UDP hole punching – p2p communication across NAT (2005) (►http://www...
▻https://diasp.eu/p/5919677
UDP hole punching – p2p communication across NAT (2005)
Hacker News Comments: ▻https://news.ycombinator.com/item?id=15037058
-
-
Necurs += DDoS
World’s largest spam botnet (5 million bots) adds proxy module with DDoS features, but will it really be used that way?▻http://blog.anubisnetworks.com/blog/necurs-proxy-module-with-ddos-features
Necurs is a malware that is mainly known for sending large spam campaigns, most notably the Locky ransomware. However, Recurs is not only a spambot, it is a modular piece of malware that is composed of a main bot module, a userland rootkit and it can dynamically load additional modules.
[...]
At first look, it seemed to be a simple SOCKS/HTTP proxy module, but as we looked at the commands the bot would accept from the C2 [port 5222] we realised that there was an additional command, that would cause the bot to start making HTTP or UDP requests to an arbitrary target in an endless loop, in a way that could only be explained as a DDOS attack.
[...]
Please notice that we have not seen Recurs being used for DDOS attacks, we simply saw that it has that capability in one of the modules that it has been loading
The rest of their post contains the results of a technical analysis of this module, detailing its C2 protocol, the SOCKS/HTTP proxy features, and the DDOS attack features.
-
▻https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-adds-ddos-feature
The sheer size of the Necurs botnet, even in its worst days, dwarfs all of today’s IoT botnets. The largest IoT botnet ever observed was Mirai Botnet #14 that managed to rack up around 400,000 bots towards the end of 2016.
[...]
“The proxy/DDoS module is quite old,” said MalwareTech, a security researcher that has tracked Necurs’ evolution for years. “I imagine it was put in as a potential revenue stream but then they found there was more money in spam.”
Outside a higher revenue stream the Necurs gang stands to earn from spam, we must also take into consideration other reasons why it’s highly unlikely that we’re going to see DDoS attacks from Necurs.
[...]
Recurs’ authors have invested time and money into developing a professional, well-oiled cyber-crime machine. There is no reason to risk their steady revenue stream just for the sake of running a DDoS-for-hire service from which they have only to lose.
Mathematically, it makes no sense to destroy three revenue streams (Dridex, Locky, and rentable spamming service) just for the sake of creating and supporting a DDoS booter service.
-
-
Les serveurs mail de Microsoft n’acceptent pas d’emails envoyés par de nouveaux serveurs.
►https://mail.live.com/mail/troubleshooting.aspx#errors
Il ne suffit plus de configurer correctement son serveur mail, il faut en plus l’inscrire chez MS.Senden Sie E-Mails über eine neue IP-Adresse?
IP-Adressen, die bisher noch nicht für das Senden von E-Mails verwendet wurden, verfügen in unserem System noch über keinerlei Eintragungen zur Zuverlässigkeit. Daher können bei E-Mails, die von neuen IP-Adressen gesendet werden, mit höherer Wahrscheinlichkeit Zustellbarkeitsprobleme auftreten. Nachdem sich die IP-Adresse durch das Nichtversenden von Spam als zuverlässig erwiesen hat, wird in Outlook.com in der Regel eine bessere Zustellbarkeit für E-Mails erreicht.
Neue IP-Adressen, die für Domänen hinzugefügt werden, die über vorhandene SPF-Einträge authentifiziert wurden, übernehmen in der Regel einen Teil der Sendezuverlässigkeit der Domäne. Wenn die Domäne über eine gute Sendezuverlässigkeit verfügt, ist für neue IP-Adressen möglicherweise eine schnellere Anlaufzeit festzustellen. Eine neue IP-Adresse wird spätestens nach einigen Wochen vollständig akzeptiert. Ausschlaggebend sind hierbei jeweils das Volumen und die Listengenauigkeit – vorausgesetzt, es liegen möglichst wenig Junk-E-Mail-Beschwerden vor.
