Arrêter le Ddos de Bryan à l'aide du service marketing

Début 2013 une plateforme d'affiliation est la victime d'une attaque par déni de service distribué.

Même si c'est mal©®™, comment a-t-elle cherché à démasquer l'attaquant.

Gaëtan Duchaussois - Kwanko

L'attaque

 _____________________________________________________________________
/                                       _                             \
|   ___ __ _   _ __ ___   __ _ _ __ ___| |__   ___   _ __   __ _ ___  |
|  / __/ _` | | '_ ` _ \ / _` | '__/ __| '_ \ / _ \ | '_ \ / _` / __| |
| | (_| (_| | | | | | | | (_| | | | (__| | | |  __/ | |_) | (_| \__ \ |
|  \___\__,_| |_| |_| |_|\__,_|_|  \___|_| |_|\___| | .__/ \__,_|___/ |
\   )_)                                             |_|               /
 ---------------------------------------------------------------------
  \
   \
       __     
      UooU\.'@@@@@@`.
      \__/(@@@@@@@@@@) -> User
           (@@@@@@@@)
           `YY~~~~YY'
            ||    ||

L'attaque

 ____________________________________________________________________________
/         ____  _            _    _           _                              \
| __/\__ | __ )| | __ _  ___| | _| |__   ___ | | ___                         |
| \    / |  _ \| |/ _` |/ __| |/ / '_ \ / _ \| |/ _ \                        |
| /_  _\ | |_) | | (_| | (__|   <| | | | (_) | |  __/                        |
|   \/   |____/|_|\__,_|\___|_|\_\_| |_|\___/|_|\___|                        |
|                                                                            |
|          ____ _           _                                                |
| __/\__  / ___| |_   _ ___| |_ ___ _ __   _ __ _____   _____ _ __ ___  ___  |
| \    / | |   | | | | / __| __/ _ \ '__| | '__/ _ \ \ / / _ \ '__/ __|/ _ \ |
| /_  _\ | |___| | |_| \__ \ ||  __/ |    | | |  __/\ V /  __/ |  \__ \  __/ |
|   \/    \____|_|\__,_|___/\__\___|_|    |_|  \___| \_/ \___|_|  |___/\___| |
|                                                                            |
|                              _     ____                                    |
|  _ __  _ __ _____  ___   _  | |   | __ )                                   |
| | '_ \| '__/ _ \ \/ / | | | | |   |  _ \                                   |
| | |_) | | | (_) >  <| |_| | | |___| |_) |                                  |
| | .__/|_|  \___/_/\_\\__, | |_____|____/                                   |
\ |_|                  |___/                                                 /
 ----------------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\ <-Sysadmin
                ||-----w||
                ||      ||

Analyse

 _______________________________________________________________________________________________
(  ____                               _       _ _            __      _  __ _                 _  )
( | __ ) _ __ _   _  __ _ _ __     __| | ___ (_) |_  __   __/_/ _ __(_)/ _(_) ___ _ __   ___(_) )
( |  _ \| '__| | | |/ _` | '_ \   / _` |/ _ \| | __| \ \ / / _ \ '__| | |_| |/ _ \ '__| / __| | )
( | |_) | |  | |_| | (_| | | | | | (_| | (_) | | |_   \ V /  __/ |  | |  _| |  __/ |    \__ \ | )
( |____/|_|   \__, |\__,_|_| |_|  \__,_|\___/|_|\__|   \_/ \___|_|  |_|_| |_|\___|_|    |___/_| )
(             |___/                                                                             )
(  _ _       _   _                            __                  _   _                         )
( | ( ) __ _| |_| |_ __ _  __ _ _   _  ___   / _| ___  _ __   ___| |_(_) ___  _ __  _ __   ___  )
( | |/ / _` | __| __/ _` |/ _` | | | |/ _ \ | |_ / _ \| '_ \ / __| __| |/ _ \| '_ \| '_ \ / _ \ )
( | | | (_| | |_| || (_| | (_| | |_| |  __/ |  _| (_) | | | | (__| |_| | (_) | | | | | | |  __/ )
( |_|  \__,_|\__|\__\__,_|\__, |\__,_|\___| |_|  \___/|_| |_|\___|\__|_|\___/|_| |_|_| |_|\___| )
(                            |_|                                                                )
 -----------------------------------------------------------------------------------------------
        o    ,-^-.
         o   !oYo!
          o /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Analyse

