This is the code repository for the USENIX Security 2021 paper, "Weaponizing Middleboxes for TCP Reflected Amplification".

Overview

weaponizing-censors badge

Censors pose a threat to the entire Internet. In this work, we show that censoring middleboxes and firewalls can be weaponized by attackers to launch unprecedented reflected denial of service attacks. We find hundreds of thousands of IP addresses that offer amplification factors greater than 100× and IP addresses that technically offer infinite amplification.

This is the code repository for the USENIX Security 2021 paper, "Weaponizing Middleboxes for TCP Reflected Amplification".

This repository contains submodules for our two forks of ZMap, a submodule to the main Geneva repository containing the plugin used to identify the amplifying sequences, and processing scripts for analyzing scan results.

Amplification attacks are not the only way that censors pose a threat to those living outside their borders. See our concurrent work from WOOT 2021 on weaponizing censors for availability attacks and its repository.

📝 Abstract

Reflective amplification attacks are a powerful tool in the arsenal of a DDoS attacker, but to date have almost exclusively targeted UDP-based protocols. In this paper, we demonstrate that non-trivial TCP-based amplification is possible and can be orders of magnitude more effective than well-known UDP-based amplification. By taking advantage of TCP-non-compliance in network middleboxes, we show that attackers can induce middleboxes to respond and amplify network traffic. With the novel application of a recent genetic algorithm, we discover and maximize the efficacy of new TCP-based reflective amplification attacks, and present several packet sequences that cause network middleboxes to respond with substantially more packets than we send.

We scanned the entire IPv4 Internet to measure how many IP addresses permit reflected amplification. We find hundreds of thousands of IP addresses that offer amplification factors greater than 100×. Through our Internet-wide measurements, we explore several open questions regarding DoS attacks, including the root cause of so-called "mega amplifiers". We also report on network phenomena that causes some of the TCP-based attacks to be so effective as to technically have infinite amplification factor (after the attacker sends a constant number of bytes, the reflector generates traffic indefinitely).

đŸ•ĩī¸â€â™€ī¸ Finding Amplifiers: ZMap Forks

We scanned the entire IPv4 Internet dozens of times to find IP addresses with middleboxes on their path that could be weaponized. To find these, we created two custom forks of the open-source scanning tool ZMap. ZMap is a fast single packet network scanner designed for Internet-wide network surveys. We modified ZMap first to add a new probe module (the forbidden_scan module defined in src/probe_modules/module_forbidden_scan.c), and then created a second fork to add the ability to craft two distinct packets for each probe (this enables us to send a custom SYN packet, followed by a second custom packet containing a well-formed HTTP GET request).

The submodule zmap in this repository is for single packet scans (the SYN, PSH, or PSH+ACK scans from our paper) and zmap_multiple_probes (for the SYN; PSH or SYN; PSH+ACK scans from our paper).

The module has multiple options compiled in, including the Host: header included in the payload. To change any of the following options, edit the module_forbidden_scan.c file located in src/probe_modules and recompile ZMap to use.

🏃 Running ZMap

Example on how to build zmap and run the forbidden_scan module to scan a single IP address and record the responses received:

$ IP=
$ cmake . && make -j4  && sudo src/zmap -M forbidden_scan -p 80 $IP/32 -f "saddr,len,payloadlen,flags,validation_type" -o scan.csv -O csv 

The output of the scan is a csv file called scan.csv. For each packet that ZMap identified as a response to our scan, the output file will contain the src IP address, the IP length of the packet, the length of the payload itself, the TCP flags, and the validation_type (the reason the probe treated the incoming packet as a response to a probe).

This module can be used to test firewalls or other middleboxes to see if they are vulnerable to this attack.

Also in this repsitory is a helper script scan_all.py, which can be used to automate multiple ZMap scans with different scanning parameters.

đŸ”Ŧ Processing Scan Results

Included in this repository are two helper scripts to process the results of a ZMap scan. The main processing script is stats.py, which will consume the output of ZMap and generate graphs and summary statistics about the scan. See the below example of the stats.py script processing a scan.csv file (note the IP addresses have been anonymized).

# python3 stats.py scan.csv 149
Processing scan data assuming attacker sent 149 bytes per IP.
Initializing analysis of scan.csv
Calculating total length of file to analyze:
949099449 total packets to analyze.
  - Unique responding IPs: 362138621
  - Number of amplifying IP addresses: 218015761
  - Total number of bytes sent by amplifying IP addresses: 45695690843
  - Average amplification rate from amplifying IP addresses: 1.407000
  - Highest total data received by IP:
        7632101 96.96.96.96 141334
        9788625 97.97.97.97 181270
        44365380 98.98.98.98 142200
        238162104 99.99.99.99 1011556
  - Highest total packets received by IP:
        7360299 1.1.1.1 136301
        8040711 2.2.2.2 148901
        8186133 3.3.3.3 151594
        238162104 4.4.4.4 1011556
  - Flags on packets sent by responders:
    + 472: S
    + 119609984: R
    + 680892582: RA
    + 12: FSPA
    + 1: SPUE
    + 2: PAU
    + 1: SUEC
    + 1: FAU
    + 1: PAUE
    + 1: SRPAUEC
    + 7217: FRPA
    + 4734607: FA
    + 5540525: RPA
    + 3687478: PA
    + 58615499: SA
    + 11928812: FPA
    ...
  - CDF of number of packets sent: scan_packets_cdf.eps
  - CDF of bytes sent: scan_bytes_cdf.eps
  - CDF of amplification rate: scan_amplification_cdf.eps

📃 License

This repository is licensed under BSD 3-Clause license. Please note that this repository contains multiple submodule pointers to other repositories, each of which contains its own license. Please consult each for license information.