Hinweis: Denken Sie daran, Ihr JMRP-Konto (Junk E-Mail Reporting Program, Junk-E-Mail-Meldeprogramm) mit den neuen IP-Adressen zu aktualisieren. Wenn Sie ein JMRP-Konto aktualisieren oder einrichten möchten, klicken Sie auf hierDienste für Absender und Internetdienstanbieter
▻https://mail.live.com/mail/services.aspx
Comme tout est payant chez MS ils conseillent de souscrire un abonnemenet chez un service de maintien de réputation. Pourtant on peut effectivement s’en passer sauf si on est en train de monter un service de mailings commerciaux.Return Path-Zertifizierung
Ein Akkreditierungs-/Reputationsdienst eines Drittanbieters mit dem Zweck, Absendern den Status eines sicheren Absenders zu verleihen
Weitere Informationen finden Sie unter ▻http://g.live.com/9wc9en-us/senderscoreWenn Hotmail Deine Mailserver abweist
▻https://www.hagen-bauer.de/2015/10/hotmail-block.html
Comment j’ai appris cette « nouvelle » ? Notre fournisseur de serveurs héberge des serveurs piratés et MS a mis sur ses blocklists de réseaux IP entiers.In unsere “Nachbarschaft” bei Hetzner gab es wohl einige SPAM Schleudern so das Hotmail ganze Netzsegmente auf eine “schwarze Liste” gestellt hat. Unsere Server selbst ist sauber.
Nach etwas Suchen bin ich auf diese Seite gestoßen. Hier kann man beantragen das eine IP Adresse wieder freigeschaltet wird.
La solution
▻https://support.microsoft.com/en-us/getsupport?oaspworkflow=start_1.0.0.0&wfname=capsub&productkey=ed
Il faut demander gentiment qu’ils vérifient un peu, et hop, quelques heures plus tard ca roule. MS réagit nettement plus vite et mieux que Google.Après (enfin, de préférance préalablement) il faut toujours installer les protocoles de vérification qui améliorent la fiabilité de la communication avec les grands fournisseurs de services email.
RFC 7208 - Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1
▻https://tools.ietf.org/html/rfc7208#page-23SPF : FAQ/Examples
▻http://www.openspf.org/FAQ/ExamplesUbuntu+ISPConfig+DKIM | Howtoforge - Linux Howtos and Tutorials
►https://www.howtoforge.com/community/threads/ubuntu-ispconfig-dkim.72473DKIM-Patch 1.1.9
▻https://blog.schaal-24.de/ispconfig/dkim-patch-1-1-9How Senders Deploy DMARC in 5-Easy Steps
▻https://dmarc.org/overview
Cette liste décrit les étapes essentielles pour transformer un serveur mail traditionnel en machine acceptée par la majorité de ses interlocutrices. Il ne faut jamais oublier que ce sont des conventions qui évoluent et ne sont pas parfaites du tout.DMARC has been designed based on real-world experience by some of the world’s largest email senders and receivers deploying SPF and DKIM. The specification takes into account the fact that it is nearly impossible for an organization to flip a switch to production. There are a number of built-in methods for “throttling” the DMARC processing so that all parties can ease into full deployment over time.
1. Deploy DKIM & SPF. You have to cover the basics, first.
2. Ensure that your mailers are correctly aligning the appropriate identifiers.
3. Publish a DMARC record with the “none” flag set for the policies, which requests data reports.
4. Analyze the data and modify your mail streams as appropriate.
5. Modify your DMARC policy flags from “none” to “quarantine” to “reject” as you gain experience.dmarcian - SPF Surveyor
►https://dmarcian.com/spf-survey/rezo.net
Pour finir on peut vérifier si on a tout fait dans les normes.rezo.net
Warning present!
A DMARC record was detected while looking for an SPF record. DMARC records must be located at “_dmarc.rezo.net”, and not directly at “rezo.net”.Record analysis:
DNS-querying mechanisms/modifiers:The SPF record authorizes 8 individual netblocks using 3 DNS-querying mechanisms/modifiers. The maximum number of DNS-querying mechanisms/modifiers is 10.
