.  (Laughter).  >>  You didn’t send an email or anything, you know, we’ve got IRC forms.  No, man I was just DDoSing, it’s all about the DDoS.  That’s the mentality, I guess, that some of our opponents have, so.  >> Ok, so here is a good idea on some of the humor we’re going to do.  Show of hands, who’s is actually here to defend against DDoS?  Ok, and who is here like DDoS soul direct trying to figure out how, maybe, a better way to hone their craft?  I didn’t really see any Guy Fawkes masks so.  (Laughter).  >>  Ok, so anyways, I always like humor so let’s start out with a little bit of that.  So this is basically how attackers visualize themselves, right?  That’s what they are thinking so then what we’re going to try to do is give you different techniques to use so then your web server should be more like this.  It’s not enough to do anything.  So, a little bit of background he had touched, I think at the time I was a senior security architect that I applied for this.  We had to reorg so now I’m a principal senior architect.  Fortune 500.  I was directly involved with defending against Operation Ababil, probably a lot of you guys have heard of that since you’re dealing with DDoS.  Cisc0ninja works in threat intelligence and has been a long time member of Soldier X.  I’m kind of like, I’ve been with Soldier X a long time with doing more of the back end stuff and I’ve also, I guess, kind of known as the back in the 90’s at least, the only guy dumb enough to use his real name instead of a handle in the group.  Because, you know, everybody has hacker aliases.  A quick disclaimer; opinions, ideas, solutions all that stuff is from us it’s not from our employers or representative for them whatsoever.  Since we have Def Con kids now we do have some explicit language and you know, some pictures in some of the slides.  So, just a heads up.  What we are going to cover, course requirements, have a bit of introductions, show an attack landscape, then we have basically two parts we defend on. The network side and the web defense side.  So you can actually try to protect the network layer or you can actually do it on the web server.  I always think it’s important for defense in depth, especially depending on what technologies you have or what your company will let you do.  Maybe your company says you can’t use snort inline or you can’t have this or have that.  So basically we try to give you a whole slew of things.  You get enough of those and you’d be good.  We’re also going to go over reacting to an attack.  It seems like a lot with these big companies, you know, the website goes down and everybody starts freaking out.  Instead of properly reacting everybody is like, oh my god it’s the end of the world, the website is down what do we do?  Then, at the end, try to get some best practices; put everything together.  If we actually have time we want to do, basically, story time, some fun that’s happened with Solider X.  Obviously you put that at the end so you guys get the information that’s actually useful to you since fun stories aren’t that useful to you.  So for requirements, for our examples.  For soul direct we use Linux, but you know, Linux, UNIX.  Apache2 is the web server we use, Python and Perl for the scripts that we have. For our monitoring system it actually runs on Raspberry Pi, because you know, it’s like five watts of power.  We have a sixteen by two LCD as you can see at the bottom.  It basically says Soldier X is up, Soldier X is down.  That monitoring tool is actually, it should be on the Def Con CD.  It’s also in the – if you look at the first slide it has the Soldier X address; it’s in that directory as well.  So, you should have Snort inline if possible.  There is also, we’re going to give an example with an F5; the F5 is kind of an expensive load balancer so we aren’t necessarily saying you need to have that but I know some people don’t have Snort.  Some of you might have Surricata, we’re not actually giving examples for that but you should be using, like, you know the stuff we show to build your own Surricata rules as well.  Network sniffer hardware if possible.  It’s important a lot of the time when these attacks are going on to see what’s coming in versus just speculating.  And then of course you need critical thinking skills.  DDoS is not, there is no real silver bullet.  You need to be able to adapt as your attackers adapt.  So, why this talk is relevant that we fill?  At least since from 2010 from what I can see, Layer 7 is on the rise.  Operation Ababil, for those of you who are familiar, was an attack from the Middle East because there was a Youtube video that was offensive to some of the Islamic people.  Basically they said, ok, Youtube has this video up and unless they take it down we’re going to attack all of the financial infrastructure.  They hit all the big banks in the United States.  Obviously, the banks have no say so in what Youtube hosts but that was their mentality.  So basically there is also DDoS seems to be one of the preferred methods of hacktavists, or like he said, somebody has an issue with something on the Soldier X site, instead of emailing us, they are like, I’m just going to DDoS the shit out of that site.  You know, this is how I’m going to react and you’re like, ok I’m being hit and you don’t even know why half of the time.  