Amplification Hell: Revisiting Network Protocols for DDoS Abuse

Abstract

In distributed reflective denial-of-service (DRDoS) attacks, adversaries send requests to public servers (e.g., open recursive DNS resolvers) and spoof the IP address of a victim. These servers, in turn, flood the victim with valid responses and-unknowingly-exhaust its bandwidth. Recently, attackers launched DRDoS attacks with hundreds of Gb/s bandwidth of this kind. While the attack technique is well-known for a few protocols such as DNS, it is unclear if further protocols are vulnerable to similar or worse attacks. In this paper, we revisit popular UDP-based protocols of network services, online games, P2P filesharing networks and P2P botnets to assess their security against DRDoS abuse. We find that 14 protocols are susceptible to bandwidth amplification and multiply the traffic up to a factor 4670. In the worst case, attackers thus need only 0.02% of the bandwidth that they want their victim(s) to receive, enabling far more dangerous attacks than what is known today. Worse, we identify millions of public hosts that can be abused as amplifiers. We then analyze more than 130 real-world DRDoS attacks. For this, we announce bait services to monitor their abuse and analyze darknet as well as network traffic from large ISPs. We use traffic analysis to detect both, victims and amplifiers, showing that attackers already started to abuse vulnerable protocols other than DNS. Lastly, we evaluate countermeasures against DRDoS attacks, such as preventing spoofing or hardening protocols and service configurations. We shows that carefully-crafted DRDoS attacks may evade poorly-designed rate limiting solutions. In addition, we show that some attacks evade packet-based filtering techniques, such as port-, content-or length-based filters. Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author's employer if the paper was prepared within the scope of employment.

CDN-on-Demand: An Affordable DDoS Defense via Untrusted Clouds

“…It efficiently blocks non-spoofed bandwidth DoS attack packets, sent directly to the victim, as illustrated by Attacker 1 in Figure 8. In practice, non-spoofed attack packets are widely used in BW-DoS attacks, as they are easier to generate by attackers, since they can be sent by benign reflectors [29], [35], and clients running unprivileged malware and/or behind NATs or ingress-filtering routers.…”

An Evaluation of Darknet Traffic Taxonomy

“…Scan and backscatter analysis and detection were covered in Refs. [5], [21], [28]. Continuous efforts have been made to tackle Conficker throughout the years [13], [26], [27].…”

HTTP/2 Tsunami: Investigating HTTP/2 proxy amplification DDoS attacks

“…RELATED WORK C Rossow et al [7] analysed UDP amplification attacks to expose the risk of existing vulnerabilities with network protocols. Bait servers were deployed and back scatter analysis was performed to provide insight into their current usage.…”