This record utilizes a small number of DNS-querying mechanisms/modifiers. No fixing is required. If this record is meant to be included by other records, consider reducing the number of DNS-querying mechanisms/modifiers (if possible) to keep total resource consumption low.
Duplicate netblock authorization:
The following netblocks have been authorized more than once. Duplicates usually indicate inefficient records or redundant “include:” mechanisms, and should be removed:
netblock # of occurrences
193.56.58.14/32 2Record flattening (experimental!):
The dmarcian SPF Record Flattener (experimental!) rewrites this record by removing duplicate netblocks, collapsing any overlapping netblocks, and using 0 DNS-querying mechanisms/modifiers. Each SPF record is kept to less than 512 bytes to fit into a single UDP packet (assuming no other TXT records are sharing the DNS label).
NOTE: this approach does not take into account administrative or domain boundaries, and is meant to show that “minified” SPF records are possible. The presence of unusual qualifiers, macros, and creative semantics will likely yield less than optimal results.
domain record
rezo.net v=spf1 ip4:91.194.60.0/23 ip4:185.34.32.0/22 ip4:193.56.58.0/24 ip6:2001:67c:288::/48 ip6:2a00:99a0::/128 ~all-
@fil C’est grave docteur ?
Warning present!
A DMARC record was detected while looking for an SPF record. DMARC records must be located at “_dmarc.rezo.net”, and not directly at “rezo.net”. -
-
@fil ►https://dmarcian.com/spf-survey/rezo.net :-)
Enfin, c’est sans doute comme avec validator.w3.org C’est beau d’être parfait, mais on a souvent une bonne raison pour garder son code moche qui fonctionne.
-
-
NewWorldHackers & Anonymous are behind the massive DDoS attack against Dyn DNS service, using the Mirai bonnet and other booters
▻http://securityaffairs.co/wordpress/52583/hacking/dyn-dns-service-ddos-3.html
When I asked which Anon groups were involved they replied me that many crews targeted the Dyn DNS service.
“Anonymous, Pretty much all of Anonymous” sais NewWorldHackers.
They confirmed me that they are testing the capability of their botnet, highlighting that the DDoS attack against the Dyn DNS Service was carried with the Mirai botnet alongside with other booters.#DDoS #botnet #Mirai
#NewWorldHackers #Anonymous
#Dyn #DNS
#IoT-
Statement by Dyn
▻http://hub.dyn.com/static/hub.dyn.com/dyn-blog/dyn-statement-on-10-21-2016-ddos-attack.html
We can confirm, with the help of analysis from Flashpoint and Akamai, that one source of the traffic for the attacks were devices infected by the Mirai bonnet. We observed 10s of millions of discrete IP addresses associated with the Mirai botnet that were part of the attack.
-
Krebs’s view on this
▻https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage
“The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present.
-
Rumours about extorsion
▻http://www.networkworld.com/article/3133751/security/extensive-ddos-attack-against-dyn-restarts-could-indicate-a-new-use-of
Cunningham [director of cyber operations for A10 Networks] says he’s seen chatter on underground forums indicating that the attackers tried to extort Bitcoin from Dyn by threatening the attacks, and when the provider didn’t pay up, launched them. He says Dyn seems to be doing a pretty good job of mitigating the effects relatively quickly.
-
Lengthy and interesting article by #Level3 on Mirai, containing information on the C2s (command & control servers) and the structure of the botnet
By analyzing the communication patterns of the Mirai C2 IP addresses, we were able to identify and enumerate Mirai’s infrastructure. This analysis was later confirmed accurate when the Mirai source code was released.
-
The Mirai source code
-
Chinese firm admits its hacked DVRs, cameras were behind [Dyn DNS] massive DDOS attack
▻http://www.pcworld.com/article/3134039/hacking/chinese-firm-admits-its-hacked-products-were-behind-fridays-massive-ddos-at
Hangzhou Xiongmai Technology, a vendor behind DVRs and internet-connected cameras, said on Sunday that security vulnerabilities involving weak default passwords in its products were partly to blame.
