The debate over whether the recent cataclysmic floods in the UK were due to man-made climate change will rage on. In the digital world though, it’s clear that massive flooding of networks, involving data rather than water, is the result of actions taken by the men and women who created the internet in the latter half of the 21st century. And yet the problems they created can be solved.
Over the last year, digital criminals have been exploiting age-old pieces of web architecture to amplify their attacks to epic magnitudes. Exempli gratia: content delivery network CloudFlare has been at the centre of two massive attacks in the last year, known as distributed denial of service (DDoS) hits because they kill websites with traffic coming from multiple sources.
The first was in March 2013, when attackers wanting to take down an anti-spam organisation Spamhaus used a neat way of knocking their target offline. They realised that by pretending to be Spamhaus, spoofing the group’s IP address, they could send small requests to pieces of the internet that would return significant amounts of data, which would subsequently clog up the networks used by their enemy and taking them offline.
The attackers were able to exploit a feature in domain name system (DNS) servers, which are normally used to translate searches for URLs (e.g. theguardian.com) into IP addresses (e.g. 216.27.61.137). Requests sent to open DNS servers give large responses, and so make for nice amplifiers. The eventual traffic generated by abusing this weakness was an epic 309Gbps, which disrupted portions of Europe’s internet.
NTP = no tiny problem
That was a record until this February, when attackers used a similar method, but exploiting the Network Time Protocol (NTP), which is used to sync times across machines. By sending tiny requests to 4,529 NTP servers running on 1,298 different networks, they were able to generate just under 400Gbps as they attempted but failed to wipe an unnamed site offline, according to CloudFlare.
Attacks over the time syncing protocol are the most pressing concern. In a paper published on 24 February, Christian Rossow, security researcher at the Ruhr University Bochum in Germany, notes the level of amplification over NTP is startling.
In the worst case Rossow investigated, attackers abusing NTP would only need to generate 0.02% of the bandwidth that they want their victim to receive. NTP servers could be abused to amplify request traffic sent by an attacker by a factor of anywhere between 556.9 and 4670. That’s simply massive.
It’s all because of a feature that was left open until a recent release of NTP, known as “monlist”. It means that by sending just 8 bytes of data, an NTP server will relay data on recent clients that had connected to it, in up to 100 different data packets with 440 bytes in each payload.
It’s like asking Zoltar a one-word question whilst standing next to someone you’re not particularly keen on, running away and the mechanical fortune teller’s response both deafening and knocking out that unlucky customer left alone to take the hit.
It’s in the game
But NTP and DNS servers aren’t the only problems here. There are other exploitable protocols, 12 of which Rossow details in his report, many of which were designed years ago, when the creators of what would become the modern internet had no idea how their code would be used for destructive means. Millions upon millions of potential amplifiers are now available to attackers.
Others are more current. Servers used by gamers, namely those used by Quake 3 and Valve’s Steam client, could be abused in similar ways. For Quake 3, a request could be sent to a game server, which would respond with detailed configuration data and a list of current players.
Attackers wanting to exploit this would likely do so during busy gaming hours, when they could amplify their requests by over 80 times. The Valve-owned Steam protocol, used in massively popular games like Counter-Strike, Half-Life or Team Fortress, was found to offer less power but would no doubt still prove handy to attackers.
“I’ve been in contact with Valve in January... They have acknowledged the problem and will investigate response rate limiting (on mid-term) and changing the Steam protocol (on long-term),” says Rossow. “Community-driven games like Quake 3 already address the weaknesses by proposing ways how to add rate limiting to open servers.”
Valve had not responded to a request for comment at the time of publication.
Legacy protocols, like the charmingly named Quote of the Day Protocol, which mainframe administrators used to broadcast a daily quote on request by a user, can also be abused. And there are millions of potential amplifiers across the BitTorrent peer-to-peer network too.
SNMP = seriously nasty massive problem
Even if they can’t generate anything like the power attacks over NTP can, these other exploitable bits of the Internet remain a cause for concern. Outside of NTP and DNS, the most worrying threat is amplification over the Simple Network Management Protocol (SNMP), traditionally used for monitoring of devices connected to a network.