So, what kind of spawned this talk is I went to CloudFlare’s talk last year and they showed a lot of cool attacks and then solution was get CloudFlare.  I was like, that’s not what – that doesn’t really resonate with me so we actually did try that.  We actually did get CloudFlare.  We still even have our DNS going through CloudFlare and so, there is a cost factor.  There is also, it’s like, there is security through obscurity really.  I mean, if they know your IP address then they just DDoS your IP address.  For Soldier X, for instance, the website will leak the IP address.  You know, you sign up for new accounts, it sends and email out, you look at the email and boom there is the IP address.  Now, CloudFlare could say, you need a separate server, you need this, you need that, but we’re basically a non-profit security hobbyist.  We aren’t trying to build this infrastructure to make sure it works at CloudFlare.  There is also historical records that people could use for, let’s say, you’re a big company and you have Slash 16 where you’re probably not just going to move that because you need CloudFlare.  You’ve also got DNS brute force.  I don’t know if you guys have heard of knock, that’s like a – I saw it on some Russian forums that actually just brute force as a records.  And last but not least, an old technique is pointer record.  You get an IP range, scan all the pointer records, if you have pointer records setup guess what?  They get your IP.  So for us it didn’t really work.  In one funny situation with our interpiece server CloudFlare was actually passing the – they were actually passing this get flood going after large PDFs and CloudFlare actually passed that traffic on to our server and so the server is still going down and you get this error, like, 522.  CloudFlare is fine but your website is not.  And last but not least, privacy concerns.  So, what this talk is, is it’s a real world look.  All of these are actual real world examples.  None of this stuff is made up for this talk.  We actually take Soldier X logs.  The only thing we obfuscate is IP addresses of non-attackers – we actually obfuscate, they were not attacking our site, I don’t want to give their IPs during this talk.  We also have free code examples and of course a bit of humor at DDoSers because we kind of try to keep this interesting.  I know defense can be a pretty dry topic.  So, what this talk is not; a silver bullet to solve all DDoS attacks, a political stance on DDoS, of course not a cry for people to DDoS us even more.  I’m sure people are going to watch this on Youtube and be like, screw these guys I’m DDoSing the shit out of this site.  We’re not selling you a product.  So, let’s see, the attack landscape.  If you have the amplification attacks, which is basically the biggest pipe winds, we’re not covering that, if they have a bigger, more bandwidth than you that’s coming in then you go down.  What we’re going after is the HTTP DDoS.  I guess you’re about to get a shot for – nooo.  Maybe I am too.  (Applause).  >> You guys know the drill.  First time speakers do a shot.  >> This is actually my fourth time speaking.  >> But it’s his first time, right?  >> Wait, give me that.  >> You already gave it to me. >> Cheers to Def Con.  >> Cheers.  >> So, back to the – the HTTP DDoS is our focus.  Usually in the form of large GETPOST requests.  They will go after large PDF files, they’ll try to hit expensive queries.  If you have search functionality or whatever in your website they are going to hit that.  Of course, for Layer 7 there is other application DDoS attacks we aren’t covering those.  Those are kind of future fun.  If Soldier X starts getting hit with that stuff maybe give a talk on that stuff in the future but right now it’s not going on.  So, why do they do it?  This is my stance; a lack of skill necessary to do an intrusion.  They can’t break into our site so they are like, I’m going to DDoS the shit out of that place.  It could be that some people view it as political protest.  I don’t think it’s peaceful protest since you are actually taking a site down but some people see it that way.  I like little slides because I don’t always participate in DDoS attacks but when I do I use links meant to trick people into joining.  That’s unwilling participation which actually has happened.  Or my favorite – for you guys into the web comics – John Gabriel from Penny Arcade who has the greater internet fuckwad theory.  Which is that you take a normal person, give him anonymity, put an audience in front of him and they become this total fuckwad.  (Laughter).  >> So that’s – we’ll actually get back to one of the methods with Soldier X is we’ve actually publically shamed some of these people if we can get attribution.  It actually seems to have worked really well which kind of led me to say, you know this theory has a good point to it.  So, with Layer 7 DDoS it drives down the cost of a DDoS.  The attackers have a very high return on investment.  They don’t need a whole lot of bandwidth.  It evades most current carrier mitigations and they can really take down your site with minimal effort.  We’ve seen sites taken down through (indiscernible) which isn’t all that fast.  So, our goal then is drive up attacker costs, reduce the defensive costs, so we’re trying to teach you technique rather than sell you products.  Mitigate when possible.  You may always be able to mitigate you can at least drive up those costs.  And then just get people thinking about solutions to this problem.  Then we have the famous quote to give a man fish, teach a man to fish.  So, first let’s get into an example attack.  Important note with the Al Qassam cyber fighters, a lot of stuff I can’t tell you because of you know, where I work and basically, agreements that I’ve made but if there is people from the financial section or something, you know, get a hold of me afterwards and if I could verify you I could give you a lot more information on this if you need it.  So basically Operation Ababil is a large 
