TCP-AMP DDoS Attack - Fake abuse reports problem
A very old attack method called TCP-AMP ( https://pastebin.com/jYhWdgHn [https://pastebin.com/jYhWdgHn] ) has been getting really popular recently. I've been a victim of it multiple times on many of my IP's and every time it happens - My IP's end up getting blacklisted in major big databases. We also receive tons of abuse reports for "Port Scanning". Example of the reports we're getting: tcp: 51.81.XX.XX:19342 -> 209.208.XX.XX:80 (SYN_RECV) tcp: 51.81.XX.XX:14066 -> 209.208.XX.XX:80 (SYN_RECV) OVH are threatening to kick us off their network, because we are victims of this attack. And requesting us to do something about it, despite the fact that there is nothing you can do when you are being victim of an DDoS Attack. Anyone else had any problems with these kind of attacks? The attack basically works like this; - The attacker scans the internet for TCP Services, i.e port 80. - The attacker then sends spoofed requests from our IP to these TCP Services, which makes the remote service attempt to connect to us to initiate the handshake.. This clearly fails. ... Which ends up with hundreds of request to these services, reporting us for "port flood".
Peace, On Fri, Feb 21, 2020, 1:18 AM Octolus Development <admin@octolus.net> wrote:
OVH are threatening to kick us off their network, because we are victims of this attack.
Most of the hosting companies will do that to you because you're causing degradation of service quality for other customers. Especially the lowcosters which even cut the costs of processing the abuse, and OVH is the world-renowned cost cutter. Look out for data centers with appropriate DDoS countermeasures. Those won't be cheap though. -- Töma
Hello, Since OVH has been offering DDOS protection capable of soaking up hundreds of gigabits+ per second as a standard with all their services for a long time, I'm assuming this is a miscommunication / standard support response. I would try to get in touch with the network team and include pcaps. Filip On 2/20/20 11:37 PM, Töma Gavrichenkov wrote:
Peace,
On Fri, Feb 21, 2020, 1:18 AM Octolus Development <admin@octolus.net <mailto:admin@octolus.net>> wrote:
OVH are threatening to kick us off their network, because we are victims of this attack.
Most of the hosting companies will do that to you because you're causing degradation of service quality for other customers. Especially the lowcosters which even cut the costs of processing the abuse, and OVH is the world-renowned cost cutter.
Look out for data centers with appropriate DDoS countermeasures. Those won't be cheap though.
-- Töma
Peace, On Fri, Feb 21, 2020, 1:57 AM Filip Hruska <fhr@fhrnet.eu> wrote:
[..] OVH has been offering DDOS protection capable of soaking up hundreds of gigabits+ per second as a standard with all their services for a long time
They only do it for common trivial vectors like UDP-based amplification — and other types easily handleable through flowspec. Which is honestly not their fault because they try to keep their costs down. (Other means to keep the costs down may be of concern of Ronald G. though, but that's a different story.) However, TCP amplification is not of that sort. -- Töma
It doesn't sound to be a real amplification.. If it is, can anyone provide the amplification factor? 1x? It sounds more like a TCP spoofing. Jean On 2020-02-20 18:22, Töma Gavrichenkov wrote:
Peace,
On Fri, Feb 21, 2020, 1:57 AM Filip Hruska <fhr@fhrnet.eu <mailto:fhr@fhrnet.eu>> wrote:
[..] OVH has been offering DDOS protection capable of soaking up hundreds of gigabits+ per second as a standard with all their services for a long time
They only do it for common trivial vectors like UDP-based amplification — and other types easily handleable through flowspec.
Which is honestly not their fault because they try to keep their costs down. (Other means to keep the costs down may be of concern of Ronald G. though, but that's a different story.)
However, TCP amplification is not of that sort.
-- Töma
On Thu, Feb 20, 2020 at 3:40 PM Jean | ddostest.me via NANOG < nanog@nanog.org> wrote:
It doesn't sound to be a real amplification.. If it is, can anyone provide the amplification factor? 1x?
