Chronological Thread 

< Chronological >      < Thread >

---

Hi all,

This is TCP specific, but it is a very interesting lecture about DoS
attacks... Check this out if you are interested:

http://grc.com/dos/grcdos.htm

I had to read it until the end when I started. Maybe because I didn't
really know that much about DoS attacks... :-)

Enjoy!

BR Iván Arias Rodríguez

> -----Original Message-----
> From: ext Tuexen Michael
> [mailto:Michael.Tuexen AT icn.siemens.de]
> Sent: 14. February 2002 18:10
> To: 'Andreas Jungmaier'; Randall Stewart
> Cc: Loughney John (NRC/Helsinki);
> discussion AT sctp.de;
> Hollaus Thomas;
> tsvwg AT ietf.org
> Subject: RE: [Tsvwg] Possible DoS in SCTP ?
>
>
> Dear all,
>
> if I understand DDoS attacks correcly, they use some mechanism
> to generate a lot of packets by sending one. Using the SCTP
> feature currently being the discussed you are generating one
> packet by sending one. You can send this directly.
>
> Best regards
> Michael
>
> Michael Tuexen Tel.: +49 89 722 47210
> Siemens AG Fax: +49 89 722 48212
> ICN WN CS SE 5 E-mail:
> Michael.Tuexen AT icn.siemens.de
>
> > -----Original Message-----
> > From: Andreas Jungmaier
> > [SMTP:ajung AT exp-math.uni-essen.de]
> > Sent: Thursday, February 14, 2002 6:03 PM
> > To: Randall Stewart
> > Cc:
> > john.loughney AT nokia.com;
> >
> > discussion AT sctp.de;
> > Hollaus
> Thomas;
> tsvwg AT ietf.org
> > Subject: Re: [Tsvwg] Possible DoS in SCTP ?
> >
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > Hi all,
> > please see my comments inline.
> >
> > > > > Andreas:
> > > > >
> > > > > There is no amplification here though... so it is no
> > > > > different than if Evil-E sent the aborts itself
> > > > > to all the "victims" V... it must send N packets
> > > > > to get N packets to victims... this is no
> > > > > different than a UDP attack.. in fact a UDP attack
> > > > > is easier...
> > > >
> > > > Well, *almost*. The only problem I see here is that many
> > > > network installations by now have already adapted to UDP
> > > > attacks, e.g. by filtering excessive amounts (or simply all)
> > > > ICMP dest. unreachble packets (which are subsequently
> > > > jamming the targets/victims network).
> > > >
> > > > With SCTP, however, it is not that simple: you get back
> > > > a transport layer packet that is much harder to filter.
> > >
> > > How is SCTP harder to filter than UDP.. UDP IS a transport
> > > protocol and the ports in the UDP/TCP header are in the
> > > same place as the SCTP header...
> >
> > Yes, but the UDP does not cause the DoS -- it is the ICMP
> > destination unreachable packets sent in reply to a UDP packet, that
> > cause the problems.
> >
> > > > Think about it: there have been MANY distributed DoS attacks
> > > > based on UDP, why shouldn't there be some based on SCTP some
> > > > day ?
> > >
> > > Or TCP.. at this level though your attacker is limited
> > > to the bandwidth/cpu of the Evil-E machine. This is NO
> > > different than TCP or UDP or anything else out there
> > > now...
> >
> > No, that was my point. In typical DDoS scenarios, there is
> > thousands of Evil-E's, directed by one central process. This has
> > been done by e.g. the Stacheldraht based DDoS attacks.
> > I am not saying this is much of an issue, I am saying that
> > SCTP can be used, as other protocols, for (D)DoS attacks.
> >
> > Best regards,
> > Andreas
> >
> >
> >
> > > > BTW, John: I am not concerned about cycles for processing
> > > > ABORTs. The problem really arises when an attacker starts a lot
> > > > of "Evil Endpoints E", that all have one target: Victim V.
> > > > The scarce resource is bandwidth.
> > > >
> > > > > Andreas Jungmaier wrote:
> > > > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > > > Hash: SHA1
> > > > > >
> > > > > > Dear all,
> > > > > >
> > > > > > I am sorry for not explaining more exactly what I meant.
> > > > > > I am assuming an attack with IP-Spoofing. The evil attacker
> > > > > > (say E) is spoofing poor victim (say V), using oblivious
> > > > > > server (say) O.
> > > > > >
> > > > > > Now,
> > > > > >
> > > > > > Evil-Endpoint E:
> > > > > > Source IP V(spoofed)
> > > > > > Dest IP O
> > > > > > SCTP-INIT (invalid params) ----------------> Server O
> > > > > > /-------------/
> > > > > > SCTP-Abort,Error /
> > > > > > Poor Victim V <--------------/
> > > > > >
> > > > > > Now, if E can use V, it could send such packets to
> a large number
> > > > > > of servers. And then V gets bombed with Aborts.
> > > > > >
> > > > > > I agree fully, that an established association is
> safe, but that
> > > > > > was not the issue I was thinking about. Comments ?
> > > >
> > > > - --
> > > > -
> > > >
> --------------------------------------------------------------
> ----------
> > > > Dipl.-Ing. Andreas Jungmaier |
> _>
> > > > Computer Networking Technology Group | ASCII
> ribbon campaign ( )
> > > > University of Essen | - against
> HTML email X
> > > > http://www.exp-math.uni-essen.de/~ajung |
> & vcards / \
> > > > -----BEGIN PGP SIGNATURE-----
> > > > Version: GnuPG v1.0.6 (GNU/Linux)
> > > > Comment: For info see http://www.gnupg.org
> > > >
> > > > iD8DBQE8a+eMXAsLBNOCSsARAmPfAJ47qG/Zy9+7omHnCOkbhsNR1b73QwCfZSQz
> > > > vIKQ3YdsJjzX46WI8XX/Qbk=
> > > > =g5mQ
> > > > -----END PGP SIGNATURE-----
> >
> > - --
> > -
> --------------------------------------------------------------
> ----------
> > Dipl.-Ing. Andreas Jungmaier |
> _
> > Computer Networking Technology Group | ASCII ribbon
> campaign ( )
> > University of Essen | - against HTML
> email X
> > http://www.exp-math.uni-essen.de/~ajung | &
> vcards / \
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v1.0.6 (GNU/Linux)
> > Comment: For info see http://www.gnupg.org
> >
> > iD8DBQE8a+3fXAsLBNOCSsARAm4GAJ9P8xD5loz/k4p2eSHeYefJj/3uEgCfbM15
> > WsAQnnBB9g6F3Vsmyqqj0xI=
> > =TK7O
> > -----END PGP SIGNATURE-----
> >
> > _______________________________________________
> > tsvwg mailing list
> > tsvwg AT ietf.org
> > https://www1.ietf.org/mailman/listinfo/tsvwg
>
> _______________________________________________
> tsvwg mailing list
> tsvwg AT ietf.org
> https://www1.ietf.org/mailman/listinfo/tsvwg
>

---

• [SCTP-Discussion] RE: [Tsvwg] Possible DoS in SCTP ?, Tuexen Michael, 02/14/2002
  • <Possible follow-up(s)>
  • [SCTP-Discussion] RE: [Tsvwg] Possible DoS in SCTP ?, Ivan.Arias-Rodriguez, 02/14/2002

---

Archive powered by MHonArc 2.6.19+.