Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Infrastructure

New Types of Reflection DDoS Attacks Spotted

A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types of reflection distributed denial-of-service (DDoS) attacks observed in recent months.

A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types of reflection distributed denial-of-service (DDoS) attacks observed in recent months.

There are well over a dozen UDP protocols that can be abused for the reflection and amplification of DDoS attacks, including DNS, NTP, SSDP, BitTorrent, RIPv1, mDNS, CharGEN, QOTD, NetBIOS, and Portmap. While some of these services have been abused for a long time, others are not as popular among attackers.

According to Akamai, attackers have recently started abusing the RPC portmap service, NetBIOS name servers, and Sentinel licensing servers.

The content delivery network (CDN) service provider reported spotting attacks leveraging NetBIOS, a service used by applications on separate computers to communicate over a LAN, sporadically between March and July 2015. In the attacks observed by the company, the attackers obtained amplification rates ranging between 2.56 and 3.85. Of the four attacks seen by Akamai, the largest peaked at 15.7 Gbps.

Another uncommon type of reflection attack spotted over the past period by the CDN company abused RPC Portmap (Portmapper), an Open Network Computing Remote Procedure Call (ONC RPC) service designed to map RPC service numbers to network port numbers.

These types of attacks are much more powerful than the ones leveraging NetBIOS, with the largest attack exceeding 100 Gbps. While the most common amplification factor observed by Akamai was approximately 10, experts noticed one instance where the traffic sent to the targeted server was multiplied more than 50 times.

Akamai said it had observed such attacks almost every day in September. In August, when the company noticed the first RPC Portmap reflection attacks, telecoms firm Level 3 Communications also warned organizations about such threats.

Another type of attack abuses Sentinel license servers, which are used to enforce and manage licensing in multi-user environments. The first such attack was observed by Akamai in June 2015 and it leveraged a vulnerable Sentinel server used by Stockholm University in Sweden. In September, Akamai mitigated a couple of Sentinel reflection DDoS attacks aimed at a gaming company and a financial firm, with a peak bandwidth of 11.7 Gbps detected for one of these attacks. DDoS protection company Nexusguard also warned about such attacks last month.

Advertisement. Scroll to continue reading.

While the amplification factor for such attacks can exceed 40, attackers are limited by the fact that there aren’t many Sentinel servers that can be abused. Only 745 unique sources of attack traffic have been identified, Akamai said in its report

“Although reflection DDoS attacks are common, these three attack vectors abuse different services than we’ve seen before, and as such they demonstrate that attackers are probing the Internet relentlessly to discover new resources to leverage,” said Stuart Scholly, senior vice president and general manager at Akamai’s Security Business Unit. “It looks like no UDP service is safe from abuse by DDoS attackers, so server admins need to shut down unnecessary services or protect them from malicious reflection. The sheer volume of UDP services open to the Internet for reflection DDoS attacks is staggering.”

Earlier this week, Symantec warned that attackers had started abusing MySQL servers infected with a piece of malware dubbed “Chikdos” for DDoS attacks.

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...

Security Infrastructure

Security vendor consolidation is picking up steam with good reason. Everyone wants to improve security efficiency and effectiveness while paying for less.

Management & Strategy

Hundreds of companies are showcasing their products and services this week at the 2023 edition of the RSA Conference in San Francisco.

Cloud Security

The term ‘zero trust’ is now used so much and so widely that it has almost lost its meaning.

Security Infrastructure

Instead of deploying new point products, CISOs should consider sourcing technologies from vendors that develop products designed to work together as part of a...

Security Infrastructure

Comcast jumps into the enterprise cybersecurity business, betting that its internal security tools and inventions can find traction in an expanding marketplace.

Audits

The PCI Security Standards Council (SSC), the organization that oversees the Payment Card Industry Data Security Standard (PCI DSS), this week announced the release...

Security Infrastructure

XDR's fully loaded value to threat detection, investigation and response will only be realized when it is viewed as an architecture