Censors pose a threat to the entire Internet. In this work, we show that censoring middleboxes and firewalls can be weaponized by attackers to launch unprecedented reflected denial of service attacks. We find hundreds of thousands of IP addresses that offer amplification factors greater than 100× and IP addresses that technically offer infinite amplification.
This is the code repository for the USENIX Security 2021 paper, "Weaponizing Middleboxes for TCP Reflected Amplification".
This repository contains submodules for our two forks of ZMap, a submodule to the main Geneva repository containing the plugin used to identify the amplifying sequences, and processing scripts for analyzing scan results.
Amplification attacks are not the only way that censors pose a threat to those living outside their borders. See our concurrent work from WOOT 2021 on weaponizing censors for availability attacks and its repository.
Reflective amplification attacks are a powerful tool in the arsenal of a DDoS attacker, but to date have almost exclusively targeted UDP-based protocols. In this paper, we demonstrate that non-trivial TCP-based amplification is possible and can be orders of magnitude more effective than well-known UDP-based amplification. By taking advantage of TCP-non-compliance in network middleboxes, we show that attackers can induce middleboxes to respond and amplify network traffic. With the novel application of a recent genetic algorithm, we discover and maximize the efficacy of new TCP-based reflective amplification attacks, and present several packet sequences that cause network middleboxes to respond with substantially more packets than we send.
We scanned the entire IPv4 Internet to measure how many IP addresses permit reflected amplification. We find hundreds of thousands of IP addresses that offer amplification factors greater than 100×. Through our Internet-wide measurements, we explore several open questions regarding DoS attacks, including the root cause of so-called "mega amplifiers". We also report on network phenomena that causes some of the TCP-based attacks to be so effective as to technically have infinite amplification factor (after the attacker sends a constant number of bytes, the reflector generates traffic indefinitely).
?️♀️ Finding Amplifiers: ZMap Forks
We scanned the entire IPv4 Internet dozens of times to find IP addresses with middleboxes on their path that could be weaponized. To find these, we created two custom forks of the open-source scanning tool
ZMap. ZMap is a fast single packet network scanner designed for Internet-wide network surveys. We modified ZMap first to add a new probe module (the
forbidden_scan module defined in
src/probe_modules/module_forbidden_scan.c), and then created a second fork to add the ability to craft two distinct packets for each probe (this enables us to send a custom
SYN packet, followed by a second custom packet containing a well-formed HTTP
zmap in this repository is for single packet scans (the
PSH+ACK scans from our paper) and
zmap_multiple_probes (for the
SYN; PSH or
SYN; PSH+ACK scans from our paper).
The module has multiple options compiled in, including the
Host: header included in the payload. To change any of the following options, edit the
module_forbidden_scan.c file located in
src/probe_modules and recompile ZMap to use.
? Running ZMap
Example on how to build
zmap and run the
forbidden_scan module to scan a single IP address and record the responses received:
$ IP=<IP address to scan here> $ cmake . && make -j4 && sudo src/zmap -M forbidden_scan -p 80 $IP/32 -f "saddr,len,payloadlen,flags,validation_type" -o scan.csv -O csv
The output of the scan is a csv file called
scan.csv. For each packet that ZMap identified as a response to our scan, the output file will contain the
src IP address, the IP length of the packet, the length of the payload itself, the TCP flags, and the validation_type (the reason the probe treated the incoming packet as a response to a probe).
This module can be used to test firewalls or other middleboxes to see if they are vulnerable to this attack.
Also in this repsitory is a helper script
scan_all.py, which can be used to automate multiple ZMap scans with different scanning parameters.
? Processing Scan Results
Included in this repository are two helper scripts to process the results of a ZMap scan. The main processing script is
stats.py, which will consume the output of ZMap and generate graphs and summary statistics about the scan. See the below example of the
stats.py script processing a
scan.csv file (note the IP addresses have been anonymized).
# python3 stats.py scan.csv 149 Processing scan data assuming attacker sent 149 bytes per IP. Initializing analysis of scan.csv Calculating total length of file to analyze: 949099449 total packets to analyze. - Unique responding IPs: 362138621 - Number of amplifying IP addresses: 218015761 - Total number of bytes sent by amplifying IP addresses: 45695690843 - Average amplification rate from amplifying IP addresses: 1.407000 - Highest total data received by IP: 7632101 184.108.40.206 141334 9788625 220.127.116.11 181270 44365380 18.104.22.168 142200 238162104 22.214.171.124 1011556 - Highest total packets received by IP: 7360299 126.96.36.199 136301 8040711 188.8.131.52 148901 8186133 184.108.40.206 151594 238162104 220.127.116.11 1011556 - Flags on packets sent by responders: + 472: S + 119609984: R + 680892582: RA + 12: FSPA + 1: SPUE + 2: PAU + 1: SUEC + 1: FAU + 1: PAUE + 1: SRPAUEC + 7217: FRPA + 4734607: FA + 5540525: RPA + 3687478: PA + 58615499: SA + 11928812: FPA ... - CDF of number of packets sent: scan_packets_cdf.eps - CDF of bytes sent: scan_bytes_cdf.eps - CDF of amplification rate: scan_amplification_cdf.eps
This repository is licensed under BSD 3-Clause license. Please note that this repository contains multiple submodule pointers to other repositories, each of which contains its own license. Please consult each for license information.