DDoS Protocol Amplification Analysis

13 posts · Aug 2012 – Feb 2018

What this trail covers

Cloudflare's DDoS mitigation capabilities have evolved to analyze and defend against increasingly sophisticated amplification attacks. This includes deep dives into protocols like NTP (specifically the MONLIST command) and DNS, understanding their vulnerabilities, and developing strategies to counter large-scale UDP floods. The focus is on identifying and mitigating new attack vectors by analyzing traffic patterns, reflector IPs, and protocol-specific weaknesses to maintain network resilience. This post details the mechanics of NTP-based amplification attacks and provides guidance for mitigating them by securing NTP servers and implementing BCP-38.

All Cloudflare trails

Feb 2018Memcrashed - Major amplification attacks from UDP port 11211This post details the discovery and analysis of a new amplification attack vector using the memcached protocol over UDP port 11211. It explains the mechanics of amplification attacks, the specific vulnerabilities in the memcached protocol that enable high amplification factors (up to 51,200x), and provides data on the scale of attacks observed (up to 260Gbps). It also maps the source IPs of vulnerable memcached servers and lists common hosting providers. Finally, it provides recommendations for memcached users, system administrators, ISPs, and developers to mitigate these attacks.
Jun 2017Stupidly Simple DDoS Protocol (SSDP) generates 100 Gbps DDoSThis post details the analysis of a 100 Gbps+ DDoS attack leveraging the Stupidly Simple DDoS Protocol (SSDP) and UPnP. It explains how misconfigured firewalls and IP spoofing enable these amplification attacks. The post provides technical details on SSDP's M-SEARCH frames, the amplification factors achieved with 'ssdp:all' queries, and the distribution of vulnerable reflector IPs and ASNs. It also includes a Python script for querying SSDP devices and analysis of common 'Server' header values.
Jan 2017The Porcupine Attack: investigating millions of junk requestsThis post details the investigation and analysis of a novel attack vector that generated millions of junk HTTP requests per second. The attack was characterized by a repeating binary payload with specific length distributions and was sourced from a globally distributed botnet that aggressively rotated IP addresses. The invalid HTTP requests bypassed traditional HTTP DDoS mitigations, requiring the use of tcpdump and payload analysis to identify the pattern and scale of the attack. The investigation identified the payload's generation algorithm and its potential connection to Keccak test vectors.
Aug 2016How the Consumer Product Safety Commission is (Inadvertently) Behind the Internet’s Largest DDoS AttacksThis post details how the CPSC.gov DNS record is being used for DNS reflection amplification attacks, explaining the amplification factor (68x) and its popularity among attackers (94% of requests). It analyzes the CPSC.gov DNS record structure and provides recommendations for reducing its size to mitigate its use in DDoS attacks.
Mar 2016Staying afloat: the DROWN Attack and CloudFlareThis post details the DROWN attack, which exploits vulnerabilities in SSLv2 and the sharing of private keys across servers supporting both SSLv2 and newer TLS versions. Cloudflare automatically protects customers by not enabling SSLv2 and proactively tests customer origin servers for vulnerability. The post advises disabling SSLv2 and ensuring private keys are not shared with SSLv2-enabled servers.
Advertisement
Jan 2015DDoS Packet Forensics: Take me to the hex!This post details the analysis of a specific DDoS attack against Cloudflare's DNS servers. The author investigates a correlation between the TTL field in IP headers and the IPv4 source address, discovering that the TTL is derived from the first byte of the source IP address (TTL = first byte >> 1 + 40). Additionally, the DNS ID field is found to be the one's complement of the first two bytes of the source IP, and the IPv4 header ID is the first two bytes of the source IP. The post concludes by posing a mystery about how the random source IPs are generated.
May 2014BPF - the forgotten bytecodeThis post details the historical context and technical implementation of the Berkeley Packet Filter (BPF) and its use in network packet filtering, particularly for tools like tcpdump. It explains the BPF bytecode, kernel API, and how Cloudflare utilizes custom BPF bytecode with the 'xt_bpf' iptables module for sophisticated, high-performance packet filtering to drop malicious traffic, including specific examples for DNS query filtering and subdomain matching.
Feb 2014Good News: Vulnerable NTP Servers Closing DownThis post details the aftermath of a large 400Gbps NTP amplification DDoS attack on Cloudflare's network. It identifies 4,259 vulnerable NTP servers used as amplification vectors via the 'monlist' command. Encouragingly, over 75% of these vulnerable servers were no longer vulnerable within a week and a half, indicating successful community and administrator efforts to patch or reconfigure them. The post also references an earlier blog post explaining the technical details of NTP-based DDoS attacks.
Feb 2014Technical Details Behind a 400Gbps NTP Amplification DDoS AttackThis post details a specific 400Gbps NTP amplification DDoS attack, analyzing its mechanics, the number and distribution of NTP servers used, and the amplification factor of the MONLIST command. It highlights the global nature of the threat and the importance of network operators restricting access to NTP servers and disabling the MONLIST command, as well as enforcing BCP38 to prevent source IP spoofing. It also foreshadows SNMP amplification attacks.
Jan 2014Understanding and mitigating NTP-based DDoS attacksThis post details the mechanics of NTP-based DDoS amplification attacks, explaining how the `monlist` command can be exploited to generate large replies from small requests. It highlights the amplification factor (up to 206x observed) and the ease of finding vulnerable NTP servers. The post also provides mitigation strategies for server administrators (upgrading ntpd, disabling monlist or using mrulist with nonce) and network operators (implementing BCP-38 to prevent IP spoofing).
Feb 2013Good Web Security News: Open DNS Resolvers Are Getting ClosedThis post details the successful effort to reduce the number of open DNS resolvers, a significant source of amplification attacks, by over 30% through engagement with network providers. It highlights the problem of DNS amplification attacks, the role of misconfigured resolvers, and the positive impact of Cloudflare's 'name-and-shame' approach in encouraging network providers to clean up their open resolvers. It also gives kudos to Team Cymru and SoftLayer for their efforts.
Oct 2012Deep Inside a DNS Amplification DDoS AttackThis post details the mechanics of DNS amplification attacks, explaining how attackers leverage open DNS resolvers and UDP to magnify traffic volume. It contrasts DNS amplification with older SMURF attacks and highlights how DNSSEC, while enhancing security, can inadvertently increase the amplification factor. The post also explains Cloudflare's network architecture and bandwidth billing model as factors that make it resilient to such attacks.
Aug 2012Mars Attacks!This post analyzes attack statistics from July 2012, identifying 'Martian IP addresses' (reserved IP ranges not valid on the public internet) as the largest source of attacks. It explains IP address spoofing and how it's used in DDoS attacks, particularly reflection attacks like DNS reflection, where small query packets are amplified into larger reply packets. The post details how Cloudflare's network team analyzes these attacks by looking at invalid networks rather than spoofed source IPs.