weaponizing-censors

Censors pose a threat to the entire Internet. In this work, we show that censoring middleboxes and firewalls can be weaponized by attackers to launch unprecedented reflected denial of service attacks. We find hundreds of thousands of IP addresses that offer amplification factors greater than 100× and IP addresses that technically offer infinite amplification.

This is the code repository for the USENIX Security 2021 paper, "Weaponizing Middleboxes for TCP Reflected Amplification".

This repository contains submodules for our two forks of ZMap, a submodule to the main Geneva repository containing the plugin used to identify the amplifying sequences, and processing scripts for analyzing scan results.

Amplification attacks are not the only way that censors pose a threat to those living outside their borders. See our concurrent work from WOOT 2021 on weaponizing censors for availability attacks and its repository.

📝 Abstract

Reflective amplification attacks are a powerful tool in the arsenal of a DDoS attacker, but to date have almost exclusively targeted UDP-based protocols. In this paper, we demonstrate that non-trivial TCP-based amplification is possible and can be orders of magnitude more effective than well-known UDP-based amplification. By taking advantage of TCP-non-compliance in network middleboxes, we show that attackers can induce middleboxes to respond and amplify network traffic. With the novel application of a recent genetic algorithm, we discover and maximize the efficacy of new TCP-based reflective amplification attacks, and present several packet sequences that cause network middleboxes to respond with substantially more packets than we send.

We scanned the entire IPv4 Internet to measure how many IP addresses permit reflected amplification. We find hundreds of thousands of IP addresses that offer amplification factors greater than 100×. Through our Internet-wide measurements, we explore several open questions regarding DoS attacks, including the root cause of so-called "mega amplifiers". We also report on network phenomena that causes some of the TCP-based attacks to be so effective as to technically have infinite amplification factor (after the attacker sends a constant number of bytes, the reflector generates traffic indefinitely).

🕵️‍♀️ Finding Amplifiers: ZMap Forks

We scanned the entire IPv4 Internet dozens of times to find IP addresses with middleboxes on their path that could be weaponized. To find these, we created two custom forks of the open-source scanning tool ZMap. ZMap is a fast single packet network scanner designed for Internet-wide network surveys. We modified ZMap first to add a new probe module (the forbidden_scan module defined in src/probe_modules/module_forbidden_scan.c), and then created a second fork to add the ability to craft two distinct packets for each probe (this enables us to send a custom SYN packet, followed by a second custom packet containing a well-formed HTTP GET request).

The submodule zmap in this repository is for single packet scans (the SYN, PSH, or PSH+ACK scans from our paper) and zmap_multiple_probes (for the SYN; PSH or SYN; PSH+ACK scans from our paper).

The module has multiple options compiled in, including the Host: header included in the payload. To change any of the following options, edit the module_forbidden_scan.c file located in src/probe_modules and recompile ZMap to use.

🏃 Running ZMap

Example on how to build zmap and run the forbidden_scan module to scan a single IP address and record the responses received:

$ IP=
$ cmake . && make -j4  && sudo src/zmap -M forbidden_scan -p 80 $IP/32 -f "saddr,len,payloadlen,flags,validation_type" -o scan.csv -O csv 

The output of the scan is a csv file called scan.csv. For each packet that ZMap identified as a response to our scan, the output file will contain the src IP address, the IP length of the packet, the length of the payload itself, the TCP flags, and the validation_type (the reason the probe treated the incoming packet as a response to a probe).

This module can be used to test firewalls or other middleboxes to see if they are vulnerable to this attack.

Also in this repsitory is a helper script scan_all.py, which can be used to automate multiple ZMap scans with different scanning parameters.

🔬 Processing Scan Results

Included in this repository are two helper scripts to process the results of a ZMap scan. The main processing script is stats.py, which will consume the output of ZMap and generate graphs and summary statistics about the scan. See the below example of the stats.py script processing a scan.csv file (note the IP addresses have been anonymized).

# python3 stats.py scan.csv 149
Processing scan data assuming attacker sent 149 bytes per IP.
Initializing analysis of scan.csv
Calculating total length of file to analyze:
949099449 total packets to analyze.
  - Unique responding IPs: 362138621
  - Number of amplifying IP addresses: 218015761
  - Total number of bytes sent by amplifying IP addresses: 45695690843
  - Average amplification rate from amplifying IP addresses: 1.407000
  - Highest total data received by IP:
        7632101 96.96.96.96 141334
        9788625 97.97.97.97 181270
        44365380 98.98.98.98 142200
        238162104 99.99.99.99 1011556
  - Highest total packets received by IP:
        7360299 1.1.1.1 136301
        8040711 2.2.2.2 148901
        8186133 3.3.3.3 151594
        238162104 4.4.4.4 1011556
  - Flags on packets sent by responders:
    + 472: S
    + 119609984: R
    + 680892582: RA
    + 12: FSPA
    + 1: SPUE
    + 2: PAU
    + 1: SUEC
    + 1: FAU
    + 1: PAUE
    + 1: SRPAUEC
    + 7217: FRPA
    + 4734607: FA
    + 5540525: RPA
    + 3687478: PA
    + 58615499: SA
    + 11928812: FPA
    ...
  - CDF of number of packets sent: scan_packets_cdf.eps
  - CDF of bytes sent: scan_bytes_cdf.eps
  - CDF of amplification rate: scan_amplification_cdf.eps

📃 License

This repository is licensed under BSD 3-Clause license. Please note that this repository contains multiple submodule pointers to other repositories, each of which contains its own license. Please consult each for license information.

📑 Citation

To cite this paper, please use the Bibtex here.