Chronological Thread 

< Chronological >      < Thread >

---

Dear all,

if I understand DDoS attacks correcly, they use some mechanism
to generate a lot of packets by sending one. Using the SCTP
feature currently being the discussed you are generating one
packet by sending one. You can send this directly.

Best regards
Michael

Michael Tuexen Tel.: +49 89 722 47210
Siemens AG Fax: +49 89 722 48212
ICN WN CS SE 5 E-mail:
Michael.Tuexen AT icn.siemens.de

> -----Original Message-----
> From: Andreas Jungmaier
> [SMTP:ajung AT exp-math.uni-essen.de]
> Sent: Thursday, February 14, 2002 6:03 PM
> To: Randall Stewart
> Cc:
> john.loughney AT nokia.com;
>
> discussion AT sctp.de;
> Hollaus Thomas;
> tsvwg AT ietf.org
> Subject: Re: [Tsvwg] Possible DoS in SCTP ?
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi all,
> please see my comments inline.
>
> > > > Andreas:
> > > >
> > > > There is no amplification here though... so it is no
> > > > different than if Evil-E sent the aborts itself
> > > > to all the "victims" V... it must send N packets
> > > > to get N packets to victims... this is no
> > > > different than a UDP attack.. in fact a UDP attack
> > > > is easier...
> > >
> > > Well, *almost*. The only problem I see here is that many
> > > network installations by now have already adapted to UDP
> > > attacks, e.g. by filtering excessive amounts (or simply all)
> > > ICMP dest. unreachble packets (which are subsequently
> > > jamming the targets/victims network).
> > >
> > > With SCTP, however, it is not that simple: you get back
> > > a transport layer packet that is much harder to filter.
> >
> > How is SCTP harder to filter than UDP.. UDP IS a transport
> > protocol and the ports in the UDP/TCP header are in the
> > same place as the SCTP header...
>
> Yes, but the UDP does not cause the DoS -- it is the ICMP
> destination unreachable packets sent in reply to a UDP packet, that
> cause the problems.
>
> > > Think about it: there have been MANY distributed DoS attacks
> > > based on UDP, why shouldn't there be some based on SCTP some
> > > day ?
> >
> > Or TCP.. at this level though your attacker is limited
> > to the bandwidth/cpu of the Evil-E machine. This is NO
> > different than TCP or UDP or anything else out there
> > now...
>
> No, that was my point. In typical DDoS scenarios, there is
> thousands of Evil-E's, directed by one central process. This has
> been done by e.g. the Stacheldraht based DDoS attacks.
> I am not saying this is much of an issue, I am saying that
> SCTP can be used, as other protocols, for (D)DoS attacks.
>
> Best regards,
> Andreas
>
>
>
> > > BTW, John: I am not concerned about cycles for processing
> > > ABORTs. The problem really arises when an attacker starts a lot
> > > of "Evil Endpoints E", that all have one target: Victim V.
> > > The scarce resource is bandwidth.
> > >
> > > > Andreas Jungmaier wrote:
> > > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > > Hash: SHA1
> > > > >
> > > > > Dear all,
> > > > >
> > > > > I am sorry for not explaining more exactly what I meant.
> > > > > I am assuming an attack with IP-Spoofing. The evil attacker
> > > > > (say E) is spoofing poor victim (say V), using oblivious
> > > > > server (say) O.
> > > > >
> > > > > Now,
> > > > >
> > > > > Evil-Endpoint E:
> > > > > Source IP V(spoofed)
> > > > > Dest IP O
> > > > > SCTP-INIT (invalid params) ----------------> Server O
> > > > > /-------------/
> > > > > SCTP-Abort,Error /
> > > > > Poor Victim V <--------------/
> > > > >
> > > > > Now, if E can use V, it could send such packets to a large number
> > > > > of servers. And then V gets bombed with Aborts.
> > > > >
> > > > > I agree fully, that an established association is safe, but that
> > > > > was not the issue I was thinking about. Comments ?
> > >
> > > - --
> > > -
> > > ------------------------------------------------------------------------
> > > Dipl.-Ing. Andreas Jungmaier | _>
> > > Computer Networking Technology Group | ASCII ribbon campaign ( )
> > > University of Essen | - against HTML email X
> > > http://www.exp-math.uni-essen.de/~ajung | & vcards / \
> > > -----BEGIN PGP SIGNATURE-----
> > > Version: GnuPG v1.0.6 (GNU/Linux)
> > > Comment: For info see http://www.gnupg.org
> > >
> > > iD8DBQE8a+eMXAsLBNOCSsARAmPfAJ47qG/Zy9+7omHnCOkbhsNR1b73QwCfZSQz
> > > vIKQ3YdsJjzX46WI8XX/Qbk=
> > > =g5mQ
> > > -----END PGP SIGNATURE-----
>
> - --
> - ------------------------------------------------------------------------
> Dipl.-Ing. Andreas Jungmaier | _
> Computer Networking Technology Group | ASCII ribbon campaign ( )
> University of Essen | - against HTML email X
> http://www.exp-math.uni-essen.de/~ajung | & vcards / \
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
>
> iD8DBQE8a+3fXAsLBNOCSsARAm4GAJ9P8xD5loz/k4p2eSHeYefJj/3uEgCfbM15
> WsAQnnBB9g6F3Vsmyqqj0xI=
> =TK7O
> -----END PGP SIGNATURE-----
>
> _______________________________________________
> tsvwg mailing list
> tsvwg AT ietf.org
> https://www1.ietf.org/mailman/listinfo/tsvwg

---

• [SCTP-Discussion] RE: [Tsvwg] Possible DoS in SCTP ?, Tuexen Michael, 02/14/2002
  • <Possible follow-up(s)>
  • [SCTP-Discussion] RE: [Tsvwg] Possible DoS in SCTP ?, Ivan.Arias-Rodriguez, 02/14/2002

---

Archive powered by MHonArc 2.6.19+.