scale DDoS attack via a PHP based bot net, which they called Brobot, against American financial institutions.  Now if you look the first thing I don't know probably pretty small but basically you have the wordpress/joomla, some CMS site.  It was actually a really small, really clever back door where you see like if they call the PHP directly, JEXEC won't be defined so it will say hey, die with restricted access.  They change it so if JEXEC is not defined then die by evaluating a Base64 encoded blob on CID.  So you pass a Base64 encoded attack script and boom it goes; it does your bidding.  So there's a couple pieces of example code you can kind of get an idea.  Like if you see the first example it's not really a proper request the way it is set up.  It doesn’t give a lot of data.  Then, as you see the second example they actually tried to randomize the refer and the user agent and try to do a more proper HTTP request, generated some fake IP's for (indiscernible, client IP’s and stuff like that.  On Soldier X which we can basically give you anything we want from Solider X.  We have our usage policy is that if you attack our site we can share your information.  If you're just visiting then we won't but if you're attacking us we will do whatever we want with it.  So yeah so one was kind of weird I thought.  It was like, critical mass.  There's like dirty panties picture where there's him and some girl from Def Con back at Lexus Park so somebody actually did the DDoS trying to grab that picture over and over.  There was this other one, like a seemingly random just request with all these characters then you have some other like (indiscernible) law guy it says fuck you mother fucker tango down and gives his Twitter address.  Which could be not him at all, it could be somebody wanting to set him up but that’s what was in there.  And last but not least you have hitting a random slash node.  This is my favorite though.  This doesn't have a whole lot of purpose but I just liked it.  Imma Firin’ Mah Desu.  This is like a single request.  Like look at the log; what is this?  (Laughter) >>  Desu, desu, desu, desu.  (Laughter)  >> I would really like the guy who did this attack to give him a drink.  It made me laugh for so long.  So going in then the network defense your carrier has some capabilities.  So you can have a black list malicious IP addresses and you can limit packet sessions, band width, per second IP that can be useful if they can do it.  Black hole, a protocol or port.  A lot of times if you see weird UDP floods I know that ends up being fairly effective.  It's not what we're covering but I wanted to throw that in because we're trying to be as exhaustive as we can on this talk to give you guys like a good idea about this stuff.  You can use IPs like Snort or CeraCotta.  It’s often ideal as long as they're not using SSL you can drop that traffic before it hits your web server.  So that's pretty good.  And load balance of course, like F5 it's pricey.  I saw them at Black Hat, I guess now they're advertising DDoS where before it was a load balancer.  But you can use the Irules, it supports regular expressions, and end up blocking that traffic there as well.  Firewalls, iptables, black list IP addresses.  A lot of people talk about geographic blocking.  I've not really seen that work very well but I mean depending on who your attacker is maybe it might work for you.  It really depends on your adversary and who is coming after you.  We do block EGI Hosting, I don’t know if that hosting company is really insecure or what but if I remove a block, like Soldier X starts getting hit like crazy and finally I think they've actually black listed from their site as well to stop their network from talking to ours.  I’m like, I don't know what's with you guys.  I didn't block you, just restart a server or something.  Boom, here it comes from EGI hosting.  You can limit your packet sessions, band width per second per IP on your level too.  So back to VoxLulz1, it may not have been VoxLulz1 but we’ll refer to him as.  You see he’s got this nice fancy user agent, fuck you mother fucker tango down.  So, how we block with Snort inline.  You have a simple Snort rule, you can go through.  (Laughter) >>  We had to have humor to try to keep you awake.  Like I said, I always give offensive talks.  I do reverse engineering and exploitation.  It seems it would be kind of easy to keep people's attention but this stuff, to me, is kind of dry.  So we will try to keep you a little entertained.  So you have the Snort inline and you can stop them there.  Then it doesn't reach the web server.  If you have F5 load balancer you then see the Irules right there so you can block them at that point.  You've got also, he came from EGI hosting so we have that block where you block the whole slash 24 and you’ve also got the limiting connections with IP tables.  