-
DDos On Dyn Used Malicious TCP, UDP Traffic
▻http://www.darkreading.com/attacks-breaches/ddos-on-dyn-used-malicious-tcp-udp-traffic-/d/d-id/1327309
Scott Hilton, executive vice president of product for Dyn, in a blog post said the attackers employed masked TCP and UDP traffic via Port 53 in the attack as well as recursive DNS retry traffic, “further exacerbating its impact,” he said.
[...]
He noted that the DNS traffic sent in the DDoS attacks also generated legitimate DDoS retry traffic, making the attack more complicated to parse, and the attack generated ten- to 20 times the normal DNS traffic levels thanks to malicious and legit retries.
“During a DDoS which uses the DNS protocol it can be difficult to distinguish legitimate traffic from attack traffic,” he said in the post. “When DNS traffic congestion occurs, legitimate retries can further contribute to traffic volume. We saw both attack and legitimate traffic coming from millions of IPs across all geographies.”
-
-
More on Mirai, and more than Mirai
▻http://www.securityweek.com/mirai-iot-botnet-not-only-contributor-massive-ddos-attack-akamai
Akamai says Mirai was not alone:
While Akamai confirmed that the Mirai botnet was part the attack, the company also said that Mirai was only “a major participant in the attack” and that at least one other botnet might have been involved, though they couldn’t confirm that the attacks were coordinated.
Akamai refers to Mirai as Kaiten and has it documented here:
▻https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/kaiten-std-router-ddos-malware-threat-advisory.pdfMore on the released source code of Mirai which confirms the use of GRE flooding, one of the techniques used on top of DNS Water Torture:
▻http://www.securityweek.com/hacker-releases-source-code-iot-malware-mirai
A copy of the source code files provided to SecurityWeek includes a “read” where the author of Mirai explains his reasons for leaking the code and provides detailed instructions on how to set up a botnet.
[...]
Mirai, believed to have made rounds since May 2016, infects IoT devices protected by weak or default credentials. Once it hijacks a device, the threat abuses it to launch various types of DDoS attacks, including less common UDP floods via Generic Routing Encapsulation (GRE) traffic.
This was proven through reverse-engineering by
▻http://cyberx-labs.com/en/blog/cyberx-reveals-gre-evidence-krebs-iot-based-attack-largest-ddos-interneIt is still GRE is still an uncommon attack vector, but it was already used during the 2016 Rio games
▻http://www.tripwire.com/state-of-security/security-data-protection/cyber-security/how-a-massive-540-gbsec-ddos-attack-failed-to-spoil-the-rio-olympicsFor some French, see also here:
▻https://seenthis.net/messages/530903#Mirai #Kaiten
#Akamai
#DDoS
#Brian_Krebs
#OVH
#GRE
#DNS_Water_Torture-
What cameras, IoT and DVR devices are taking part of Mirai ?
from Krebs:
▻https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack
-
▻http://www.forbes.com/sites/thomasbrewster/2016/10/07/chinese-firm-xm-blamed-for-epic-ddos-attacks/#5b59fcd33bf5
But one researcher, Flashpoint’s Zachary Wikholm, today claimed to have found a single Chinese firm, Hangzhou XiongMai Technologies (XM), that shipped flawed code allowing the perpetrators to potentially amass nearly half a million bots for their malicious network.
-
Interesting article by F5 which goes in a bit more detail about the two types of GRE flood attacks (Ethernet and IP based)
▻https://f5.com/about-us/news/articles/mirai-the-iot-bot-that-took-down-krebs-and-launched-a-tbps-ddos-attack-on-ovh-21
They also make a reference to the origin of the Mirai name:
It seems that the bot creator named his creation after a Japanese series “Mirai Nikki (The Future Diary)” and uses the nickname of “Anna-senpai” referring to the “Shimoneta” series.