Rossow estimates there are 4.83m SNMP servers that could be used for amplification, by sending a request for a “GetBulk operation”, in which a device returns a list of devices that can be monitored over the protocol. Attacker traffic could be multiplied by as much as 11.3 times.
• The war over mobile ‘adware’
Whilst that amplification isn’t huge, Matthew Prince, CEO of CloudFlare, claims he has seen amplification at a factor of 650 over SNMP. That attack, which took place in 2012 and was a result of SNMP being enabled on Comcast DSL modems, only generated 25Gbps. Prince believes this will be the next big attack vector. “SNMP reflection is the really big bad one.”
With most of these protocols, an attacker with reasonable programming skills would be able to find open servers in a “negligible” amount of time, according to Rossow’s paper. He found it takes around one minute to acquire 100,000 BitTorrent amplifiers, and around four to get the same number over NTP, DNS and SNMP.
“We shouldn’t have designed these protocols in a way that they are vulnerable to attacks like this,” Prince adds. He believes malicious types will soon turn to combining amplification methods, in particular DNS, NTP and SNMP. This would make detection and prevention trickier. “Combine those three and you start to have attacks that start to threaten core parts of the internet’s backbone.”
Overwhelmed much?
All this might seem overwhelming, but there are two main ways to stem the tide of huge data floods. The first is simple: those running devices with the vulnerable protocols can fix their machines, either by installing a patch, as has been provided for NTP servers, or by closing off functions within servers, as can be done with DNS and SNMP.
The fight to fix NTP servers is going rather well at the minute. When Rossow completed his research in July last year, there were 1.6 million NTP servers using the “monlist” command. There are now only 190,000 and the figure is steadily going down, Rossow says.
Yet for attacks over DNS, the problem is only getting worse. One man who is particularly depressed about the situation is Jared Mauch, who, in his spare time outside of working for network company NTT, runs an initiative trying to reduce the number of exploitable DNS resolvers – the Open Resolver Project.
A year ago, he thought he could cut the number down from 25 million to less than 10 million. Yet rather than go down, the number has only gone up. At last count, there were 32 million. “Most people don’t take action until they feel the threat is relevant to them,” says Mauch, who also runs the Open NTP Project.
“People don’t buy flood insurance until their house is going to be flooded. I think there are a lot of these hidden risks out there that deep technologists understand but the average person who just wants to use the Internet to get to YouTube and Netflix, whatever services they intend to use, it’s just plumbing to them. People don’t care about how their pipes work until they don’t work.
“I don’t want to go as far as to call it irresponsible, but it’s definitely something where I wish more attention was paid to services that people operate and offer.”
Global problem, little action
There are technical reasons for the lassitude too. Open DNS resolvers are harder to locate and fix, as they can be anything from home internet routers to Android phones used as Wi-Fi hotspots. “It is very difficult to monitor and check whether or not you are running a vulnerable network. The average Android phone user doesn’t anticipate that when they put their phone in Wi-Fi hotspot mode that they are contributing to the DDoS problem,” adds Prince.
Another way to prevent these amplified attacks is by getting network administrators to prevent IP spoofing. This is done by implementing what is known as best common practice (BCP) number 38 - a standard created by the IETF (Internet Engineering Task Force) that puts a packet filter on the edge of networks to stop spoofing.
But again little action is being taken. As of July 2013, the Spoofer Project noted that 25% of Autonomous Systems worldwide, which includes internet service providers, allowed for IP spoofing. In mid-February 2014, the figure remains the same.
This is a global problem, Rossow says. “Many countries are affected, [including those] in Europe, and also the UK. We can only hope that the current wave of amplification attacks raises the awareness of such providers.”
Governments are now aware of the issue, as highlighted by national Computer Emergency Response Team (CERT) alerts over amplification in recent months. That’s largely because security professionals like Mauch and Rossow warned them about it. But now it’s time for others running networks to take action.
It may be hard to convince them to act, as their systems aren’t the ones suffering. But those apathetic few are imposing a cost on the rest of the internet. Whether they locate vulnerable systems or prevent spoofing, they will be doing so for the good of the internet.
• Feeling smug that your iPhone can’t be hacked? Not so fast...
• How can I keep my Android tablet or smartphone secure?
