Securi-Tay 2020: Densor - Effective DDoS attack tracking

## Overview Lloyd presents Densor, a threat intelligence platform for tracking DDoS attacks. Developed in his spare time, Densor aims to provide organizations visibility into DDoS campaigns and attack patterns through honeypot-based monitoring and malware analysis.

## DDoS Attack Landscape DDoS attacks fall into three categories: attacks on resources (attacker renting servers), reflection attacks, and volume attacks, spanning OSI layers 3, 4, and 7. The barrier to entry is extremely low—four dollars can rent a service capable of taking small enterprises offline. Attack motivations range from teenagers annoying peers to organized criminals seeking profit. Reflection attacks dominate the threat landscape because they're cost-effective and can deliver 5+ gigabits per second.

## Reflection Attack Mechanics Reflection attacks exploit vulnerable services by spoofing the victim's IP address. A 39-byte DNS query, for example, can receive a 3+ kilobyte response; when the attacker spoofs the victim's source IP, that massive response goes to the victim. Attackers scan the internet for vulnerable services (DNS, NTP, TFTP, LDAP, mDNS, TeamSpeak) and filter by largest response size. To execute these attacks, threat actors must use providers that don't block source IP spoofing, often paying premium prices on black markets for this capability.

## Mirai Botnet Mirai is responsible for major DDoS attacks. Its source code was leaked in 2016 by someone using the alias "anna senpai," identified as a 22-year-old from Massachusetts. The creator worked at an anti-DDoS company; the leak backfired by preventing attribution. As open-source malware, Mirai spawned many variants used primarily by individuals aged 15–23. It evolved from brute-forcing default credentials on IoT devices (especially Chinese-manufactured routers with identical firmware across multiple brands) to exploiting firmware vulnerabilities. Mirai targets multiple architectures (x86, x64, MIPS, ARM, RISC-V) by cross-compiling binaries for each. The original creator was caught via university network compromise and now works with the FBI.

## Densor's Monitoring Approach Densor collects botnet samples through honeypots (e.g., Cowrie SSH honeypot) and emulates the botnet environment to observe attack behavior without continuously attacking victims. Extracting command & control information is challenging because Mirai obfuscates strings and operators modify code. Densor uses Unicorn, a CPU emulation framework, to hook library calls and extract data across multiple architectures without separate VMs. Data is logged into Elasticsearch and exposed via WebSocket API for organizations to query attacks and receive alerts.

## Key Observations The USA is the most attacked country due to abundant vulnerable DNS servers. Large organizations are typical targets. Zero-day exploits trade in specialized circles at higher prices than reflection attack services. IoT devices are primarily useful for DDoS botnets due to poor computational power and return on investment for traditional exploitation.

## Takeaways The low barrier to entry and open-source nature of malware democratize DDoS capabilities. Reflection attacks remain dominant due to cost-effectiveness. Honeypot-based monitoring and threat intelligence sharing provide visibility, though operating honeypots exists in a legal gray area.