It sounds more like a TCP spoofing.
Some reading for you: https://www.usenix.org/conference/woot14/workshop-program/presentation/kuhre... Damian
It is spoofing, but it is also absolutely amplification. Look at the preso that Damien linked : https://www.usenix.org/conference/woot14/workshop-program/presentation/kuhre... Hope that this doesn't become one of the 'services' that you provide! :) On Thu, Feb 20, 2020 at 6:40 PM Jean | ddostest.me via NANOG < nanog@nanog.org> wrote:
It doesn't sound to be a real amplification.. If it is, can anyone provide the amplification factor? 1x?
It sounds more like a TCP spoofing.
Jean On 2020-02-20 18:22, Töma Gavrichenkov wrote:
Peace,
On Fri, Feb 21, 2020, 1:57 AM Filip Hruska <fhr@fhrnet.eu> wrote:
[..] OVH has been offering DDOS protection capable of soaking up hundreds of gigabits+ per second as a standard with all their services for a long time
They only do it for common trivial vectors like UDP-based amplification — and other types easily handleable through flowspec.
Which is honestly not their fault because they try to keep their costs down. (Other means to keep the costs down may be of concern of Ronald G. though, but that's a different story.)
However, TCP amplification is not of that sort.
-- Töma
I thought you said this on your blog? https://blog.octovpn.com/the-ddos-that-bans-you/ [https://blog.octovpn.com/the-ddos-that-bans-you/] "We are the first VPN on the market to come up with a solution for this, and that's why we are who we are. We're keeping our method completely private for now." Did the method stop working? What was the method? Since you are reselling OVH, you should ask them to block syn-ack spam. it should be trivial for them to block. I would be surprised if it wasn't automatically detected already. Short of bribing Sony, I don't see how you can stop random honey pots from banning spoofed ips. There's no technical solution for that.
If I read your description correctly: - Attacker sends spoofed TCP SYN from your IP address(es) and different src ports, to some TCP servers (e.g. port 80) - TCP servers respond with SYN/ACK ; many servers resend the SYN/ACK hence amplification . - *** your system does not respond *** - Servers may think you're doing SYN-Flood against them, since connection remains in SYN_RCVD, and hence complain. In fact, we don't really know what is the goal of the attackers; they may in fact be trying to do SYN-Flood against these servers, and you're just a secondary victim and not the even the target, that's also possible. Anyway, is this the case? If it is... may I ask, do you (or why don't you) respond to the unsolicited SYN/ACK with RST as per the RFC? I suspect you don't, maybe due to these packets being dropped by FW/NAT, that's quite common. But as you should understand by now from my text, this (non-standard) behavior is NOT recommended. The problem may disappear if you reconfigure your FW/NAT (or host) to respond with RST to unsolicited SYN/ACK. As I explained above, if my conjectures are true, then OVH as well as the remote servers may have a valid reason to consider you either as the attacker or as an (unknowning, perhaps) accomplice. I may be wrong - sorry if so - and would appreciate, in any case, if you can confirm or clarify, thanks. -- Amir Herzberg Comcast professor of Security Innovations, University of Connecticut Homepage: https://sites.google.com/site/amirherzberg/home Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security On Thu, Feb 20, 2020 at 5:23 PM Octolus Development <admin@octolus.net> wrote:
A very old attack method called TCP-AMP ( https://pastebin.com/jYhWdgHn ) has been getting really popular recently.
I've been a victim of it multiple times on many of my IP's and every time it happens - My IP's end up getting blacklisted in major big databases. We also receive tons of abuse reports for "Port Scanning".
Example of the reports we're getting: tcp: 51.81.XX.XX:19342 -> 209.208.XX.XX:80 (SYN_RECV) tcp: 51.81.XX.XX:14066 -> 209.208.XX.XX:80 (SYN_RECV)
OVH are threatening to kick us off their network, because we are victims of this attack. And requesting us to do something about it, despite the fact that there is nothing you can do when you are being victim of an DDoS Attack.
