Some sources not usually thought of as attackers, but printers, routers, IP cameras, sensors and other Internet-connected devices are now launching large distributed denial of service attacks (DDoS), a new report said.
Attackers are taking advantage of inherent vulnerabilities in some common network protocols used by these devices to turn them into malicious bots, security firm Prolexic said in a report.
The report identifies three vulnerabilities in particular seeing use in DDoS attacks: Simple Network Management Protocol (SNMP), Network Time Protocol (NTP) and Character Generator Protocol (CHARGEN).
All three protocols are ubiquitous across the Internet and in out-of-the-box devices and system configurations, said Terrence Gareau, principal security architect for Prolexic.
SNMP manages devices such as routers and printers connected to the Internet. The protocol is able to collect data about device performance and enables remote management.
There are several security problems with SNMP, Prolexic researchers said. Some versions of the protocol transmit data in human readable form and are therefore vulnerable to interception and data modification attacks. The protocol is also vulnerable to IP spoofing because the origin of transmission of an SNMP request cannot undergo verification. All versions of SNMP are also vulnerable to “brute force” attacks, the company said.
Attackers can take advantage of such flaws to take control of network-attached devices and use them to launch denial of service attacks, Gareau said. The flaws also allow attackers to send spoofed IP requests to an SNMP host and get it to respond with a message that is several times larger in byte size than the original request. In some cases, attackers can craft IP requests that generate close to 7.5 times more traffic than the original request, he said.
As a result, attackers can generate huge volumes of DDoS traffic with relatively small SNMP requests, Gareau said. Such attacks are DDoS amplification attacks because of the manner in which attack traffic ends up magnified and distributed to the target, he said.
Organizations that want to reduce the risk of their devices to launch DDoS attacks should disable SNMP if they do not need it, restrict SNMP access via access control lists, and disable read and write SNMP access unless they absolutely need it, Prolexic said in its report. Companies should also consider stronger authentication measures to control access to SNMP devices.
Similarly, problems with the Network Time Protocol can result in systems co-opted into a DDoS attack, the company said. NTP synchronizes network clocks and for timestamp messages. As with SNMP, attackers can launch multiple requests for NTP updates from multiple hosts and direct all the responses to a target computer.
Meanwhile, vulnerabilities in the CHARGEN protocol, which is in remote debugging and measurement tools, allows attackers to craft malicious packets and have them directed to a target. Companies that use this protocol should review its use and eliminate it if they do not need it, Prolexic said in the report.