These are real world examples you can copy and paste or modify just to get you in the mind set how to do this stuff.  With network defense I also wanted to mention Blocking TOR.  Well isn’t TOR too slow to take you down?  Actually, hack3r is a group we used to do stuff with and they were taken down in 2013 then again in 2014 via TOR.  So we have a script, this is modified from another website.  All the stuff, anything borrowed or used from anywhere will be at the end in the references section, so all of this stuff is referenced, we don’t want to steal anyone’s credit.  This is modified from the site and this will basically go through, get a list from dan.me.uk. and then build an iptables rule and block it.  I don’t know how many companies have issues with TOR but I know, at least the place I work we see a ton of attacks coming from it.  No real reason for us to have it.  Like I said, TOR, people say it's a great thing.  I don't disagree with that but there may not be any point.  If you're a bank or you sell things I mean someone is giving up their identity when they buy something for you or when they log in to their bank account so there isn’t really a reason to use TOR to do that.  It’s a question that I propose.  So aside from just the blocking side it's important for a lot of people for network monitoring to figure out am I under attack or maybe your company might say, you know, I would like to know if we're being attacked but I don't trust you putting this in line and blocking customers and whatever so you can just basically, same snort rule you just have it do an alert instead of a drop so that way, you know, you just get notified of it.  With the F5, what I always do is I just common out the drop and you can still go in and get the notification and see you're being attacked.  But it doesn't actually drop it.  Then next we'll get into for monitoring software we have RoboAmp, which Rat with Solier X wrote.  Actually I'm surprised my phone hasn't gone off, I really expected when we announced the talk we started getting DDoS like crazy.  I really expect the site to go down during this talk and my phone will start going crazy and it will start telling me, hey the site is down.  But I don't know.  I guess I'm lucky.  So, it runs on a Raspberry Pi. It uses less or equal 5 watts of power.  It displays the power and little sixteen by two LCD, now you don't need to have an LCD to do this.  That's just if you want the display.  It actually sends an SMS message to the SX staff that there's a disruption.  You have the options; basically you have a ping check which probably isn’t as useful in today’s – you know if you’re talking Layer 7.  Your website is going to kind of -- or database will go down and you will get an error message.  You aren’t actually -- the ping check will not do a whole lot for you but we left it in there just in case you're worried about that whole massive attack that takes down the network.  The deep check, actually what it does, it looks at the website and you can specify regular expression for like basically what that means if your site is offline.  Some companies don't actually say we're offline.  They say, oh we're doing a little bit of maintenance we'll be right back.  They don't want to acknowledge they've been DDoS’d so it supports that as well.  So then after that they go back to web defense or on to web defense and like I said we use Apache2 at Soldier X so that's going to be our focus.  You can use .htaaccess for example.  A lot of people seem to like, oh, why do you use .htaaccess but can actually protect files, directory listings, you can block user agents  There's other clever things we will get into, like, you can redirect a bad request back to themselves or maybe you want to redirect them to somewhere like FBI.gov.  (Laughter)  >> Like I said Soldier X is basically a hobby security group and we can do things as a company you wouldn't want to do but it's all in good fun.  So mod_evasive is the equivalent if you're an IS shop, dynamic IP restrictions for Microsoft, essentially this is one of the critical things that I would say to use because you can actually use – you’re throttling how they can hit your site.  At the end of the day without looking into the traffic that's ultimately what you are going to do to drive up attacker cost.  So say user agent seems weird and whatever.  This limiting seems weird.  Does this really work?  You have to know your enemy.  So why?  You've got these subset of anonymous with an F5 armed against us.  You've got basement dwelling 12 year olds armed with GET flood script posted to pastebin last Tuesday hitting us.  This is pretty much how we view our enemy at least at Soldier X.  So getting into some of those example directions with .htaaccess that's an easy way to block VoxLulz or get a little creative and use mod_rewrite and redirect to themselves, redirect them more interesting like the FBI.gov.  Like I said, it’s the FBI party van.  Somehow it's a lot more funny when it’s not parked in your driveway.  (Laughter)  >> Then we just give you a Mod_evasive sample config.  A thing I’d like to add is if any of this stuff, if you and copy and paste it or whatever you have issue with it I’m not going to work for you for free or anything but I’d be happy to give you stuff that I’ve already written and put it on that directory on the site. If you guys have access to that just, you know, I'll give an email at the end of this as well as IRC and what not just to try to help you guys get started on this.  So, then moving on to Fail2Ban. It's actually designed to protect against brute force attacks by looking at error logs.  What we've actually done and this is by no means new, there are other people doing this as well.  Just not a lot of people it seems.  You can point it at your access logs for your web server and use it for DDoS defense.  If you remember the random pattern from earlier you notice the attacker didn't seed it right.  So you see that it is already repeated but then you also see I highlighted the equal mark.  So when we get into that you can turn a randomized DDoS attempt into a worthless attempt.  What we see with that is it’s a capital letter A through Z -- 99 of those then an equals sign, then A to Z and another 99 of those.  So you set your regX and have your notes, no DDoS for you and boom, blocks them with IP tables when they hit you with that.  Once it sees those it puts them in the IP tables.  I think we blocked them for like 24 hours.  You can do however long you want but to add on some additional ideas you have server caching or web caching.  A lot of the stuff turns out to be performance enhancements so it’s good anyway but it actually ends up helping DDoS. I think a lot of issues with Layer 7 DDoS is just nobody was really hitting our websites.  We had expensive inquiries or this or that but it wasn't really a problem for us.  It was more or less like oh the search is little slow but.  And then someone hits it and it’s get, get, get, post, post, post it's like oh crap the freaking website is down.  With Soldier X we use boost.  I talked to people that use squid proxy for caching.  They said that has worked well for them.  There are some other Apache tools that other people have mentioned to me.  Like I said, if we don't use it then we don't give examples so we're not going to make theoretical stuff up and say this works and we don't know.  But you have mod_bwshare to throttle the bandwidth for IP, you’ve got limit ip connection to limit the number of simultaneous connections from the IP and there's people using Captcha, Javascript and those type of things to actually try to detect is this a bot or is this a person?  Also for your programmers you really need if you have a website that has these different queries try to talk to your developers.  They need really get on to this stuff with strict validation, filter user input, properly release resources because you don't want it eating up all of the memory.  Set limits.  So you have session limits, token expiration, loop counters, concurrent sessions per token for IP address, expensive queries should be limited per IP address.  It doesn't make expense you know you have a really expensive query why would you let someone hit it 50 times a second.  It doesn't make sense.  Cache the results of those queries when possible, like what boost does.  It will – anything something someone goes to that is PHP it generates an HTML file so boom there they go.  Let’s get the HTML file instead of running the query over and over and over.  Optimize your database structure and like I always say I have a CS background, you should be testing.  You should be testing your code against denial of service or distributed denial of service and that should be part of quality assurance in your organization.  This is something that seems to be just a mind set of these guys they're just going to come in and DDoS you if they do anything you don't like or do it for fun.  So it really should than part of your testing.  If anybody needs like some sample code I can put it in that directory and you can use that to help test in your organization.
>> Testing, ain't nobody got time for that.
>> That picture says  I don't know when I use code I do it in production.
[Laughing].
So on to reacting to an attack.  I always say don't panic.  When I've seen these attacks you have people throwing their hands in the air.  Oh my God what's going on?  The website is down.  There is no internet.  So also verify it's an attack.  I'm not going to say which company but it was like oh my God we're being DDoSed.  It's no it's just your employees watching FIFA via HD on YouTube.  >>  1080p.  >>  And read the logs.  It’s amazing to me how many people don't actually read logs.  Web logs are good.  They actually give you a bit of insight into what people are doing.  If you see an IP pounding away it's a good indication it's an attack instead of, you know, oh the web site is down.  So getting all the top talkers and blocking the malicious ones, there's a quick thing from the command line that you can do to give you all the IPs and how many requests per IP.  If you're in Linux of course like we said and you need some sort of reputation system.  Especially if you share with other organizations.  I know I've seen cases with financial sector where data is being shared out and you look in this top talker's block and it's oh it's tax time and Intuit is in here.  Of course everybody is using Turbo Tax.  They're not DDoSing you.  It's freaking tax time or other organizations that query data from you.  So we use a home grown tool that we call reputator.  I will show you a little bit of output from that.  So, in a top talkers example, I like this picture.  Be mindful of that.  Only one is a convicted felon.
