Mirror saturation in amplified reflection Distributed Denial of Service: A case of study using SNMP, SSDP, NTP and DNS protocols

摘要

Over the last six years, there have been two major game changers in Distributed Deny of Service (DDoS) attacks: amplified reflection and the Internet of Things (IoT). Together, they motivated well-founded security concerns relating to IoT's offered attack surface, and how it could potentialize DDoS. In order to assess those concerns, the feasibility of loT device abuse as reflectors were evaluated in this paper. Attacks abusing four protocols were tested showing a pattern that indicates that reflector saturates without sustaining maximum amplification rates, for very low injection rates (between 10 and 100 probe/sec). Hence, if on the one hand IoT devices, in general, would not be considered good reflectors, they would be good injectors. Any prepared attacker could thus use more injectors while maintaining low injection rates. This would certainly require greater coordination from the attacker but tends to hamper detection. It is expected to new levels of higher sophistication in DDoS attack execution, as in carpet bombing and pulse attacks, with the evolution of Command and Control (C2) incorporating orchestration and attack coordination.