 _______________________________________________________________________________________
/                                                                    _               _  \
|   __ _ _ __ ___ _ __        __   __   __ _  ___ ___ ___  ___ ___  | | ___   __ _  | | |
|  / _` | '__/ _ \ '_ \   ____\ \ / /  / _` |/ __/ __/ _ \/ __/ __| | |/ _ \ / _` | | | |
| | (_| | | |  __/ |_) | |_____\ V /  | (_| | (_| (_|  __/\__ \__ \_| | (_) | (_| | | | |
|  \__, |_|  \___| .__/         \_/    \__,_|\___\___\___||___/___(_)_|\___/ \__, | | | |
|  |___/         |_|                                                         |___/  |_| |
|                 _             __                         _        _ _                 |
|   __ ___      _| | __        / _|  _ __ ___   __ _  __ _(_) ___  | | | ___  ___ ___   |
|  / _` \ \ /\ / / |/ /  _____| |_  | '_ ` _ \ / _` |/ _` | |/ __| | | |/ _ \/ __/ __|  |
| | (_| |\ V  V /|   <  |_____|  _| | | | | | | (_| | (_| | | (__  | | |  __/\__ \__ \  |
|  \__,_| \_/\_/ |_|\_\       |_|   |_| |_| |_|\__,_|\__, |_|\___| | |_|\___||___/___/  |
\                                                    |___/         |_|                  /
 ---------------------------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Analyse

 _________________________________________________________
/   ____ _____ _____      __                              \
|  / ___| ____|_   _|    / /                              |
| | |  _|  _|   | |     / /                               |
| | |_| | |___  | |    / /                                |
|  \____|_____| |_|   /_/                                 |
|                                                         |
|  _   _           _          _      ____   ____   ____   |
| | | | | ___  ___| |_ _     / \    | __ ) / ___| |  _ \  |
| | |_| |/ _ \/ __| __(_)   / _ \   |  _ \| |     | | | | |
| |  _  | (_) \__ \ |_ _   / ___ \ _| |_) | |___ _| |_| | |
| |_| |_|\___/|___/\__(_) /_/   \_(_)____(_)____(_)____/  |
\                                                         /
 ---------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Réaction

 _____________________________________________________________________________
/      __     ____                          _                    _       _    \
|  ____\ \   / ___|___  _ __ ___  _ __ ___ (_)___ ___  __ _ _ __(_) __ _| |_  |
| |_____\ \ | |   / _ \| '_ ` _ \| '_ ` _ \| / __/ __|/ _` | '__| |/ _` | __| |
| |_____/ / | |__| (_) | | | | | | | | | | | \__ \__ \ (_| | |  | | (_| | |_  |
|      /_/   \____\___/|_| |_| |_|_| |_| |_|_|___/___/\__,_|_|  |_|\__,_|\__| |
\                                                                             /
 -----------------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Réaction

 ___________________________________________________________________________
/  ___                     _   _             _   _               ___ ____   \
| |_ _|_ ____   _____  ___| |_(_) __ _  __ _| |_(_) ___  _ __   |_ _|  _ \  |
|  | || '_ \ \ / / _ \/ __| __| |/ _` |/ _` | __| |/ _ \| '_ \   | || |_) | |
|  | || | | \ V /  __/\__ \ |_| | (_| | (_| | |_| | (_) | | | |  | ||  __/  |
| |___|_| |_|\_/ \___||___/\__|_|\__, |\__,_|\__|_|\___/|_| |_| |___|_|     |
|                                |___/                                      |
|      __    _____ _    ___ _                                               |
|  ____\ \  |  ___/ \  |_ _| |                                              |
| |_____\ \ | |_ / _ \  | || |                                              |
| |_____/ / |  _/ ___ \ | || |___                                           |
|      /_/  |_|/_/   \_\___|_____|                                          |
\                                                                           /
 ---------------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Réaction

