The store-and-flood distributed reflective denial of service attack

Abstract

Distributed reflective denial of service (DRDoS) attacks, especially those based on UDP reflection and amplification, can generate hundreds of gigabits per second of attack traffic, and have become a significant threat to Internet security. In this paper we show that an attacker can further make the DRDoS attack more dangerous. In particular, we describe a new DRDoS attack called store-and-flood DRDoS, or SF-DRDoS. By leveraging peerto-peer (P2P) file-sharing networks, SF-DRDoS becomes more surreptitious and powerful than traditional DRDoS. An attacker can store carefully prepared data on reflector nodes before the flooding phase to greatly increase the amplification factor of an attack. We implemented a prototype of SF-DRDoS on Kad, a popular Kademlia-based P2P file-sharing network. With realworld experiments, this attack achieved an amplification factor of 2400 on average, with the upper bound of attack bandwidth at 670 Gbps in Kad. Finally, we discuss possible defenses to mitigate the threat of SF-DRDoS.

Distributed reflection denial of service attack: A critical review

“…Increasingly rampant DDoS attacks, particularly attacks by DRDoS with UDPs, have become a global problem [29], [30]. DRDoS attacks, which focus on UDP reflection and amplification, can produce hundreds of gigabits per second of attack traffic, and has become a major threat to internet safety [31]. These attacks violate UDP-based network protocols that send a higher response compared with the request size.…”

“…Thus, in our research area, we aim to shed light on the techniques used to detect and mitigate the BGP protocol by DRDoS attack. TCPbased DRDoS attacks were studied, but they only occur during the link establishment step due to the threeway handshake procedure and have no major amplification impact [31]. The protocols based on TCP, such as FTP and Telnet, have the highest number of amplifiers, as shown by data from scanning a random IP address for the popular protocols [34].…”

“…The UDP protocol allows the amplification/reflection of the response that will lead to producing hundreds or thousands of gigabits per second of attack traffic. Thus, the DRDoS attacks become an influential threat to internet security [31]. The huge UDP traffic is amplified by the attacker, and the attacker is directed to the target by flooding the bandwidth of the victim by using P2P networks to store agent attack data before the attack process [39].…”

A Novel SIP Based Distributed Reflection Denial-of-Service Attack and an Effective Defense Mechanism

“…A successful DoS attack against a VoIP network requires the IP addresses of the SIP server and the SIP clients, and the IDs of the SIP users [38]. We obtain these parameters using our attack tool Mr.SIP's Network Scanner and SIP Enumerator modules.…”