SNMP DDoS Scans Spoof Google Public DNS Server

The SANS Internet Storm Center Yesterday Reported SNMP Scans Spoofed from Google’s Public Recursive DNS Server Seeking to Overwhelm Vulnerable Routers and Other Devices that Support the Protocol with DDoS Traffic. “The traffic is spoofed and claims to come from Google’s DNS server. The attack is however not an attack against Google. It is likely an attack against misconfigured gateways”, Said Johannes Ullrich, Dean of Research of the SANS Technology Institute and Head of the Internet Storm Center. Ullrich Said the ISC is still Investigating the Scale of the Possible Attacks but Said, the Few Packets that Have been Submitted Target Default Passwords Used by SNMP. In an Update Posted Last Night, Ullrich Said the Scans are Sequential, indicating Someone is Conducting an Internet-Wide Scan Looking for Vulnerable Routers and Devices that Accept Certain SNMP Commands. “The attack uses the default ‘read/write’ community string of ‘private’. SNMP uses this string as a password and ‘private’ is a common default”, Ullrich Said. “For read-only access, the common default is ‘public’.” Ullrich Explained that, the Attack Tries to Change Configuration Variables in the Affected Device, the TTL or Time To Live Variable to 1 which he Said, Prevents any Future Traffic Leaving the Gateway and it also Sets the Forwarding Variable to 2, which Shuts it Off. Vulnerable Configurations, Ullrich Said, are likely Not Common. “If this works, it would amount to a [DDoS] against the network used by the vulnerable router”, Ullrich Said. “This could also just be a troll checking ‘what is happening if I send this ?’.”


Large-Scale DDoS Attacks Rely on Amplification or Reflection Techniques to Amp Up the Amount of Traffic Directed at a Target. DNS Reflection Attacks are a Time-Tested Means of Taking Down Networks with Hackers Taking Advantage of the Millions of Open DNS Resolvers on the Internet to Get Up to 100 to 1 Amplification Rates for Every Byte Sent Out. Earlier this Year, Home Routers were Targeted in DNS-Based Amplification Attacks; More than 5 Million were Used during February Alone as the Starting Point for DDoS Attacks. Also Earlier this Year, Hackers Found a Soft Spot in Network Time Protocol (NTP) Servers that Synch Time for Servers across the Internet. NTP-Based DDoS Attacks, Some Reaching 400Gbps, were Keeping Critical Services Offline. However, a Concerted Patching Effort has Kept these Attacks at Bay and in June, NSFocus Reported that, of the 430,000 Vulnerable NTP Servers Found in February, All but, 17,000 had been Patched. Experts, however, Warned that, SNMP-Based DDoS Attacks, Could be the Next Major Area of Concern. Matthew Prince, CEO of CloudFlare, Said in February that SNMP Attacks Could Dwarf DNS and NTP. “If you think NTP is bad, just wait for what’s next. SNMP has a theoretical 650x amplification factor”, Prince Said. “We’ve already begun to see evidence attackers have begun to experiment with using it as a DDoS vector. Buckle up.” SANS’ Ullrich, meanwhile Said, he’s Continuing to Research this Attack and Admins Should be on the Lookout for Packets from the Source IP 8.8.8.8, which is Google’s DNS Server, with a Target UDP Port of 161. “Just like other UDP based protocols (DNS and NTP), SNMP has some queries that lead to large responses and it can be used as an amplifier that way”, Ullrich Said.




Info Source:

https://isc.sans.edu/forums/diary/Google+DNS+Server+IP+Address+Spoofed+for+SNMP+reflective+Attacks/18647