Sunday, November 1, 2015
A new threat advisory published this week by Akamai’s Security Intelligence Response Team warns organizations about three new types of reflection distributed denial-of-service (DDoS) attacks observed in recent months.
There are well over a dozen UDP protocols that can be abused for the reflection and amplification of DDoS attacks, including DNS, NTP, SSDP, BitTorrent, RIPv1, mDNS, CharGEN, QOTD, NetBIOS, and Portmap. While some of these services have been abused for a long time, others are not as popular among attackers.
According to Akamai, attackers have recently started abusing the RPC portmap service, NetBIOS name servers, and Sentinel licensing servers.
The content delivery network (CDN) service provider reported spotting attacks leveraging NetBIOS, a service used by applications on separate computers to communicate over a LAN, sporadically between March and July 2015. In the attacks observed by the company, the attackers obtained amplification rates ranging between 2.56 and 3.85. Of the four attacks seen by Akamai, the largest peaked at 15.7 Gbps.
Another uncommon type of reflection attack spotted over the past period by the CDN company abused RPC Portmap (Portmapper), an Open Network Computing Remote Procedure Call (ONC RPC) service designed to map RPC service numbers to network port numbers.
These types of attacks are much more powerful than the ones leveraging NetBIOS, with the largest attack exceeding 100 Gbps. While the most common amplification factor observed by Akamai was approximately 10, experts noticed one instance where the traffic sent to the targeted server was multiplied more than 50 times.
Akamai said it had observed such attacks almost every day in September. In August, when the company noticed the first RPC Portmap reflection attacks, telecoms firm Level 3 Communications also warned organizations about such threats.
Another type of attack abuses Sentinel license servers, which are used to enforce and manage licensing in multi-user environments. The first such attack was observed by Akamai in June 2015 and it leveraged a vulnerable Sentinel server used by Stockholm University in Sweden. In September, Akamai mitigated a couple of Sentinel reflection DDoS attacks aimed at a gaming company and a financial firm, with a peak bandwidth of 11.7 Gbps detected for one of these attacks. DDoS protection company Nexusguard also warned about such attacks last month.
While the amplification factor for such attacks can exceed 40, attackers are limited by the fact that there aren’t many Sentinel servers that can be abused. Only 745 unique sources of attack traffic have been identified, Akamai said in its report.
"Although reflection DDoS attacks are common, these three attack vectors abuse different services than we've seen before, and as such they demonstrate that attackers are probing the Internet relentlessly to discover new resources to leverage," said Stuart Scholly, senior vice president and general manager at Akamai’s Security Business Unit. "It looks like no UDP service is safe from abuse by DDoS attackers, so server admins need to shut down unnecessary services or protect them from malicious reflection. The sheer volume of UDP services open to the Internet for reflection DDoS attacks is staggering."
Earlier this week, Symantec warned that attackers had started abusing MySQL servers infected with a piece of malware dubbed “Chikdos” for DDoS attacks.