▻https://f5.com/Portals/1/Images/News/blogs/mirai-inspiration.JPG
-
Default password for most popular devices.
www.phenoelit.org/dpl/dpl.htmladmin 123456
admin password
Cisco Cisco
login password
root password
…
Le plus drole :
Administrator changeme -
Here are the 61 passwords that powered the Mirai IoT botnet
▻http://www.csoonline.com/article/3126924/security/here-are-the-61-passwords-that-powered-the-mirai-iot-botnet.html -
Some more information on its spread, operations, and code, by Incapsulate.
▻https://www.incapsula.com/blog/malware-analysis-mirai-ddos-botnet.html
One of the most interesting things revealed by the code was a hardcoded list of IPs Mirai bots are programmed to avoid when performing their IP scans.
This list is interesting, as it offers a glimpse into the psyche of the code’s authors. On the one hand, it exposes concerns of drawing attention to their activities. A concern we find ironic, considering that this malware was eventually used in one of the most high-profile attacks to date.
-
US CERT Threat Alert : Heightened DDoS Threat Posed by Mirai and Other Botnets
▻https://www.us-cert.gov/ncas/alerts/TA16-288A -
-
▻http://www.securityweek.com/whats-fix-iot-ddos-attacks
HTTP GET floods were already pernicious. For years, attackers have been able to disable web sites by sending a flood of HTTP requests for large objects or slow database queries. Typically, these requests flow right through a standard firewall because hey, they look just like normal HTTP requests to most devices with hardware packet processing. The Mirai attack code takes it a step further by fingerprinting cloud-based DDoS scrubbers and then working around some of their HTTP DDoS mitigation techniques (such as redirection).
-
Mirai botnet leverages #STOMP Protocol to power DDoS attacks.
▻http://securityaffairs.co/wordpress/53544/malware/mirai-botnet-stomp.html
STOMP is a simple application layer, text-based protocol [an alternative to other open messaging protocols, such as AMQP (Advanced Message Queuing Protocol] that allows clients communicate with other message brokers. It implements a communication method among for applications developed using different programming languages.
[...]
Below the steps of the DDoS STOMP attack:
• A botnet device uses STOMP to open an authenticated TCP handshake with a targeted application.
• Once authenticated, junk data disguised as a STOMP TCP request is sent to the target.
• The flood of fake STOMP requests leads to network saturation.
• If the target is programmed to parse STOMP requests, the attack may also exhaust server resources. Even if the system drops the junk packets, resources are still used to determine if the message is corrupted.
How Mirai Uses STOMP Protocol to Launch DDoS Attacks
▻https://www.incapsula.com/blog/mirai-stomp-protocol-ddos.html
-
Mirai botnet with 400.000 devices now for rent
▻http://www.ibtimes.co.uk/ddos-hire-service-now-advertising-renting-out-400000-bot-strong-mirai-bot
A DDoS-for-hire service, run by two hackers going by the pseudonyms Popopret and BestBuy, is now reportedly advertising a Mirai botnet up for rent. The Mirai botnet allegedly comprises of over 400,000 infected bots and may have been sired from the original Mirai source code.
[...]
renting the botnet does not come cheap. Customers desiring to rent the botnet must do so for a minimum of two weeks. However, clients can determine the amount of bots, the attack duration and the DDoS cool down (a term which refers to the length of time between consecutive attacks).
[...]
Popapret and BestBuy’s Mirai botnet is a more evolved version of the original botnet. The two hackers have added new features, such as brute-force attacks via SSH and support for exploiting zero-day vulnerabilities. According to two security researchers, going by handle 2sec4u and MalwareTech on Twitter, some of the newly created Mirai botnets can now carry out DDoS attacks by spoofing IP addresses and may also be capable of bypassing DDoS mitigation systems.
Source:
▻http://www.bleepingcomputer.com/news/security/you-can-now-rent-a-mirai-botnet-of-400-000-bots -
Understanding the Mirai Botnet
▻https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf
In this paper, we provide a seven-month retrospective analysis
of Mirai’s growth to a peak of 600k infections and a history of its DDoS victims. By combining a variety of measurement perspectives, we analyse how the botnet emerged, what classes of devices were affected, and how Mirai variants evolved and competed for vulnerable hosts. Our measurements serve as a lens into the fragile ecosystem of IoT devices. We argue that Mirai may represent a sea change in the evolutionary development of bonnets—the simplicity through which devices were infected and its precipitous growth, demonstrate that novice malicious techniques can compromise enough low-end
devices to threaten even some of the best-defended targets.
