Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/12/2019
04:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New DDoS Attacks Leverage TCP Amplification

Attackers over the past month have been using a rarely seen approach to disrupt services at large organizations in several countries.

Cybercriminals appear to have finally figured out a way to launch highly effective distributed denial-of-service (DDoS) attacks using TCP amplification — something most attackers have typically avoided under the assumption it cannot be done efficiently.

Security vendor Radware this week said its researchers over the past 30 days have observed multiple criminal campaigns involving the use of a new type of TCP reflection attack against large organizations. The victims of these massive attacks include European sports gambling website Eurobet, Korea Telecom, Turkish financial services company Garanti, and SK Broadband of South Korea.

The attacks not only impacted the intended targets but also the networks that were used to generate the DDoS flood, causing a ripple effect that impacted many businesses around the world. The method of TCP reflection being used in the campaigns has made the attacks particularly hard to mitigate, Radware noted.

"This attack is unique because it creates collateral damage," says Daniel Smith, head of security research with Radware's emergency response team. "The secondary victim in this attack is actually the first to see the attack traffic."

In DDoS attacks, threat actors use different methods to try and amplify the volume of attack traffic generated by a compromised system. The goal is to try and turn small queries and packets into much larger payloads that can then be used to flood a target network.

With TCP SYN-ACK reflection, attackers send a SYN packet — designed to appear like it originated from the target network's IP address — to a wide number of random or preselected IP addresses, or reflection services. The IP addresses respond to the spoofed SYN packet with a SYN-ACK packet that is sent to the target network. If the target network does not respond in the expected manner, the reflection IP will continue to retransmit the SYN-ACK packet in an attempt to establish a three-way handshake, Radware said.

The extent of amplification possible depends on the number of SYN-ACK retransmits the reflection service can perform. The more times the reflection IP sends the SYN-ACK requests to the target IP, the more the amplification.

Ripple Effect
Attackers have avoided TCP reflection because they have long believed the default setting for Linux systems is five retransmits, which is not enough to amplify traffic to the extent that UDP-based reflections can, Radware said. The reality, as demonstrated by an independent security researcher in 2014, is that many devices on the Internet can be manipulated to retransmit more than 5,000 SYN-ACK packets in 60 seconds, if needed.

Such attacks can overwhelm target networks and also cause other problems for victims, Smith says. In the latest campaigns involving TCP reflection attacks, the intended targets were also the victims of improper blacklisting, Smith says.

"The original spoofed SYN flood sent to the reflectors misrepresented the victims IP range," he notes. "As a result of the spoofed SYN flood on the reflectors network, operators moved to blacklist networks that were misrepresented." Some network administrators, for instance, blacklisted networks like Eurobet not just because of the spoofed SYN flood from the attacker, but also the return flood of TCP RST and ICMP packets from Eurobet, Smith said.

Since the attack was spoofed, blacklisting the victim's network only helps to further accomplish the attacker's goals he notes. 

Because of how TCP reflection attacks work, the networks that were used as reflection services also experienced network congestion and service degradation. Many companies that were unaware of their networks being used as TCP reflectors were left wondering why they were being flooded with SYN traffic, Radware said.

From a mitigation standpoint, the most challenging aspect to dealing with a TCP reflection attack is preventing network exhaustion, Smith says.

"These attacks produce high volumes of packets per second, requiring a large amount of resource from network devices to process the traffic," he notes. "If resources become exhausted, networks will fail resulting in an outage."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: "Account Fraud Harder to Detect as Criminals Move from Bots to 'Sweat Shops'."

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
Pen Testers Who Got Arrested Doing Their Jobs Tell All
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/5/2020
New 'Nanodegree' Program Provides Hands-On Cybersecurity Training
Nicole Ferraro, Contributing Writer,  8/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15058
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.
CVE-2020-15059
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to bypass authentication via a web-administration request that lacks a password parameter.
CVE-2020-15060
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.
CVE-2020-15061
PUBLISHED: 2020-08-07
Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to denial-of-service the device via long input values.
CVE-2020-15062
PUBLISHED: 2020-08-07
DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to elevate privileges because the administrative password can be discovered by sniffing unencrypted UDP traffic.