CERT-In Advisory
CIAD-2021-0030
HTTP Reflection / Amplification DDoS attack through security Middle-boxes (TLP: WHITE)
Original Issue Date: September 02, 2021
Severity Rating: High
Description
A potential new method of DDoS attack has been identified that exploit a loophole in the security middle boxes such as Intrusion Prevention Systems (IPS), NextGen Firewalls, Network Address Translators (NATs) and Load balancers etc.
The attack is carried out by sending a specially crafted sequence of packets to misconfigured security middle boxes deceiving it into believing a 3-way handshake is completed thus allowing TCP communication. The attacker sends an HTTP request for a website likely to be blocked at the security device, spoofing the IP Address of the victim, to which the security device responds with a large HTML blocking notification page which results in amplification effect. It is reported that the attacker can achieve an amplification factor up to 100,000,000.
II. Measures to be adopted to protect against DDoS attacks.
1. Measures for detection of attacks:
- Understand your current environment and have a baseline of the daily volume, type and performance of network traffic.
- Enable adequate logging mechanisms at perimeter, server, system level and review the logs at frequent intervals.
- Continuously monitor the network activities & server logs to detect and mitigate suspicious and malicious activities in your network. Review the traffic patterns and logs of perimeter devices to detect anomalies in traffic, network level floods(TCP, UDP, SYN, etc.) and application floods (HTTP GET) etc.
- Preserve all logs indicating type of attack and attack sources.
2. Protection measures:
- Thoroughly scan the network and online applications and plug any existing vulnerability in the network devices, operating systems, server software and application software and apply latest patches/updates as applicable.
- Employ defense-in-depth strategies: emphasize multiple, overlapping and mutually supportive defensive systems to guard against single point failures in any specific technology and protection method.
- Deploy appropriate Intrusion/DDoS Prevention System capable of detecting and mitigating DDoS attacks. Ensure that Intrusion/DDoS Prevention System contain signatures to detect the attacks launched from common attack tools.
- Sudden surge in inbound traffic to any critical server or services, such as ICMP floods, UDP/TCP flood etc. could be due to DDoS attacks. If such attacks are observed, implement appropriate response measures in coordination with Internet Service Provider (ISP).
- Identify and block the attack sources at Router/Packet filtering device/DDoS prevention solutions. Disable non-essential ports/services.
- To counter attacks on applications, check the integrity of critical application files periodically and in case of suspicion of attack restore applications and content from trusted backups.
- Maintain list of contacts of ISPs, vendors of network and security devices and contact them as appropriate.
- In case your SLA with ISP includes DDoS mitigation services instruct your staff about the requirements to be sent to ISP.
- Have a Business Continuity Plan and Disaster Recovery Plan ready for activation in case of emergency.
References
https://www.netscout.com/blog/asert/http-reflectionamplification-abusable-internet-censorship
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|