To address this risk, we recommend technical and nontechnical
interventions, as well as propose future research directions.#DDoS
-
-
New ransomware variant integrates DDoS attack capabilities
▻https://www.invincea.com/2016/05/two-attacks-for-the-price-of-one-weaponized-document-delivers-ransomware-aWe recently found a ransomware variant that not only holds the victim’s machine and data hostage [by file encryption and screen locking] until a ransom is paid, but also exploits the compromised machine as part of a potential DDOS attack. This means that while the victim is unable to access their endpoint, that same endpoint is being used to deny service to another victim.
The observed network traffic looks to be flooding the subnet with UDP packets over port 6892. By spoofing the source address, the host could direct all response traffic from the subnet to a targeted host, causing the host to be unresponsive.
The ransomware is based on a modified version of the Cerber strain, which executes malicious MS Office VBScript.
-
On a beaucoup parlé des attaques #DoS par réflexion + amplification en les présentant souvent comme spécifiques à #UDP. Mais un article récent (mais passé curieusement inaperçu) montre qu’on peut en faire également avec #TCP.
-
TCP Handshake Amplification
DDoS amplification attacks currently typically use UDP-based protocols with spoofed source IPs. The reason being that there is no 3-way handshake in UDP.
However, it turns out there are TCP-based protocols are also vulnerable to amplification attacks. Better even, the handshake itself can be abused for amplification.
Authors of the 2014 research mentioned in Stéphane’s article (and below) have identified 4.8 million devices vulnerable to an average TCP-based amplification factor of 112x. Of those, they identified thousands of hosts that can be abused for an amplification of almost 80.000x.
They identified that there are hosts responding to a SYN with an excessive amount of RST packets, and others that transmit actual payload data via PSH packets – even before the three-way handshake has been completed.
From the point of view of an attacker, the number of amplifiers is important to scale up the overall attack bandwidth.
Compared to UDP-based amplification attacks, the fact that there are much more amplifiers makes this form still the most attractive.
An attacker has to scan many more IPv4 hosts in order to find a large enough number of TCP-based amplifiers.Why would TCP-based amplifiers be interesting?
• They could be interesting to attackers who have little bandwidth available and who want to amplify as much as possible.
• Also, TCP traffic is considerably harder to filter at the network edges than UDP-based protocols. It is not easy to make a difference between legitimate and malicious TCP traffic without appliances that keep trace of and inspect the states of TCP connections.
• Another reason why TCP-based is more complicated is that TCP-based amplification traffic does not carry payload that can be inspected for validity.The paper:
Hell of a Handshake: Abusing TCP for Reflective Amplification DDoS Attacks
(Marc Kuhrer, Thomas Hupperich, Christian Rossow, Thorsten Holz)▻http://www.christian-rossow.de/publications/tcpamplification-woot2014.pdf
SYN/ACK: The majority of amplifiers cause amplification by repeatedly retransmitting SYN/ACK packets upon our SYN segments. This attack type amplifies traffic up to 80x on average, and for SIP even up to 1,596x.
PSH: The number of amplifiers that transmit payload data via PSH (without a completed handshake) is low for most protocols. Nevertheless, the amplification factor is higher compared to the SYN/ACK amplifiers.
RST: The by far highest amplification is observed for hosts that transmit a tremendous number of RST segments. As such, an attacker could abuse the 4,242 vulnerable Telnet hosts to achieve an average amplification rate of 79,625x. Compared to SYN/ACK, the RST amplifiers of most protocols also have a much higher traf- fic volume—even though the number of hosts is significantly lower. That is, the 8,863 SYN/ACK amplifiers of NetBIOS transmitted about 25 MB of traffic, while the RST amplifiers caused traffic of more than 12 GB. Similarly, even though we observed most of the FTP ampli- fiers sending SYN/ACK packets (causing a total of 3.2 GB of traffic), the RST amplifiers transferred 15.1 GB of traf- fic in the same amount of time, a multitude of factor 5x.
