New method that amplifies DDoSes by 4 billion-fold. What could go wrong?

Researchers warned on Tuesday that cybercriminals who use giant floods of data to knock sites offline are using a never-before-seen method that has the potential to increase the damaging effects of those floods by an unprecedented 4 billion times.

In a distributed denial-of-service attack, junk data is sent to a third-party service in a way that causes the service to divert a larger response to the intended target. The requirements needed to overwhelm their targets are lower in so-called amplification attacks. Rather than having to find huge amounts of bandwidth and computing power, the DDoSer locates server on the Internet that will do it for them.

It’s all about amplification

One of the oldest amplification vectors is misconfigured DNS servers, which increase DDoS volumes by about 54 times. New amplification routes have included the Network Time Protocol servers (about 556x), Plex media servers (about 5x), Microsoft RDP (86x), and the Connectionless Lightweight Directory Access Protocol (at least 50x). Just last week, researchers described a new amplification vector that achieves a factor of at least 65.

Memcached has the potential to increase traffic by 51,000x.

The MiCollab and MiVoice Business Express are collaboration systems. They have been used for the past month to attack financial institutions, logistics companies, gaming companies, and organizations in other markets. In a break with manufacturer's recommendations, a fleet of 2,600 server is exposing an abusable system test facility in the software to the internet through a port that can be accessed only internally.

Advertisement The current DDoS records stand at about 3.47 terabits per second for volumetric attacks and roughly 809 million packets per second for exhaustion forms. Volumetric DDoSes work by consuming all available bandwidth either inside the targeted network or service or get between the target and the rest of the Internet. Exhaustion DDoSes, by contrast, overexert a server.

The records could be shattered by the new amplification vector provided by the misconfigured Mitel server. The 4 billion-fold amplification potential of the vector makes it possible for it to do this, as well as the fact that the Mitel systems can stretch out the attacks for longer.

The exposed system test facility can be used to launch a sustained attack of up to 14 hours in duration by means of a single spoofed attack initiation packet.

The 14-hour data flood can be delivered by a single abusable node at a rate of 80 thousand packets per second. Over the course of that time, the counter packets that track the number of responses the server send would generate nearly a hundred billion dollars of attack traffic. packets could account for an additional 2.5 terabytes of attack traffic directed toward the target.

A single packet is all it takes

The MiCollab and MiVoice Business Express services are used to transfer phone calls to the internet. There is a driver for the products. Customers can use a driver feature to test their internet networks. The tests are only available inside private networks and not on the Internet, but about 2,600 server have disobeyed the directive.

The test feature will be available inside an internal network after the software updates are released.