 ______________________________________________________________________________________
/  ____                                                              _    _            \
| |  _ \  ___  _ __  _ __   ___ _ __   _   _ _ __     ___ ___   ___ | | _(_) ___       |
| | | | |/ _ \| '_ \| '_ \ / _ \ '__| | | | | '_ \   / __/ _ \ / _ \| |/ / |/ _ \      |
| | |_| | (_) | | | | | | |  __/ |    | |_| | | | | | (_| (_) | (_) |   <| |  __/      |
| |____/ \___/|_| |_|_| |_|\___|_|     \__,_|_| |_|  \___\___/ \___/|_|\_\_|\___|      |
|                                                                                      |
|   __     ____                                _     _                  _              |
|   \_\_  | __ ) _ __ _   _  __ _ _ __     ___| |_  | |_ _ __ __ _  ___| | _____ _ __  |
|  / _` | |  _ \| '__| | | |/ _` | '_ \   / _ \ __| | __| '__/ _` |/ __| |/ / _ \ '__| |
| | (_| | | |_) | |  | |_| | (_| | | | | |  __/ |_  | |_| | | (_| | (__|   <  __/ |    |
|  \__,_| |____/|_|   \__, |\__,_|_| |_|  \___|\__|  \__|_|  \__,_|\___|_|\_\___|_|    |
\                     |___/                                                            /
 --------------------------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Réaction

 ___________________________________________________________________
/   ____ _____ _____      __  _   _           _       ___ ____      \
|  / ___| ____|_   _|    / / | | | | ___  ___| |_ _  |_ _|  _ \     |
| | |  _|  _|   | |     / /  | |_| |/ _ \/ __| __(_)  | || |_) |    |
| | |_| | |___  | |    / /   |  _  | (_) \__ \ |_ _   | ||  __/     |
|  \____|_____| |_|   /_/    |_| |_|\___/|___/\__(_) |___|_|        |
|                                                                   |
|      __    ____        _        ____          _                   |
|  ____\ \  |  _ \ _   _| |__    / ___|   _ ___| |_ ___  _ __ ___   |
| |_____\ \ | |_) | | | | '_ \  | |  | | | / __| __/ _ \| '_ ` _ \  |
| |_____/ / |  __/| |_| | |_) | | |__| |_| \__ \ || (_) | | | | | | |
|      /_/  |_|    \__,_|_.__/   \____\__,_|___/\__\___/|_| |_| |_| |
\                                                                   /
 -------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

The magic

 ________________________________________________________________________
(   ____                                     _      __       _           )
(  / ___|___  _ __ ___  _ __ ___   ___ _ __ | |_   / _| __ _(_)_ __ ___  )
( | |   / _ \| '_ ` _ \| '_ ` _ \ / _ \ '_ \| __| | |_ / _` | | '__/ _ \ )
( | |__| (_) | | | | | | | | | | |  __/ | | | |_  |  _| (_| | | | |  __/ )
(  \____\___/|_| |_| |_|_| |_| |_|\___|_| |_|\__| |_|  \__,_|_|_|  \___| )
(                                                                        )
(                           _        ____                        ___     )
(  _ __ _____   _____ _ __ (_)_ __  | __ ) _ __ _   _  __ _ _ __|__ \    )
( | '__/ _ \ \ / / _ \ '_ \| | '__| |  _ \| '__| | | |/ _` | '_ \ / /    )
( | | |  __/\ V /  __/ | | | | |    | |_) | |  | |_| | (_| | | | |_|     )
( |_|  \___| \_/ \___|_| |_|_|_|    |____/|_|   \__, |\__,_|_| |_(_)     )
(                                               |___/                    )
 ------------------------------------------------------------------------
        o    ,-^-.
         o   !oYo!
          o /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

The magic

 _________________________________________________________________________________
/ La semaine dernière, nous avons subi deux attaques, respectivement sur le site  \
| vitrine et sur nos serveurs de tracking.                                        |
|                                                                                 |
| Notre infrastructure a été conçue en anticipant ce type d'attaque et nous avons |
| rapidement mis en place des solutions qui nous permettent d'y faire face sans   |
\ nuire à l'activité de notre plateforme.                                         /
 ---------------------------------------------------------------------------------
  \
   \
      /\_)o<
     |      \
     | O . O| --> Équipe Marketing
      \_____/