#DDoS
-
-
A New DDoS Reflection Attack: Portmapper (TCP/UDP 111)
Portmapper is a mechanism to which Remote Procedure Call (RPC) services register in order to allow for calls to be made to the Internet.
When a client is looking to find the appropriate service, the Portmapper is queried to assist. The response size varies wildly depending on which RPC services are operating on the host.▻http://blog.level3.com/security/a-new-ddos-reflection-attack-portmapper-an-early-warning-to-the-industr
It already has been used in a number of attacks, with the largest impact to organizations taking place August 10 through 12. These attacks targeted only a subset of verticals, primarily focused on gaming, hosting and Internet infrastructure
[...]
On the high end of the spectrum, we have seen responses as large as 1930 bytes for an amplification of 28.4x.
[...]
We recommend disabling Portmapper along with NFS, NIS and all other RPC services across the open Internet as a primary option. In situations where the services must remain live, firewalling which IP addresses can reach said services and, subsequently, switching to TCP-only are mitigations to avoid becoming an unknowing participant in DDoS attacks in the future.
-
Torrent clients and BitTorrent Sync can be leveraged for DrDoS attacks
▻https://www.usenix.org/conference/woot15/workshop-program/presentation/p2p-file-sharing-hell-exploiting-bittorrent
In this paper, we demonstrate that the BitTorrent protocol family is vulnerable to distributed reflective denial-of-service (DRDoS) attacks. Specifically, we show that an attacker can exploit BitTorrent protocols (Micro Transport Protocol (uTP), Distributed Hash Table (DHT), Message Stream Encryption (MSE))and BitTorrent Sync (BTSync) to reflect and amplify traffic from peers.
We validate the efficiency, robustness and evadability of the exposed BitTorrent vulnerabilities in a P2P lab testbed. We further substantiate the lab results by crawling more than 2.1 million IP addresses over Mainline DHT (MLDHT) and analyzing more than 10,000 BitTorrent handshakes. Our experiments reveal that an attacker is able to exploit BitTorrent peers to amplify the traffic up to a factor of 50 times and in case of BTSync up to 120 times.
Additionally, we observe that the most popular BitTorrent clients are the most vulnerable ones. (uTorrent, Mainline Vuze)
[...]
We showed that anattack is quite difficult to circumvent, as the found vulnerabilities can only be defended with a DPI firewall. In case of a MSE handshake, it is even harder to detect the attack, since the packet contains a high entropy payload with a public key and random data.
The paper:
▻https://www.usenix.org/system/files/conference/woot15/woot15-paper-adamsky.pdf
▻https://torrentfreak.com/bittorrent-can-be-exploited-for-dos-attacks-research-warns
BitTorrent Inc has been notified about the vulnerabilities and patched some in a recent beta release. For now, however, uTorrent is still vulnerable to a DHT attack. Vuze was contacted as well but has yet to release an update according to the researcher.
Arstechnica also wrote about it:
▻http://arstechnica.com/security/2015/08/how-bittorrent-could-let-lone-ddos-attackers-bring-down-big-sites
En Français :
▻http://actualite.housseniawriting.com/technologie/2015/08/16/les-attaques-drdos-peuvent-se-propager-via-les-clients-bittorrent/7227
-
-
#NIST: UDP-Based Amplification Attacks
-
-
New DRDoS (Distributed Reflection Denial-of-Service) based on NTP, similar to the previous DNS open resolver based DDoS in 2013
The mechanism is to spoof UDP port 123 packets with a REQ_MON_GETLIST request, which will return the last 600 clients with NTP requests and hence the significant BAF - Bandwidth Amplification Factor. NTP is reflection-vulnerable as it does not validate the source IP of the sender.
Affected are all versions of ntpd prior to 4.2.7p26;
this last version has disabled support for MON_GETLISTHow to test if you are vunerable ?
ntpq -c rv
ntpdc -c sysinfo
ntpdc -n -c monlistIf the last command returns nothing then you’re OK.
