DDoS attackers have found this new trick to knock over websites

Distributed denial of service (DDoS) attackers are using a new technique to knock websites offline by targeting vulnerable ‘middleboxes’, such as firewalls, to amplify junk traffic attacks. 

Amplification attacks are nothing new and have helped attackers knock over servers with short busts of traffic as high as 3.47 Tbps. Microsoft last year mitigated attacks on this scale that were the result of competition between online-gaming players

But there’s a new attack on the horizon. Akamai, a content distribution network firm, says it has seen a recent wave of attacks using “TCP Middlebox Reflection”, referring to transmission control protocol (TCP) – a founding protocol for secured communications on the internet between networked machines. The attacks reached 11 Gbps at 1.5 million packets per second (Mpps), according to Akamai.

SEE: Cybersecurity: Let’s get tactical (ZDNet special report)

The amplification technique was revealed in a research paper last August, which showed that attackers could abuse middleboxes such as firewalls via TCP to magnify denial of service attacks. The paper was from researchers at the University of Maryland and the University of Colorado Boulder.

Most DDoS attacks abuse the User Datagram Protocol (UDP) to amplify packet delivery, generally by sending packets to a server that replies with a larger packet size, which is then forwarded to the attacker’s intended target. 

The TCP attack takes advantage of network middleboxes that don’t comply with the TCP standard. The researchers found hundreds of thousands of IP addresses that could amplify attacks by over 100 times utilizing firewalls and content filtering devices. 

So, what was a theoretical attack just eight months ago is now a real and active threat. 

“Middlebox DDoS amplification is an entirely new type of TCP reflection/amplification attack that is a risk to the internet. This is the first time we’ve observed this technique in the wild,” it says in a blogpost

Firewalls and similar middlebox devices from the likes of Cisco, Fortinet, SonicWall and Palo Alto Networks, are key pieces of corporate network infrastructure. Some middleboxes however don’t properly validate TCP stream states when enforcing content filtering policies. 

“These boxes can be made to respond to out-of-state TCP packets. These responses often include content in their responses meant to “hijack” client browsers in an attempt to prevent users from getting to the blocked content. This broken TCP implementation can in turn be abused to reflect TCP traffic, including data streams, to DDoS victims by attackers,” Akamai notes. 

Attackers can abuse these boxes by spoofing the source IP address of the intended victim to direct response traffic from the middleboxes. 

In TCP, connections use the synchronize (SYN) control flag to exchange key messages for a  three-way handshake. The attackers abuse the TCP implementation in some middelboxes that cause them to unexpectedly respond to SYN packet messages. In some cases, Akamai observed that a single SYN packet with a 33-byte payload produced a 2,156-byte response, amplifying its size by 6,533%.   

Note: This article have been indexed to our site. We do not claim legitimacy, ownership or copyright of any of the content above. To see the article at original source Click Here

Related Posts
There is actually a Sichuan girl behind the pig heart transplant thumbnail

