Printers, routers used as bots in DDoS attacks
Network-connected devices have vulnerable protocols that allow them to be easily manipulated, Prolexic says
Computerworld - Printers, routers, IP cameras, sensors and other Internet-connected devices are increasingly used to launch large distributed denial of service attacks, security firm Prolexic warned in a report this week.
Attackers are taking advantage of inherent vulnerabilities in some common network protocols used by these devices to turn them into malicious bots, Prolexic said.
The report identifies three vulnerabilities in particular that are being used in DDoS attacks: Simple Network Management Protocol (SNMP), Network Time Protocol (NTP)( and Character Generator Protocol (CHARGEN).
All three protocols are ubiquitous across the Internet and in out-of-the-box devices and system configurations, said Terrence Gareau, principal security architect for Prolexic.
SNMP is used to manage devices such as routers and printers that are connected to the Internet. The protocol is used to collect data about device performance and enables remote management.
According to Prolexic, there are several security problems with SNMP. Some versions of the protocol transmit data in human readable form and are therefore vulnerable to interception and data modification attacks. The protocol is also vulnerable to IP spoofing because the origin of transmission of an SNMP request cannot be verified. All versions of SNMP are also vulnerable to "brute force" attacks, the company said.
Attackers can take advantage of such flaws to take control of network-attached devices and use them to launch denial of service attacks, Gareau said. The flaws also allow attackers to send spoofed IP requests to an SNMP host and get it to respond with a message that is several times larger in byte size than the original request. In some cases, attackers can craft IP requests that generate close to 7.5 times more traffic than the original request, he said.
As a result, attackers can generate huge volumes of DDoS traffic with relatively small SNMP requests, Gareau said. Such attacks are considered DDoS amplification attacks because of the manner in which attack traffic is magnified and distributed to the target, he added.
Organizations that want to reduce the risk of their devices being used to launch DDoS attacks should disable SNMP if it is not needed, restrict SNMP access via access control lists, and disable read and write SNMP access unless it is absolutely needed, Prolexic said in its report. Companies should also consider stronger authentication measures to control access to SNMP devices.
Similarly, problems with the Network Time Protocol can result in systems that are co-opted into a DDoS attack, the company said. NTP is used to synchronize network clocks and for timestamp messages. As with SNMP, attackers can launch multiple requests for NTP updates from multiple hosts and direct all the responses to a target computer.
Meanwhile, vulnerabilities in the CHARGEN protocol, which is found in remote debugging and measurement tools, allows attackers to craft malicious packets and have them directed to a target. Companies that use this protocol should review its use and eliminate it if it isn't needed, according to Prolexic.
The Prolexic report is the second in recent days to highlight the security dangers posted to organizations from legacy technologies. Earlier this month security firm Rapid7 released a report on how thousands of older systems, including those used to manage critical industrial control equipment, traffic lights, fuel pumps, retail point-of-sale terminals and building automation, are vulnerable to tampering because they're insecurely connected to the Internet via terminal servers.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at @jaivijayan or subscribe to Jaikumar's RSS feed . His e-mail address is email@example.com.
Read more about Malware and Vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The Threat Landscape Hardly a day goes by without the discovery of a new cyberthreat somewhere in the world! But how do you keep up with...
- Security for Virtualization In the rush to implement virtualization, security has become second. So while the business benefits are clear, the risks are less well documented...
- Is Your Big Data Solution Production-Ready? Read "Is Your Big Data Solution Production-Ready?" now, and discover best practices and actionable steps to implementing a production-ready big data solution.
- Pay-as-you-Grow Data Protection: IBM Tivoli's Full-featured Data Protection Suite for Small to Medium Businesses IBM Tivoli Storage Manager Suite for Unified Recovery gives small and medium businesses the opportunity to start out with only the individual solutions...
- Webinar: Building a Big Data solution that's production-ready Big data solutions are no longer just a nice-to-have.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well... All Malware and Vulnerabilities White Papers | Webcasts