DDoS attacks using SNMP amplification on the rise

[Nytro]

[h=1]DDoS attacks using SNMP amplification on the rise[/h]

[h=2]After using open DNS and NTP servers for DDoS amplification, attackers are also abusing the SNMP protocol[/h]

By Lucian Constantin, IDG News Service

May 23, 2014 02:21 PM ET

IDG News Service - Attackers are increasingly abusing devices configured to publicly respond to SNMP (Simple Network Management Protocol) requests over the Internet to amplify distributed denial-of-service attacks.

This amplification technique, which is also known as reflection, can theoretically work with any protocol that is vulnerable to IP (Internet Protocol) address spoofing and can generate large responses to significantly smaller queries. Attackers can craft requests that appear to originate from the IP address of their intended victim in order to trick servers that accept requests over such protocols from the Internet to flood the victim with data.

Many DDoS attacks in the past year have used misconfigured DNS (Domain Name System) and NTP (Network Time Protocol) servers for amplification. However, devices that support SNMP, a protocol designed to allow the monitoring of network-attached devices by querying information about their configuration, can also be abused if the SNMP service is directly exposed to the Internet. SNMP-enabled devices with such configurations can be found both in home and business environments and include printers, switches, firewalls and routers.

Since April 11, the Prolexic Security Engineering Response Team (PLXsert), which is now part of Akamai Technologies, has identified 14 separate DDoS campaigns that used SNMP reflection.

Almost half of the malicious SNMP reflected traffic came from IP addresses in the U.S. and 18 percent from China, PLXsert said in a threat advisory published Thursday. "The attacks targeted clients in the following industry verticals: consumer goods, gaming, hosting, non-profits and software-as-a-service (SaaS)."

One of the tools used to launch the recent attacks was created in 2011 by a hacker group called Team Poison and can send spoofed SNMP GetBulk requests to publicly accessible SNMP-enabled devices to trigger responses that can be more than 1,700 times larger than the requests, the Prolexic team said.

The attackers crafted their requests to have a source port of 80 -- usually assigned to HTTP -- so that vulnerable devices return their SNMP responses to the victims on the same port, flooding their HTTP services.

"Until approximately three years ago, SNMP devices were manufactured using SNMP version 2 and were commonly delivered with the SNMP protocol openly accessible to the public by default," PLXsert said. "Devices using SNMP v3 are more secure. To stop these older devices from participating in attacks, network administrators need to check for the presence of this protocol and turn off public access."

Information over SNMP is controlled by a so-called community string, which in the case of SNMP v2c is "public" by default, PLXsert said.

SNMP amplification attacks are not really new, said Sean Power, security operations manager at DDoS protection vendor DOSarrest Internet Security, Friday via email. "Legitimate SNMP traffic has no need to leave your network and should be prevented from doing so. This attack exists because many organizations fail to prevent this."

Sursa: DDoS attacks using SNMP amplification on the rise - Network World

[aelius]

Interesanta chestia.

Deci vine cam asa:

- Atacatorul vrea sa dea ddos la 172.16.0.22 port 80 (unde ruleaza un server web)

- Face un tool cu ajutorul caruia altereaza pachetele (raw) si le trimite catre servere SNMP ca cereri (spoofed, sa apara ca fiind de la 172.16.0.22 src port 80)

- Serverele cu SNMP vor da raspuns catre 172.16.0.22 port 80 si se va produce aglomerare (socket exhaustion, probabil si utilizare mare de banda)

Chestia e ca nu sunt atat de multe echipamente sau servere cu SNMP deschis catre public. Acesta este de regula restrictionat pe subnet.

Parerea mea e ca si companiile astea fac valva mare prin comunicate de presa pentru a determina oamenii sa le cumpere serviciile.

In plus, nu vad de ce nu server http nu ar returna 403 unui request ce nu face parte din http req methods.

Edited May 25, 2014 by aelius

[Elohim]

Interesanta chestia.

Deci vine cam asa:

- Atacatorul vrea sa dea ddos la 172.16.0.22 port 80 (unde ruleaza un server web)

- Face un tool cu ajutorul caruia altereaza pachetele (raw) si le trimite catre servere SNMP ca cereri (spoofed, sa apara ca fiind de la 172.16.0.22 src port 80)

- Serverele cu SNMP vor da raspuns catre 172.16.0.22 port 80 si se va produce aglomerare (socket exhaustion, probabil si utilizare mare de banda)

Chestia e ca nu sunt atat de multe echipamente sau servere cu SNMP deschis catre public. Acesta este de regula restrictionat pe subnet.

Parerea mea e ca si companiile astea fac valva mare prin comunicate de presa pentru a determina oamenii sa le cumpere serviciile.

Eu zic ca din tot 0.0.0.0/0 tot se gasesc cateva sute de k pt un ddos sanatos