Anyone else had any problems with these kind of attacks?
The attack basically works like this; - The attacker scans the internet for TCP Services, i.e port 80. - The attacker then sends spoofed requests from our IP to these TCP Services, which makes the remote service attempt to connect to us to initiate the handshake.. This clearly fails. ... Which ends up with hundreds of request to these services, reporting us for "port flood".
Amir: you're exactly correct -- but since you asked, here's their answer from the last time I suggested they respond with RSTs: https://seclists.org/nanog/2020/Jan/612 Damian On Thu, Feb 20, 2020 at 5:36 PM Amir Herzberg <amir.lists@gmail.com> wrote:
If I read your description correctly:
- Attacker sends spoofed TCP SYN from your IP address(es) and different src ports, to some TCP servers (e.g. port 80) - TCP servers respond with SYN/ACK ; many servers resend the SYN/ACK hence amplification . - *** your system does not respond *** - Servers may think you're doing SYN-Flood against them, since connection remains in SYN_RCVD, and hence complain. In fact, we don't really know what is the goal of the attackers; they may in fact be trying to do SYN-Flood against these servers, and you're just a secondary victim and not the even the target, that's also possible.
Anyway, is this the case?
If it is... may I ask, do you (or why don't you) respond to the unsolicited SYN/ACK with RST as per the RFC?
I suspect you don't, maybe due to these packets being dropped by FW/NAT, that's quite common. But as you should understand by now from my text, this (non-standard) behavior is NOT recommended. The problem may disappear if you reconfigure your FW/NAT (or host) to respond with RST to unsolicited SYN/ACK.
As I explained above, if my conjectures are true, then OVH as well as the remote servers may have a valid reason to consider you either as the attacker or as an (unknowning, perhaps) accomplice.
I may be wrong - sorry if so - and would appreciate, in any case, if you can confirm or clarify, thanks.
-- Amir Herzberg
Comcast professor of Security Innovations, University of Connecticut
Homepage: https://sites.google.com/site/amirherzberg/home
Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security
On Thu, Feb 20, 2020 at 5:23 PM Octolus Development <admin@octolus.net> wrote:
A very old attack method called TCP-AMP ( https://pastebin.com/jYhWdgHn ) has been getting really popular recently.
I've been a victim of it multiple times on many of my IP's and every time it happens - My IP's end up getting blacklisted in major big databases. We also receive tons of abuse reports for "Port Scanning".
Example of the reports we're getting: tcp: 51.81.XX.XX:19342 -> 209.208.XX.XX:80 (SYN_RECV) tcp: 51.81.XX.XX:14066 -> 209.208.XX.XX:80 (SYN_RECV)
OVH are threatening to kick us off their network, because we are victims of this attack. And requesting us to do something about it, despite the fact that there is nothing you can do when you are being victim of an DDoS Attack.
Anyone else had any problems with these kind of attacks?
The attack basically works like this; - The attacker scans the internet for TCP Services, i.e port 80. - The attacker then sends spoofed requests from our IP to these TCP Services, which makes the remote service attempt to connect to us to initiate the handshake.. This clearly fails. ... Which ends up with hundreds of request to these services, reporting us for "port flood".
hhh well Damian, Ok, I guess a free service has some costs :) More seriously, did you try to follow up and explain how dropping your RST packets may be exactly the reason for the attacker to abuse your IP space for the attack? Also, you may ask the provider of the victim to block SYN packets from your IP range (assuming the victim isn't some service that your clients will want to access). If all fails.... then all failed. -- Amir Herzberg Comcast professor of Security Innovations, University of Connecticut Homepage: https://sites.google.com/site/amirherzberg/home Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security On Thu, Feb 20, 2020 at 11:21 PM Damian Menscher <damian@google.com> wrote:
Amir: you're exactly correct -- but since you asked, here's their answer from the last time I suggested they respond with RSTs: https://seclists.org/nanog/2020/Jan/612
Damian
On Thu, Feb 20, 2020 at 5:36 PM Amir Herzberg <amir.lists@gmail.com> wrote:
If I read your description correctly:
- Attacker sends spoofed TCP SYN from your IP address(es) and different src ports, to some TCP servers (e.g. port 80) - TCP servers respond with SYN/ACK ; many servers resend the SYN/ACK hence amplification . - *** your system does not respond *** - Servers may think you're doing SYN-Flood against them, since connection remains in SYN_RCVD, and hence complain. In fact, we don't really know what is the goal of the attackers; they may in fact be trying to do SYN-Flood against these servers, and you're just a secondary victim and not the even the target, that's also possible.