[Laughing].
>>  But how this stuff goes people are taking this assumption.  Oh, whoever is generating all of this traffic my web server must be malicious.  It's not true.  So this is an example that we use for the Desu attack as we go through.  We're masking all the IPs that aren't actually attacking.  And, you want to decide on a cut off.  You see on the left is the actual number of requests they've done.  On the right is the IP.  So we decided like a thousand is probably a good cut off.  You run it through, I don't know how well you can see that but I'll try to explain it.  Run it through reputater.  Also one thing that reputator does is you grab the list of TOR nodes, you like to know if somebody has TOR, it's useful information.  You get a rating that we put between good and evil and if you look, like of course, local is like Roboamp which actually amp is in the audience if he wants to stand up, raise his hand.  The reason his name is Roboamp is every time the site went down amp would hit up everybody.  Hey the site is down.  What's going on?  It was like man this is crazy.  So when Rat wrote the tool he named is Roboamp.  It's like the robot version of him and he's always texting so it’s good that it texts.  But back to the top talkers.  If you look  so we have the good and the next highest talker is rated as evil then we look back to the log and we see, hey, that was the Desu attacker.  So it's pretty good and there's some other evils up there.  Those guys are actually  they're going around the site trying to do stuff but it wasn't DDoS.  I still masked their IP but they were still up to no good.  Then of course reacting to an attack.  Read logs.  Look for patterns that you could use for Fail2Ban or whatever blocking system you are going to have in place.  Often very early on blocking user agents and IPs, I'm not a fan of black listing IPs but early when the attack is going on sometimes that can be what you need to do right away to keep your site online.  Then beyond that use sniffer and wireshark if you can.  SSL forces an issue like if you’re using RSA or if you're not using RSA and you’re using DSA that has forward secrecy you can't see the traffic but if you are using RSA in your organization are they going to give you their private key?  Maybe.  But if you can get that you can look at it.  And from that, you know, Snort F5, Surricata, etc you can block at the network level which is often a little more intensive work wise but it can have a better payoff because it never even reaches the web server.  So, can you find the difference?  I love that picture.  So this is  yeah  a sniffer plus wireshark example.  So the first one if you see this has been blocked so there's 3.  The first is an actual legitimate web request.  You say okay pass the carriage return the new line:  The second one is a popular perl DDoS application.  If you look and it doesn't have the carraige return, GET flood, HTTP1.1 it basically has nothing.  Pretty easy to see that's not valid.  After that you have an attack tool that uses PI cURL, python DDoS tool and that one it's better.  It has a carraige return a new line but if you look like the variables don't quite match up what a browser would, they're out of order.  So they're all these little things that really is like you look at and actually use your head then get rules to stop these attacks.  So then after an attack if an attack was effective why was it effective?  In the brainstorming organization you need to do a lot of testing, deploy these defenses, we're not going to work for your company for free but happily anything here I will put online and let you use that as a good base to get started and test your network against a similar attack until your defensive or effective.  Don't wait for the attacker to come to you.  This is part of like the Solider X stuff.  Anytime we see the stuff we write tools to duplicate the attack and pound on the servers and make sure our defenses actually work.  The controversial thing it keeps coming back up in the news.  Let's hack back.  So we have some form users that have hacked the DDoSers that we can get attribution on with some success.  It's kind of amusing, some of the stories.  I have a quote from Jeff Barden, I’m not actually going to read that one because I don't really think hacking back is good but some people may like it so I think it's not a good idea in general and that's where I quote Jericho, Brian Martin of Attrition.  If a company can't do the defense correctly why do you think they can do offense right?  And if you can easily and positively attribute they shouldn't have breached your differences.  You have no business attacking them when you were negligent on defense 101.  I agree.  If you can 100 percent say who is attacking you and why they got through that doesn't make any sense.  You should have had defense in place.  But shame; back to the John Gabriel’s theory.  Shame has actually worked really well on Soldier X.  It seems like we have these guys that hit the site hard and we actually come in and we have a really good guy that does data analytics and he has a data analytics platform that runs on the site and we actually can get positive attribution if you name the people out it's like instantaneously they stop attacking you.  