There is actually a Sichuan girl behind the pig heart transplant

她便是杨璐菡,被称为‘基因剪刀手’,毕业于北大-哈佛的真学霸。CRISPR‘剪掉’小猪致病基因要知道,猪可是人体器官移植供体最佳动物之一。一直以来,将猪器官移植到人体存在着两大风险:一方面猪的基因本身携带内源性逆转录病毒(PERVs),另一方面猪器官会在人体内产生排异反应。5年前,杨璐菡领导团队成功运用CRISPR-Cas9‘基因剪刀’技术灭活猪细胞中的致病基因。这项研究Inactivation of porcine endogenous retrovirus in pigs using CRISPR-Cas9曾在2017年8月10日发表在Science期刊上。论文链接:https://www.science.org/doi/abs/10.1126/science.aan4187先前的研究工作中,大多数基因改造都是在一个基因层面上修改。而杨璐菡团队面临的科学难题便是如何在猪的单个细胞修改62个基因,也就是内源性逆转录病毒(PERVs)。更重要的是,还要保证基因组的完整。杨璐菡利用CRISPR-Cas9基因编辑工具攻克这一难题,不仅大大提高了基因编辑效率,还缩短了培育基因改造猪的时间。可以看出,在mRNA基准水平上,所有猪基本上实现了内源性逆转录病毒100%的清除率。注:棕色是1天大的小猪; 蓝色是5-7天大的小猪; 绿色是15-19天大的小猪研究中,科学家们还检索了猪成纤维细胞基因组内存在的PERVs,共发现了25种。他们同样利用CRISPR技术将这25种PERV的基因位点灭活。这个便是一只诞生的PERV灭活小猪,它叫LaiKa,照片拍摄于出生后的第二天。正是杨璐菡团队CRISPR-Cas9这一基因敲除技术的贡献,从根本上解决了猪器官移植到人体内可能导致病毒传染的风险。但是这位女神科学家的研究不仅于此。正如我们熟知的‘石墨烯驾驭者’曹原是Nature狂魔,杨璐菡可以称得上是Science和Nature的狂魔。 2周大的PERV灭活小猪其实,早在2013年,杨璐菡就将CRISPR系统成功应用于人类细胞基因编辑,同样发表在国际期刊Science上。 论文链接:https://www.science.org/doi/10.1126/science.12320332015年,杨璐菡以并列第一作者的身份在Science上发表了CRISPR-Cas9在细胞内修改基因的工作的论文。 论文链接:https://www.science.org/doi/10.1126/science.aad11912020年9月,一篇Extensive germline genome engineering in pigs论文发表在Nature上,成功研发出第一代可用于临床的异种器官移植雏形‘猪3.0’。论文链接:https://www.nature.com/articles/s41551-020-00613-9去年12月,发表在国内《器官移植》这份核心期刊上,也可以看到杨璐菡的名字,作者身份是杭州启函生物科技有限公司。研究探讨了基因编辑猪在异种器官移植的应用前景。研究人员将1只猪内源性逆转录病毒(PERV)敲除,联合3种主要异种抗原基因敲除,以及抑制补体活化、调节凝血紊乱、抗炎抗吞噬的9种人源化基因转入猪(PERV-KO/3-KO/9-TG)作为供体,获取其心脏、肝脏和肾脏,分别移植给3只恒河猴受体,建立猪-猴异种器官移植临床前研究模型。研究结果显示,基因编辑猪(PERV-KO/3-KO/9-TG)在克服超急性排斥反应、缓解体液性排斥反应及凝血紊乱方面具有一定优势,但其能否作为临床异种器官移植潜在供体需进一步评估。别人眼中的学霸80后的杨璐菡,是个土生土长的川妹子。1986年,她生在山水灵秀的巴蜀小县城,父亲是公务员,母亲是会计师。从小,璐菡就是我们父母嘴上经常说的‘别人家的孩子’,自律和努力是她的标签。‘哪有什么天才,只是比别人多了一份努力。’杨璐菡的成功同样没有任何捷径可言。杨璐菡曾表示,小时候爸妈都很忙,妈妈身体还不好,我从小就不想让他们操心,非常努力。我学习也不是一直都很好,如果你去问我的同学,他们可能会说璐菡很努力!其实也像大多数人一样,很吃力的。15岁那年,她以峨眉山市中考第一名的成绩考入成都七中。从高二开始,她加入生物竞赛队伍,用一年时间把所有生物系本科生和研究生的课程都学完,她基本上靠自学。那时的杨璐菡经常跑去四川大学旁听,她表示几乎听不懂。‘看两三遍就会懂了。’这样的自学对一位高中生而言实在考验自律性和自学能力。功夫不负有心人,璐菡用天赋和努力克服了重重困难,顺利地参加了国际生物奥林匹克竞赛。2004年,璐菡代表中国在第15届国际生物奥林匹克竞赛中荣获金牌。顺理成章地,她被招入北京大学生命科学学院继续学习。2008年,拿到生命科学和心理学双学士学位后,璐菡前往哈佛大学深造,在那里继续攻读硕士和博士学位,及开展博士后研究工作。从此,这位青年女科学家踏上了一条与基因难解难分的科研之路。师承‘合成生物学之父’George Church俗话说,名师出高徒,杨璐菡在基因研究上取得的进步离不开导师的正确指导。她的导师George Church博士是有‘合成生物学之父’美誉的哈佛医学院遗传学系教授,也是美国科学院和工程院双料院士。研究领域包括基因组测序及数据分析、合成生物学、基因组工程、个人基因组学等。George Church教授曾被预言有望获诺贝尔奖,此前,他已获得富兰克林·鲍尔科学成就,2017年,他还被《时代》杂志评选为世界上最具影响力的100个人之一。早在1984年,George Church以第一作者,导师Walter Gilbert第二作者,发表了首个直接基因组测序方法。在2017年的一次采访中,谈及基因科学下一个重大突破会是什么时,George Church 教授认为,是‘编写’DNA,而非‘编辑’DNA。George Church 教授认为,‘编写DNA’包括添加基因、删除基因(或降低基因表达)以及精准编辑,最终能在任何想要的地方,写入想要的基因。添加基因时,基因能插入到染色体的任何一个位置。删除或是降低基因时,要么引入一个干扰分子,要么直接攻击这个基因,把它弄成一团糟,几乎没有什么办法能彻底移除一个基因。差点没从哈佛毕业早在2015年,杨璐菡就开启了创业历程,和导师George Church共同创办了名为eGenesis的生物技术公司。这是一家致力于推动异种器官移植临床应用,她也是eGenesis的首席科学执行员。2017年回到国内,杨璐菡正式出任了杭州启函生物科技有限公司的CEO。同年,杨璐菡入选达沃斯世界经济论坛(World Economic Forum)评出的2017年度‘全球青年领袖’。2020年9月,入选《财富》(Fortune)2020年度‘全球40位40岁以下商界精英’榜单。人们看到的是,杨璐菡所取得的成功与身上的光环,但人们可能不知道,她差点没从哈佛大学毕业。 2018年4月,加拿大温哥华,杨璐菡在TED2018的后台进行排练在高中读书时,杨璐菡因忙于生物奥赛而耽误了英语学习,导致她的英语成绩一直不给力。在异国求学,因为语言困难,她很难进行深入的专业学习,连哈佛大学的资格考试都显得力不从心。因此,她被要求参加为期一年的语言班学习,才能继续留在哈佛。在英语水平提高之前,她无法在实验室‘浪费’一分一秒。幸运的是,George Church教授表示,自己可以理解杨璐菡想要表达的内容。作为导师,George Church教授不会让自己的学生把时间浪费在语言上。在整个研究生阶段,几乎每周,杨璐菡都会和导师进行学术讨论,也会交流科学、文化和社会各种话题。‘是George Church教授重建了我的信心!’回首过往,杨璐菡深深感慨。George Church教授教给她的远不只是学术,还教会她如何成为一个真正伟大的领导者。
Read More
Twitch says it will lay off 400 employees thumbnail