Anyway, is this the case?
If it is... may I ask, do you (or why don't you) respond to the unsolicited SYN/ACK with RST as per the RFC?
I suspect you don't, maybe due to these packets being dropped by FW/NAT, that's quite common. But as you should understand by now from my text, this (non-standard) behavior is NOT recommended. The problem may disappear if you reconfigure your FW/NAT (or host) to respond with RST to unsolicited SYN/ACK.
As I explained above, if my conjectures are true, then OVH as well as the remote servers may have a valid reason to consider you either as the attacker or as an (unknowning, perhaps) accomplice.
I may be wrong - sorry if so - and would appreciate, in any case, if you can confirm or clarify, thanks.
-- Amir Herzberg
Comcast professor of Security Innovations, University of Connecticut
Homepage: https://sites.google.com/site/amirherzberg/home
Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security
On Thu, Feb 20, 2020 at 5:23 PM Octolus Development <admin@octolus.net> wrote:
A very old attack method called TCP-AMP ( https://pastebin.com/jYhWdgHn ) has been getting really popular recently.
I've been a victim of it multiple times on many of my IP's and every time it happens - My IP's end up getting blacklisted in major big databases. We also receive tons of abuse reports for "Port Scanning".
Example of the reports we're getting: tcp: 51.81.XX.XX:19342 -> 209.208.XX.XX:80 (SYN_RECV) tcp: 51.81.XX.XX:14066 -> 209.208.XX.XX:80 (SYN_RECV)
OVH are threatening to kick us off their network, because we are victims of this attack. And requesting us to do something about it, despite the fact that there is nothing you can do when you are being victim of an DDoS Attack.
Anyone else had any problems with these kind of attacks?
The attack basically works like this; - The attacker scans the internet for TCP Services, i.e port 80. - The attacker then sends spoofed requests from our IP to these TCP Services, which makes the remote service attempt to connect to us to initiate the handshake.. This clearly fails. ... Which ends up with hundreds of request to these services, reporting us for "port flood".
Good luck responding to such SYN/ACK, when you get 10+Gbps of them (real case happened while ago with colleague). Sure those SYN/ACK are not from single location, and attackers might use whole /24 for SYN spoofing. On 2020-02-21 03:34, Amir Herzberg wrote:
If I read your description correctly:
- Attacker sends spoofed TCP SYN from your IP address(es) and different src ports, to some TCP servers (e.g. port 80) - TCP servers respond with SYN/ACK ; many servers resend the SYN/ACK hence amplification . - *** your system does not respond *** - Servers may think you're doing SYN-Flood against them, since connection remains in SYN_RCVD, and hence complain. In fact, we don't really know what is the goal of the attackers; they may in fact be trying to do SYN-Flood against these servers, and you're just a secondary victim and not the even the target, that's also possible.
Anyway, is this the case?
If it is... may I ask, do you (or why don't you) respond to the unsolicited SYN/ACK with RST as per the RFC?
I suspect you don't, maybe due to these packets being dropped by FW/NAT, that's quite common. But as you should understand by now from my text, this (non-standard) behavior is NOT recommended. The problem may disappear if you reconfigure your FW/NAT (or host) to respond with RST to unsolicited SYN/ACK.
As I explained above, if my conjectures are true, then OVH as well as the remote servers may have a valid reason to consider you either as the attacker or as an (unknowning, perhaps) accomplice.