So I mean for most companies you probably can't do that but it's interesting to think about.  So then tying this stuff together with best practices is like I said most important thing I think is limiting connections.  Because when you do that you drive up costs.  If somebody has to  have a botnet a size you drive it up more.  Have intelligent ways to block bad traffic.  Snort inline, Fail2Ban, whatever.  You need some way so if someone is actually brighter and has some pretty good attack you need to be able to identify that and block it.  Have sniffers in place.  I've seen organizations where they don't and it's like we're getting attacked.  Oh we have to get sniffers in place and figure it out.  You should already have them in place.  And tune your web server and database for performance.  One of the things like log tuning, like what’s log tuning?  It's like you should have where you're getting things like client IP and X-forwarded-for in your logs.  You probably don't want to log small static content like CSS, JS, text, if it's PDF or large pictures you probably want to log that because it can be used in an attack but a CSS file, a JS file isn’t so why log that?  All you are doing is making your web server take up that many more resources trying to log all of that.  You should remove or limit the search functionality if not needed.  You can replace it with Google search or it requires loggers to log in.  That is how hack3r was taken down.  People hit their search functionality and held the site down for days and everyone is laughing about it.  Avoid hosting large public files when you can like large PDF getrequests.  It still goes on so if you can have those not public that is ideal, sometimes you have to.  Having a monitoring service like Roboamp.  I now a lot of you guys might pay for something but Roboamp is free and you can set that up and actually get notification if the site goes down.  Instead of like hearing about it from your boss.  And then sharing information.  It has been good for the financial sector.  I think if you can you have similar companies and if you can share that sort of information everybody gets on the same page and gets those defenses in place and these guys will see this stuff doesn't work anymore.  So I don’t have much time for questions but I want time for questions.  So, a little bit of story time.  So VB is the first guy to do this took the site down for like 5 minutes.  This was before we had anything in place.  He actually did it from his IP that his user account was from so we were able to do positive attribution.  So this guy hacker on the forum a reformed criminal but the fixer got the IP we posted on the forums and turned out that VB's ISP was mikrotik routers, that’s who the fixer used to work for, he knew there was a back door in the router so he got into the guy's ISP, turned on remote pcap and basically lols ensued.  All sorts of stuff that VB was doing, who he was and it was a good time.  BenOwns is interesting.  This is a guy that wanted access to VIP forms to use like a stolen credit card and all this weird stuff.  He was like oh I don't want you guys to say that I did this.  Well you did do this so it’s on the site.  So he actually started to threaten the site and blackmail them and proceeded to DDoS.  More shame happened.  Once we said this guy was DDoSing he took off as well.  There's been many stories of pizzas being ordered when there's an attribution.  The EGI hosting stuff I already covered.  Plexor was the guy that when we announced this talk immediately the site started getting DDoSed.  Is this a friend messing with us?  It was a guy that didn't like we were giving a talk on this and the last one I’ll much is Scorpion – was Operation Ababil, Cisconinja did a lot of hacker database work so he found some evidence that Scorpion was involved in Operation Ababil.  So that got posted onto the hacker database and all of the sudden we saw some hits where there was a Black Hat Middle Eastern forum and they were like what is this?  These Soldier X guys are saying Scorpion is involved in this.  All of a sudden the site was hit with Operation Ababil tools.  It was not actually hit from the Brobot but it was hit from the same attack tools and since I was actually defending it against Operation Ababil I said you really are him and using these tools so you gave yourself away.  A little bit of thanks.  Anonymous network technicians didn't want their names in here.  So if you talk about DDoS you will get DDoSed which may happen but oh well.  Rat, for writing RoboAmp helped a lot with this, a lot of the rules and The Fixer, lattera, spendor, sn4ggi, Shinobi, Kohelet, EverestX, Jericho, Jeff Barden, Rhapsody and the entire SoldierX.com community to include the irc.soldierx.com and of course the DDoS skids like honestly it's a lot of entertainment for me.  So I had a lot of fun at your expense.  References of course for you guys to use then this is our contact information if you want to reach out to us.  This is where the data is and I think we have a few minutes for questions.
[Applause].