Amplification attack: Difference between revisions
imported>Howard C. Berkowitz No edit summary |
imported>Howard C. Berkowitz (added RFC to change default for directed broadcast) |
||
| Line 1: | Line 1: | ||
{{subpages}} | {{subpages}} | ||
One of the means of carrying out a hostile attack against computers and computer networks is the '''amplification attack'''. In such an attack, the [[miscreant]] need not send large volumes of direct offense against the targeted system, but exploits some aspect of its design to cause it to flood itself with the response to the crafted attack. | One of the means of carrying out a hostile attack against computers and computer networks is the '''amplification attack'''. In such an attack, the [[miscreant]] need not send large volumes of direct offense against the targeted system, but exploits some aspect of its design to cause it to flood itself with the response to the crafted attack. | ||
==smurf== | |||
The "smurf" exploit, which should no longer be possible in any well-maintained network, exploited a feature of [[Internet Protocol version 4]] called the [[directed broadcast]]. This feature caused all hosts on a [[subnet]] to treat an destination address, with the host field set to all ones, as intended for every machine on the subnet. If a simple query such as the [[Internet Message Control Protocol]] echo request packet is sent to every host, every host generated an echo reply in response. For a moderate-sized subnet, sending a single ICMP echo request could generate hundreds of replies. The amplified volume of the replies do the damage, not what the miscreant sends: their volume attacks the return-path bandwidth. | |||
Smurfs were defeated by changing the IPv4 specification to make the default behavior for [[router]]s ''not'' to forward directed broadcasts.<ref name=>{{citation | |||
| id = RFC 2644 | |||
| title = Changing the Default for Directed Broadcasts in Routers. | |||
| author = D. Senie. | date = August 1999. | |||
| url = http://www.ietf.org/rfc/rfc2644.txt}}</ref> | |||
==References== | |||
{{reflist}} | |||
Revision as of 19:05, 22 February 2009
One of the means of carrying out a hostile attack against computers and computer networks is the amplification attack. In such an attack, the miscreant need not send large volumes of direct offense against the targeted system, but exploits some aspect of its design to cause it to flood itself with the response to the crafted attack.
smurf
The "smurf" exploit, which should no longer be possible in any well-maintained network, exploited a feature of Internet Protocol version 4 called the directed broadcast. This feature caused all hosts on a subnet to treat an destination address, with the host field set to all ones, as intended for every machine on the subnet. If a simple query such as the Internet Message Control Protocol echo request packet is sent to every host, every host generated an echo reply in response. For a moderate-sized subnet, sending a single ICMP echo request could generate hundreds of replies. The amplified volume of the replies do the damage, not what the miscreant sends: their volume attacks the return-path bandwidth.
Smurfs were defeated by changing the IPv4 specification to make the default behavior for routers not to forward directed broadcasts.[1]
References
- ↑ D. Senie. (August 1999.), Changing the Default for Directed Broadcasts in Routers., RFC 2644