Web Censorship Systems Can Facilitate Massive DDoS Attacks

Reading Time: 1 Minute

See Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

“Tens of millions of these devices are exposed and vulnerable to abuse from adversaries and approximately 18 million of these provide at least a 2:1 amplification factor, resulting in one of the most prolific types of reflectors/amplifiers available to adversaries,” wrote Roland Dobbins and Steinthor Bjarnason in a technical analysis posted Friday.

Why Censorship Systems?

Affected censorship systems, researchers found, are particularly susceptible to these type attacks because of three factors write researchers:

• A desire on the part of the designers of such systems to scale their performance and function in asymmetrical-routing scenarios by unwisely foregoing the requirement for a full TCP handshake prior to responding to requests for a URI on the censorship systems’ deny-lists.
• The configuration and deployment of abusable systems such that they will intercept and respond to inbound spoofed, crafted attack initiator packets on their northbound interfaces, rather than intercepting and processing outbound traffic solely on their southbound interfaces.
• The siting of some abusable systems within the ambit of routing loops, thus converting them into what are effectively infinite repeating reflectors/amplifiers.

Netscout says many censorship systems are “suboptimal” in design and “implementation decisions allow spoofed requests for denied FQDNs and/or URIs to be synthesized by attackers in much the same way as other well-known reflection/amplification DDoS vectors.” This, they say results in amplified HTTP responses being directed towards the intended targets of the attack.

See Also: Offensive Security Tool: FFUF

Systems Open to Attack Because of Misconfiguration

At the heart of the vulnerability is a common misconfiguration of censorship systems that responds to HTML block notification pages from Uniform Resource Identifiers (URI) in a specific way.

“[A] lack of enforcement regarding TCP three-way handshakes, ensure that attackers can spoof the IP addresses of their targets, selecting both the source and destination ports of their choice, in order to launch high-pps/-bps HTTP reflection/amplification attacks,” researchers wrote.

Attackers can easily cloak attacks as well.

“Skilled attackers are likely to choose source and destination ports intended to allow the amplified attack traffic to conform to common network access control policies, thus masquerading the attack traffic so that at first glance, it appears to be legitimate in the context of targeted applications, services, and infrastructure,” wrote Dobbins and Bjarnason.

See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker

Mitigation Risk: The Recommendations

Netscout recommends that network operators identify abuse-able censorship systems and remove them.

“The security researchers who discovered this attack methodology have published a bespoke fork of the ZMap scanning software, along with an accompanying module, which can be used to identify abusable systems,” researchers wrote.

“Nationwide internet censorship threatens free and open access to communication and information for millions of users living inside of censoring regimes… We show that this poses an even greater threat to the internet than previously understood,” wrote researchers from the University of Maryland and the University of Colorado Boulder.

Source: threatpost.com

(Click Link)