Chronological Thread 

< Chronological >      < Thread >

---

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,
please see my comments inline.

> > > Andreas:
> > >
> > > There is no amplification here though... so it is no
> > > different than if Evil-E sent the aborts itself
> > > to all the "victims" V... it must send N packets
> > > to get N packets to victims... this is no
> > > different than a UDP attack.. in fact a UDP attack
> > > is easier...
> >
> > Well, *almost*. The only problem I see here is that many
> > network installations by now have already adapted to UDP
> > attacks, e.g. by filtering excessive amounts (or simply all)
> > ICMP dest. unreachble packets (which are subsequently
> > jamming the targets/victims network).
> >
> > With SCTP, however, it is not that simple: you get back
> > a transport layer packet that is much harder to filter.
>
> How is SCTP harder to filter than UDP.. UDP IS a transport
> protocol and the ports in the UDP/TCP header are in the
> same place as the SCTP header...

Yes, but the UDP does not cause the DoS -- it is the ICMP
destination unreachable packets sent in reply to a UDP packet, that
cause the problems.

> > Think about it: there have been MANY distributed DoS attacks
> > based on UDP, why shouldn't there be some based on SCTP some
> > day ?
>
> Or TCP.. at this level though your attacker is limited
> to the bandwidth/cpu of the Evil-E machine. This is NO
> different than TCP or UDP or anything else out there
> now...

No, that was my point. In typical DDoS scenarios, there is
thousands of Evil-E's, directed by one central process. This has
been done by e.g. the Stacheldraht based DDoS attacks.
I am not saying this is much of an issue, I am saying that
SCTP can be used, as other protocols, for (D)DoS attacks.

Best regards,
Andreas



> > BTW, John: I am not concerned about cycles for processing
> > ABORTs. The problem really arises when an attacker starts a lot
> > of "Evil Endpoints E", that all have one target: Victim V.
> > The scarce resource is bandwidth.
> >
> > > Andreas Jungmaier wrote:
> > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > Hash: SHA1
> > > >
> > > > Dear all,
> > > >
> > > > I am sorry for not explaining more exactly what I meant.
> > > > I am assuming an attack with IP-Spoofing. The evil attacker
> > > > (say E) is spoofing poor victim (say V), using oblivious
> > > > server (say) O.
> > > >
> > > > Now,
> > > >
> > > > Evil-Endpoint E:
> > > > Source IP V(spoofed)
> > > > Dest IP O
> > > > SCTP-INIT (invalid params) ----------------> Server O
> > > > /-------------/
> > > > SCTP-Abort,Error /
> > > > Poor Victim V <--------------/
> > > >
> > > > Now, if E can use V, it could send such packets to a large number
> > > > of servers. And then V gets bombed with Aborts.
> > > >
> > > > I agree fully, that an established association is safe, but that
> > > > was not the issue I was thinking about. Comments ?
> >
> > - --
> > -
> > ------------------------------------------------------------------------
> > Dipl.-Ing. Andreas Jungmaier | _
> > Computer Networking Technology Group | ASCII ribbon campaign ( )
> > University of Essen | - against HTML email X
> > http://www.exp-math.uni-essen.de/~ajung | & vcards / \
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.0.6 (GNU/Linux)
> > Comment: For info see http://www.gnupg.org
> >
> > iD8DBQE8a+eMXAsLBNOCSsARAmPfAJ47qG/Zy9+7omHnCOkbhsNR1b73QwCfZSQz
> > vIKQ3YdsJjzX46WI8XX/Qbk=
> > =g5mQ
> > -----END PGP SIGNATURE-----

- --
- ------------------------------------------------------------------------
Dipl.-Ing. Andreas Jungmaier | _
Computer Networking Technology Group | ASCII ribbon campaign ( )
University of Essen | - against HTML email X
http://www.exp-math.uni-essen.de/~ajung | & vcards / \
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.6 (GNU/Linux)
Comment: For info see http://www.gnupg.org

iD8DBQE8a+3fXAsLBNOCSsARAm4GAJ9P8xD5loz/k4p2eSHeYefJj/3uEgCfbM15
WsAQnnBB9g6F3Vsmyqqj0xI=
=TK7O
-----END PGP SIGNATURE-----

---

• [SCTP-Discussion] receive of unexpected chunks with invalid parameters, Hollaus Thomas, 02/14/2002
  • Possible DoS in SCTP ? (was: [SCTP-Discussion] receive of unexpected chunks with invalid parameters), Andreas Jungmaier, 02/14/2002
    • Re: [Tsvwg] Possible DoS in SCTP ? (was: [SCTP-Discussion] receive of unexpected chunks with invalid parameters), Randall Stewart, 02/14/2002
      • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ? (was: reception of invalid parameters), Andreas Jungmaier, 02/14/2002
        • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ? (was: reception of invalid parameters), Randall Stewart, 02/14/2002
          • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?, Andreas Jungmaier, 02/14/2002
            • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?, Randall Stewart, 02/14/2002
              • [SCTP-Discussion] Re: [Tsvwg] Possible DoS in SCTP ?, Andreas Jungmaier, 02/14/2002

---

Archive powered by MHonArc 2.6.19+.