📑 Citation

To cite this paper, please use the Bibtex here.

Owner
UMD Breakerspace
UMD Breakerspace
Multi-path load balancing is a method used by most of the real-time network to split the packets into different paths rather than transferring it through a single path

Multipath-Load-Balancing Method of managing incoming traffic by distributing and sharing load fairly among multiple routes from source to destination

Dharshan Kumar 6 Dec 10, 2022
EUserv - A Python script which can help you renew your free EUserv IPv6 VPS

English | įŽ€äŊ“中文 This project comes from https://github.com/a-beam-of-light/eu_ex

é˜ŋ两 0 Jan 06, 2022
EchoDNS - Analyze your DNS traffic super easy, shows all requested DNS traffic

EchoDNS - Analyze your DNS traffic super easy, shows all requested DNS traffic

Oli Zimmermann 1 Jan 11, 2022
PoC code for stealing the WiFi password of a network with a Lovebox IOT device connected

LoveBoxer PoC code for stealing the WiFi password of a network with a Lovebox IOT device connected. This PoC was is what I used in this blogpost Usage

Graham Helton 10 May 24, 2022
Network-Shredder is a python based NIDS.

Network-Shredder is a python based NIDS.

Oussama RAHALI 9 Dec 13, 2022
BlueHawk is an HTTP/1.1 compliant web server developed in python

This project is done as a part of Computer Networks course. It aims at the implementation of the HTTP/1.1 Protocol based on RFC 2616 and includes the basic HTTP methods of GET, POST, PUT, DELETE and

2 Nov 11, 2022
This is a simple python code to get the list of banned IP addresses from Fail2ban

Fail2ban Scripts Usage banned_list.py This script tries to get the banned list of IP addresses by Fail2ban for the service freeswitch. You can modify

Yehor Smoliakov 9 Dec 28, 2022
A protocol or procedure that connects an ever-changing IP address to a fixed physical machine address

p0znMITM ARP Poisoning Tool What is ARP? Address Resolution Protocol (ARP) is a protocol or procedure that connects an ever-changing IP address to a f

Furkan OZKAN 9 Sep 18, 2022
Python module to interface with Tuya WiFi smart devices

TinyTuya Python module to interface with Tuya WiFi smart devices Description This python module controls and monitors Tuya compatible WiFi Smart Devic

Jason Cox 365 Dec 26, 2022
Very simple and tiny file sharing service written in python

Simple File sharing tool Sharing client usage (You will need to use python3 for linux) main.py --send -f file/path Optionnal flags : pwd : set a passw

2 Jul 26, 2022
SonicWall SSL-VPN Exploit

VisualDoor SonicWall SSL-VPN Exploit, as used by Phineas Fisher to hack Cayman Trust Bank and Hacking Team.

169 Nov 15, 2022
Tool for quickly gathering information from Shodan.io about the number of IPs which satisfy large number of different queries

TriOp Tool for quickly gathering information from Shodan.io about the number of IPs which satisfy large number of different queries For furt

Jan Kopriva 27 Nov 03, 2022
Lightweight asyncio compatible utilities for consuming broker messages.

A simple asyncio compatible consumer for handling amqp messages.

Mehdi Kamani 3 Apr 10, 2022
Network Dynaimcs Simulation

A Final Year Project in CUHK, Autumn 2021 Network Dynaimcs Simulation Files param.h edit all the variables & settings here simulate.c the main program

Likchun 0 Mar 28, 2022
Utility for converting IP Fabric webhooks into a Teams format.

IP Fabric Webhook Integration for Microsoft Teams and/or Slack Setup IP Fabric Setup Go to Settings Webhooks Add webhook Provide a name URL will b

Community Fabric 1 Jan 26, 2022
This is the code repository for Mastering Python for Networking and Security – Second Edition

Mastering Python for Networking and Security – Second Edition This is the code repository for Mastering Python for Networking and Security – Second Ed

Frank Gottinger 1 Feb 09, 2022
IP Rover - An Excellent OSINT tool to get information of any ip address

IP Rover - An Excellent OSINT tool to get information of any ip address. All details are explained in below screenshot

Saad 20 Dec 16, 2022
Fmog: Fortinet Mass Object Generator. This script will take a list of IP addresses and create address objects with the same name

Fmog: Fortinet Mass Object Generator This script will take a list of IP addresses and create address objects with the same name. It will also add them

2 Oct 26, 2021
IP-Escaner - A Python Tool to obtain information from an IP address

IP-Escaner Herramienta para obtener informacion de una direccion IP Opciones de

4 Apr 09, 2022
nettrace is a powerful tool to trace network packet and diagnose network problem inside kernel.

nettrace nettrace is is a powerful tool to trace network packet and diagnose network problem inside kernel on TencentOS. It make use of eBPF and BCC.

84 Jan 01, 2023