The magic

 _________________________________________________________________
/   ____ _     _            _             _                  _    \
|  / ___| |__ (_) ___    __| | ___  ___  (_)_ __  ___    ___| |_  |
| | |   | '_ \| |/ __|  / _` |/ _ \/ __| | | '_ \/ __|  / _ \ __| |
| | |___| | | | | (__  | (_| |  __/\__ \ | | |_) \__ \ |  __/ |_  |
|  \____|_| |_|_|\___|  \__,_|\___||___/ |_| .__/|___/  \___|\__| |
|                                          |_|                    |
|      _             _                    _                       |
|   __| | ___  ___  | |__   ___  __ _  __| | ___ _ __ ___         |
|  / _` |/ _ \/ __| | '_ \ / _ \/ _` |/ _` |/ _ \ '__/ __|        |
| | (_| |  __/\__ \ | | | |  __/ (_| | (_| |  __/ |  \__ \        |
|  \__,_|\___||___/ |_| |_|\___|\__,_|\__,_|\___|_|  |___/        |
\                                                                 /
 -----------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

The magic

 _______________________________________________________
/  _   _ _     _        __  __            _             \
| | | | (_) __| | ___  |  \/  |_   _     / \   ___ ___  |
| | |_| | |/ _` |/ _ \ | |\/| | | | |   / _ \ / __/ __| |
| |  _  | | (_| |  __/ | |  | | |_| |  / ___ \\__ \__ \ |
| |_| |_|_|\__,_|\___| |_|  |_|\__, | /_/   \_\___/___/ |
|                              |___/                    |
|            _                                          |
|   ___  ___| |_   ___ _   _ _ __ ___  _ __   __ _      |
|  / _ \/ __| __| / __| | | | '_ ` _ \| '_ \ / _` |     |
| |  __/\__ \ |_  \__ \ |_| | | | | | | |_) | (_| |     |
|  \___||___/\__| |___/\__, |_| |_| |_| .__/ \__,_|     |
\                      |___/          |_|               /
 -------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

The magic

 ___________________________________________________________
/  _     __  __  ____ _____ _______   __                    \
| | |   |  \/  |/ ___|_   _|  ___\ \ / /                    |
| | |   | |\/| | |  _  | | | |_   \ V /                     |
| | |___| |  | | |_| | | | |  _|   | |                      |
| |_____|_|  |_|\____| |_| |_|     |_|                      |
|                                                           |
|                           _         _   _ __  __    _     |
|  _ __  ___  ___ _   _  __| | ___   | | | |  \/  |  / \    |
| | '_ \/ __|/ _ \ | | |/ _` |/ _ \  | |_| | |\/| | / _ \   |
| | |_) \__ \  __/ |_| | (_| | (_) | |  _  | |  | |/ ___ \  |
| | .__/|___/\___|\__,_|\__,_|\___/  |_| |_|_|  |_/_/   \_\ |
\ |_|                                                       /
 -----------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

The magic

 ____________________________________________________________________________________________
/                           _                 _                                              \
|  _ __  ___  ___ _   _  __| | ___      _    | |    __ _ _ __   __ _ _   _  __ _  __ _  ___  |
| | '_ \/ __|/ _ \ | | |/ _` |/ _ \   _| |_  | |   / _` | '_ \ / _` | | | |/ _` |/ _` |/ _ \ |
| | |_) \__ \  __/ |_| | (_| | (_) | |_   _| | |__| (_| | | | | (_| | |_| | (_| | (_| |  __/ |
| | .__/|___/\___|\__,_|\__,_|\___/    |_|   |_____\__,_|_| |_|\__, |\__,_|\__,_|\__, |\___| |
| |_|                                                          |___/             |___/       |
|      __    _____                 _ _       __     ____                      _              |
|  ____\ \  | ____|_ __ ___   __ _(_) |  ____\ \   / ___|___  _ __ ___  _ __ | |_ ___        |
| |_____\ \ |  _| | '_ ` _ \ / _` | | | |_____\ \ | |   / _ \| '_ ` _ \| '_ \| __/ _ \       |
| |_____/ / | |___| | | | | | (_| | | | |_____/ / | |__| (_) | | | | | | |_) | ||  __/       |
|      /_/  |_____|_| |_| |_|\__,_|_|_|      /_/   \____\___/|_| |_| |_| .__/ \__\___|       |
\                                                                      |_|                   /
 --------------------------------------------------------------------------------------------
        \    ,-^-.
         \   !oYo!
          \ /./=\.\______
               ##        )\/\
                ||-----w||
                ||      ||

Conclusion

Une fois le compte fermé plus d'attaques
Mise en place d'outils de mitigation
Laisser la police faire son travail serait plus constructif
uRPF ce serait pas mal amis opérateurs