Twitch says it will lay off 400 employees

Twitch announced plans to reduce its workforce on Monday, demonstrating that even the seemingly booming streaming site isn’t immune to the reductions that have swept the tech industry in the last six months. The layoffs will affect 400 employees at the company and were characterized as an effort to improve Twitch’s business outlook in the
Read More
Leonardo da Vinci used toxic pigments when he painted the Mona Lisa thumbnail

Leonardo da Vinci used toxic pigments when he painted the Mona Lisa

The Lead(II) oxide behind the mystic smile — Plumbonacrite has previously been found in later works by Rembrandt. Jennifer Ouellette - Oct 25, 2023 10:50 pm UTC Enlarge / A tiny fleck of paint, taken from the Mona Lisa, is revealing insights into previously unknown steps of Leonardo da Vinci's process.Public domain When Leonardo da
Read More
Melhor soundbar para comprar | Guia do TudoCelular thumbnail

Melhor soundbar para comprar | Guia do TudoCelular

18 de fevereiro de 2022 30 Destaque de cada soundbarJBL Cinema SB160 — Uma das soundbars mais populares LG SNH5 — Para ir além do som 2.1 Samsung HW-T555 — Boa soundbar intermediária JBL Bar 3.1 — Som potente com graves intensos Yamaha YAS-109 — Surround 3D com suporte a Alexa JBL Bar 2.0 —…
Read More
Russian TikTok creators have reportedly been paid to share propaganda thumbnail

Russian TikTok creators have reportedly been paid to share propaganda

The White House isn't the only one trying to steer discussion of Ukraine on TikTok. Vice News has discovered that Russian TikTok influencers are reportedly being paid to share videos promoting the Putin government's narrative surrounding the invasion. An anonymous operator in a Telegram channel has been telling creators what and when to post, what…
Read More
Blizzard support studio workers drop union bid thumbnail

Blizzard support studio workers drop union bid

One Activision Blizzard studio won't form a union, at least not in the near future. The Communication Workers of America (CWA) says it's withdrawing its petition for a union vote at Blizzard support studio Proletariat, which is currently working on World of Warcraft: Dragonflight. As Kotaku notes, a CWA spokesperson claims Proletariat chief Seth Sivak
Read More
Index Of News
Total
0
Share