If it returns a whole list of hostnames and IP addresses, then you know what time it is…Solutions :
(1)
Download version 4.2.7p26 or later: ▻http://www.ntp.org/downloads.html
(2)
Disable queries: if update is not possible in your environment then a workaround is to disable status queries by adding to /etc/ntp.conf:
For IPv4 : restrict default kod nomodify notrap nopeer noquery
For IPv6: restrict -6 default kod nomodify notrap nopeer noquery
(restart ntpd after the change)
(3)
Allow status queries but disable “ntpdc –c monlist” via “disable monitor”Either approach is a good idea because
(a) you protect your network from unwanted reconnaissance, as monlist is included in network tools such as NMAP or metasploit
(b) you avoid participating in DRDoS attacks and probably also suffering from it.Official Security Reports :
NIST reference of the vulnerability
▻http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5211
CERT vulnerability notice
▻http://www.kb.cert.org/vuls/id/348126Other reports on this NTP DRDoS :
very good : "Understanding and mitigating NTP-based DDoS attacks" - ▻http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks"New DoS attacks taking down game sites deliver crippling 100Gbps floods" ▻http://arstechnica.com/security/2014/01/new-dos-attacks-taking-down-game-sites-deliver-crippling-100-gbps-flood
"Les attaques DDoS sur l’industrie du jeu mettent en lumière les faiblesses de sécurité du NTP" ▻http://www.pcworld.fr/jeux-video/actualites,attaques-ddos-steam-origin-league-leagends-planetside-guild-wars-
▻http://www.theregister.co.uk/2014/01/21/open_ntp_patching_project
Documentation :
"Hardening Cisco Routers - Chapter 10: NTP" - ▻http://oreilly.com/catalog/hardcisco/chapter/ch10.html"Network Time Protocol (NTP): Overview and Configuration" - ▻http://e2epi.internet2.edu/npw/a2/ntp.pdf
▻http://www.team-cymru.org/ReadingRoom/Templates/secure-ntp-template.html
How NTP works :
▻http://www.eecis.udel.edu/~mills/ntp/html/warp.html
▻http://www.ntp.orgNTP RFCs :
– "RFC 5905: Network Time Protocol Version 4: Protocol and Algorithms Specification" ▻http://www.ietf.org/rfc/rfc5905.txt– Ou la version Bortzmeyer, excellente dans son ample élaboration comme d’habitude : ►http://www.bortzmeyer.org/5905.html
– "RFC 5906: Network Time Protocol Version 4: Autokey Specification" ▻http://www.ietf.org/rfc/rfc5906.txt
– "RFC 5907: Definitions of Managed Objects for Network Time Protocol Version 4 (NTPv4)" ▻http://www.ietf.org/rfc/rfc5907.txt
– "RFC 5908: Network Time Protocol (NTP) Server Option for DHCPv6" ▻http://www.ietf.org/rfc/rfc5908.txt
#DRDoS
#DDoS
#BAF
#denial-of-service
#NTP
#reflection
#NMAP
#metasploit
#security
#vulnerability -
-
TCP traceroute is better than ICMP or UDP for finding the path to a TCP server: ’traceroute -T -p 80 youtube.com’ #CDN
-
Downloads of LOIC DoS Attack Tool Spike as Anonymous Inspires Online Protests | SecurityWeek.Com
As Anonymous initiated what it said will be the “largest attack ever on government and music industry sites” in response to actions taken by the Justice Department against operators of file sharing site Megaupload.com, downloads of a popular DoS attack tool have spiked.
Anonymous DDoS AttacksWhile the Denial of Service tool known as the “Low Orbit Ion Cannon” (LOIC) was developed by the “good guys” to stress test websites, it has been a favorite tool of Anonymous to take its targets offline by sending a flood of TCP/UDP packets in an attempt to overwhelm a system and make it inaccessible.
►http://www.securityweek.com/downloads-loic-dos-attack-tool-spike-anonymous-inspires-online-protest
