On remote exploitation of TCP sender for low-rate flooding denial-of-service attack

摘要

This letter shows a potentially harmful scenario named Induced-shrew attack in which a malicious TCP receiver remotely controls the transmission rate and pattern of a TCP sender to exploit it as a flood source for launching low-rate Denial-of-Service (DoS) attacks. Through simulation, proof-ofconcept implementation and experimentation in testbed and realworld Internet paths, we demonstrate that standard implementation of TCP senders can be exploited as flood sources for low-rate DoS attacks without compromising them. We describe the nature of the underlying vulnerability and discuss possible countermeasures against the Induced-shrew.