Printers, routers used as bots in DDoS attacks
Network-connected devices have vulnerable protocols that allow them to be easily manipulated, Prolexic says
Computerworld - Printers, routers, IP cameras, sensors and other Internet-connected devices are increasingly used to launch large distributed denial of service attacks, security firm Prolexic warned in a report this week.
Attackers are taking advantage of inherent vulnerabilities in some common network protocols used by these devices to turn them into malicious bots, Prolexic said.
The report identifies three vulnerabilities in particular that are being used in DDoS attacks: Simple Network Management Protocol (SNMP), Network Time Protocol (NTP)( and Character Generator Protocol (CHARGEN).
All three protocols are ubiquitous across the Internet and in out-of-the-box devices and system configurations, said Terrence Gareau, principal security architect for Prolexic.
SNMP is used to manage devices such as routers and printers that are connected to the Internet. The protocol is used to collect data about device performance and enables remote management.
According to Prolexic, there are several security problems with SNMP. Some versions of the protocol transmit data in human readable form and are therefore vulnerable to interception and data modification attacks. The protocol is also vulnerable to IP spoofing because the origin of transmission of an SNMP request cannot be verified. All versions of SNMP are also vulnerable to "brute force" attacks, the company said.
Attackers can take advantage of such flaws to take control of network-attached devices and use them to launch denial of service attacks, Gareau said. The flaws also allow attackers to send spoofed IP requests to an SNMP host and get it to respond with a message that is several times larger in byte size than the original request. In some cases, attackers can craft IP requests that generate close to 7.5 times more traffic than the original request, he said.
As a result, attackers can generate huge volumes of DDoS traffic with relatively small SNMP requests, Gareau said. Such attacks are considered DDoS amplification attacks because of the manner in which attack traffic is magnified and distributed to the target, he added.
Organizations that want to reduce the risk of their devices being used to launch DDoS attacks should disable SNMP if it is not needed, restrict SNMP access via access control lists, and disable read and write SNMP access unless it is absolutely needed, Prolexic said in its report. Companies should also consider stronger authentication measures to control access to SNMP devices.
Similarly, problems with the Network Time Protocol can result in systems that are co-opted into a DDoS attack, the company said. NTP is used to synchronize network clocks and for timestamp messages. As with SNMP, attackers can launch multiple requests for NTP updates from multiple hosts and direct all the responses to a target computer.
Meanwhile, vulnerabilities in the CHARGEN protocol, which is found in remote debugging and measurement tools, allows attackers to craft malicious packets and have them directed to a target. Companies that use this protocol should review its use and eliminate it if it isn't needed, according to Prolexic.
The Prolexic report is the second in recent days to highlight the security dangers posted to organizations from legacy technologies. Earlier this month security firm Rapid7 released a report on how thousands of older systems, including those used to manage critical industrial control equipment, traffic lights, fuel pumps, retail point-of-sale terminals and building automation, are vulnerable to tampering because they're insecurely connected to the Internet via terminal servers.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- Fight Malware, Malfeasance and Malingering Every year brings more extreme sets of threats than the last. The good news is that there are a range of mitigation options....
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts