Distributed Reflection Denial-of-Service

A distributed reflection DoS (DRDoS) attack, also known as a “spoofed” attack, involves the use of multiple intermediary and secondary machines that contribute to a DDoS attack against a target machine or application

• A DRDoS attack exploits the TCP three-way handshake vulnerability
• This attack involves an attacker machine, intermediary victims (zombies), secondary victims (reflectors), and a target machine
• The attacker launches this attack by sending requests to the intermediary hosts, which in turn reflect the attack traffic to the target
• The process of a DRDoS attack is as follows
  • First, the attacker commands the intermediary victims (zombies) to send a stream of packets (TCP SYN) with the primary target’s IP address as the source IP address to other non-compromised machines (secondary victims or reflectors) in order to exhort them to establish a connection with the primary target
  • Consequently, the reflectors send a huge volume of traffic (SYN/ACK) to the primary target to establish a new connection with it because they believe the host requested it
  • The primary target discards the SYN/ACK packets received from the reflectors because they did not send the SYN packet
  • Meanwhile, the reflectors wait for the ACK response from the primary target
  • Assuming that the packet was lost, the reflector machines resend SYN/ACK packets to the primary target to establish the connection, until a time-out occurs
  • In this manner, the target machine is flooded with a heavy volume of traffic from the reflector machines
  • The combined bandwidth of these reflector machines overwhelms the target machine

• Instead of the actual attacker, the secondary victims (reflectors) seem to attack the primary target directly
• This attack is more effective than a typical DDoS attack because multiple intermediary and secondary victims generate huge attack bandwidth.

The Distributed Reflection Denial-of-Service (DRDoS) Attack, also known as a spoofed attack, is a sophisticated type of Distributed Denial-of-Service (DDoS) attack.

Mechanism of a DRDoS Attack

DRDoS attacks involve the use of multiple intermediary and secondary machines to contribute to the actual attack against the target machine or application. This method exploits network vulnerabilities to redirect traffic from numerous sources to the victim.

1. Attack Initiation and Spoofing: The attack begins when the attacker commands compromised systems (known as intermediary victims or zombies) to send a stream of request packets (such as TCP SYN packets). Crucially, these packets are sent with the primary target's IP address spoofed as the source IP address.
2. Reflection: These requests are directed toward non-compromised machines, known as secondary victims or reflectors.
3. Target Flooding: Because the requests appear to originate from the primary target, the reflectors send a huge volume of traffic (such as SYN/ACK packets) back to the primary target to try and establish a connection.
4. Resource Exhaustion: The target machine, not having initiated the connection, discards the SYN/ACK packets. Meanwhile, the reflector machines continue to resend SYN/ACK packets, assuming the initial response was lost, until a time-out occurs. The combined bandwidth of the reflector machines overwhelms the target machine, leading to a denial-of-service condition.

This type of attack leverages the TCP three-way handshake vulnerability.

Key Characteristics and Advantages

• Difficult Traceability: A DRDoS attack is an intelligent attack because it is very difficult or even impossible to trace the attacker. Instead of the actual attacker, the secondary victims (reflectors) appear to be directly attacking the primary target.
• Increased Attack Bandwidth: The attack is highly effective because using multiple intermediary and secondary victims generates a huge attack bandwidth directed at the target.
• Classification: DRDoS is classified under the general category of DoS/DDoS Attack Techniques.

Countermeasures for DRDoS Attacks

Countermeasures necessary to protect against DRDoS attacks include:

• Service Configuration: Turn off the Character Generator Protocol (CHARGEN) service to stop this attack method.
• System Updates: Download the latest updates and patches for servers.
• IP Filtering: Implement countermeasures such as Ingress Filtering, which prevents the source address spoofing of Internet traffic, making it traceable to its true source, and protecting against flooding attacks.
• TCP Intercept: Use the TCP intercept feature in routers to protect TCP servers from TCP SYN-flooding attacks, which share a similar mechanism to the spoofing used in DRDoS.