You are here
Hell of a Handshake: Abusing TCP for Reflective Amplification DDoS Attacks
Marc Kührer, Thomas Hupperich, Christian Rossow, and Thorsten Holz, Ruhr-University Bochum
Nowadays, a common way for attackers to perform Distributed Denial-of-Service (DDoS) attacks is via so called amplification attacks. The basic idea is to send relatively small requests with spoofed source address to public hosts (e.g., NTP servers), which reflect significantly larger responses to the victim of the attack. Recent studies focused on UDP-based attacks and analyzed the attack surface in detail. First results also suggested that TCP-based protocols are in principle vulnerable to such attacks, despite the three-way-handshake mechanism.
In this paper, we continue this line of work and demonstrate that TCP protocols indeed can be abused in practice. More specifically, we show that the handshake itself often yields amplification, especially since a lot of devices on the Internet react in unforeseen ways during the connection establishment. To estimate the landscape of Internet devices vulnerable to TCP amplification attacks, we performed Internet-wide scans for common TCP-based protocols and identified thousands of amplifiers that allow an amplification of factor 50x and higher.
Open Access Media
USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.