I may be wrong - sorry if so - and would appreciate, in any case, if you can confirm or clarify, thanks.
-- Amir Herzberg
Comcast professor of Security Innovations, University of Connecticut
Homepage: https://sites.google.com/site/amirherzberg/home
Foundations of Cyber-Security (part I: applied crypto, part II: network-security): https://www.researchgate.net/project/Foundations-of-Cyber-Security
On Thu, Feb 20, 2020 at 5:23 PM Octolus Development <admin@octolus.net> wrote:
A very old attack method called TCP-AMP ( https://pastebin.com/jYhWdgHn ) has been getting really popular recently.
I've been a victim of it multiple times on many of my IP's and every time it happens - My IP's end up getting blacklisted in major big databases. We also receive tons of abuse reports for "Port Scanning".
Example of the reports we're getting:
tcp: 51.81.XX.XX:19342 -> 209.208.XX.XX:80 (SYN_RECV) tcp: 51.81.XX.XX:14066 -> 209.208.XX.XX:80 (SYN_RECV)
OVH are threatening to kick us off their network, because we are victims of this attack. And requesting us to do something about it, despite the fact that there is nothing you can do when you are being victim of an DDoS Attack.
Anyone else had any problems with these kind of attacks?
The attack basically works like this; - The attacker scans the internet for TCP Services, i.e port 80. - The attacker then sends spoofed requests from our IP to these TCP Services, which makes the remote service attempt to connect to us to initiate the handshake.. This clearly fails. ... Which ends up with hundreds of request to these services, reporting us for "port flood".
Yeah this type of attack is a pain in the ass to deal with. Attacker is spoofing your IP addresses to millions of random web servers all over the Internet that see it as a typical SYN Flood those with automated reporting are likely blowing up OVH's abuse@ making a pain for them as well. However, OVH likely could easily check netflow or some other audit means to see your server didn't actually send out SYN packets to these servers. They likely are able to confirm the influx of inbound SYN-ACK packets that can be up to six depending on the TCP/IP stack of the server. The others are correct if you send out TCP Reset rejections you can tare down these bad states on the victim reflector's side to avoid getting retry SYN-ACK's. At this point I would consider whatever IP that you have that's getting attacked as burned, you're best bet is to drop those affected subnets and get new ones and avoid getting them exposed to whoever is attacking you. Spoofing issues has been the bane of any operator for years, till all the ASN's are on board with proper anti spoofing, ddos abuse of spoofing will be on-going and always an issue. On Thu, 20 Feb 2020 at 15:18, Octolus Development <admin@octolus.net> wrote:
A very old attack method called TCP-AMP ( https://pastebin.com/jYhWdgHn ) has been getting really popular recently.
I've been a victim of it multiple times on many of my IP's and every time it happens - My IP's end up getting blacklisted in major big databases. We also receive tons of abuse reports for "Port Scanning".
Example of the reports we're getting: tcp: 51.81.XX.XX:19342 -> 209.208.XX.XX:80 (SYN_RECV) tcp: 51.81.XX.XX:14066 -> 209.208.XX.XX:80 (SYN_RECV)
OVH are threatening to kick us off their network, because we are victims of this attack. And requesting us to do something about it, despite the fact that there is nothing you can do when you are being victim of an DDoS Attack.
Anyone else had any problems with these kind of attacks?
The attack basically works like this; - The attacker scans the internet for TCP Services, i.e port 80. - The attacker then sends spoofed requests from our IP to these TCP Services, which makes the remote service attempt to connect to us to initiate the handshake.. This clearly fails. ... Which ends up with hundreds of request to these services, reporting us for "port flood".
participants (10)
-
Amir Herzberg -
Bottiger -
Damian Menscher -
Denys Fedoryshchenko -
Filip Hruska -
Jean | ddostest.me -
Octolus Development -
Selphie Keller -
Tom Beecher -
Töma Gavrichenkov