Subject: RE: [Tsvwg] Possible DoS in SCTP ?

From: Tuexen Michael <[email-masked]>
Date: Thu, 14 Feb 2002 17:10:07 +0100

Dear all,

if I understand DDoS attacks correcly, they use some mechanism
to generate a lot of packets by sending one. Using the SCTP
feature currently being the discussed you are generating one
packet by sending one. You can send this directly.

Best regards
Michael

Michael Tuexen    Tel.:   +49 89 722 47210
Siemens AG        Fax:    +49 89 722 48212
ICN WN CS SE 5    E-mail: [email-masked]

> -----Original Message-----
> From:	Andreas Jungmaier [SMTP:[email-masked]]
> Sent:	Thursday, February 14, 2002 6:03 PM
> To:	Randall Stewart
> Cc:	[email-masked]; [email-masked]; Hollaus Thomas; [email-masked]
> Subject:	Re: [Tsvwg] Possible DoS in SCTP ?
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi all,
> please see my comments inline.
> 
> > > > Andreas:
> > > >
> > > > There is no amplification here though... so it is no
> > > > different than if Evil-E sent the aborts itself
> > > > to all the "victims" V... it must send N packets
> > > > to get N packets to victims... this is no
> > > > different than a UDP attack.. in fact a UDP attack
> > > > is easier...
> > >
> > > Well, *almost*. The only problem I see here is that many
> > > network installations by now have already adapted to UDP
> > > attacks, e.g. by filtering excessive amounts (or simply all)
> > > ICMP dest. unreachble packets (which are subsequently
> > > jamming the targets/victims network).
> > >
> > > With SCTP, however, it is not that simple: you get back
> > > a transport layer packet that is much harder to filter.
> >
> > How is SCTP harder to filter than UDP.. UDP IS a transport
> > protocol and the ports in the UDP/TCP header are in the
> > same place as the SCTP header...
> 
> Yes, but the UDP does not cause the DoS -- it is the ICMP
> destination unreachable packets sent in reply to a UDP packet, that
> cause the problems.
> 
> > > Think about it: there have been MANY distributed DoS attacks
> > > based on UDP, why shouldn't there be some based on SCTP some
> > > day ?
> >
> > Or TCP.. at this level though your attacker is limited
> > to the bandwidth/cpu of the Evil-E machine. This is NO
> > different than TCP or UDP or anything else out there
> > now...
> 
> No, that was my point. In typical DDoS scenarios, there is
> thousands of Evil-E's, directed by one central process. This has
> been done by e.g. the Stacheldraht based DDoS attacks.
> I am not saying this is much of an issue, I am saying that 
> SCTP can be used, as other protocols, for (D)DoS attacks.
> 
> Best regards,
> Andreas
> 
> 
> 
> > > BTW, John: I am not concerned about cycles for processing
> > > ABORTs. The problem really arises when an attacker starts a lot
> > > of "Evil Endpoints E", that all have one target: Victim V.
> > > The scarce resource is bandwidth.
> > >
> > > > Andreas Jungmaier wrote:
> > > > > -----BEGIN PGP SIGNED MESSAGE-----
> > > > > Hash: SHA1
> > > > >
> > > > > Dear all,
> > > > >
> > > > > I am sorry for not explaining more exactly what I meant.
> > > > > I am assuming an attack with IP-Spoofing. The evil attacker
> > > > > (say E) is spoofing poor victim (say V), using oblivious
> > > > > server (say) O.
> > > > >
> > > > > Now,
> > > > >
> > > > >  Evil-Endpoint E:
> > > > >   Source IP V(spoofed)
> > > > >   Dest IP O
> > > > >   SCTP-INIT (invalid params) ----------------> Server O
> > > > >                                    /-------------/
> > > > >                SCTP-Abort,Error   /
> > > > >   Poor Victim V   <--------------/
> > > > >
> > > > > Now, if E can use V, it could send such packets to a large number
> > > > > of servers. And then V gets bombed with Aborts.
> > > > >
> > > > > I agree fully, that an established association is safe, but that
> > > > > was not the issue I was thinking about. Comments ?
> > >
> > > - --
> > > -
> > > ------------------------------------------------------------------------
> > > Dipl.-Ing. Andreas Jungmaier              |                         _> 
> > > Computer Networking Technology Group      | ASCII ribbon campaign  ( )
> > > University of Essen                       |  - against HTML email   X
> > > http://www.exp-math.uni-essen.de/~ajung   |              & vcards  / \
> > > -----BEGIN PGP SIGNATURE-----
> > > Version: GnuPG v1.0.6 (GNU/Linux)
> > > Comment: For info see http://www.gnupg.org
> > >
> > > iD8DBQE8a+eMXAsLBNOCSsARAmPfAJ47qG/Zy9+7omHnCOkbhsNR1b73QwCfZSQz
> > > vIKQ3YdsJjzX46WI8XX/Qbk=
> > > =g5mQ
> > > -----END PGP SIGNATURE-----
> 
> - -- 
> - ------------------------------------------------------------------------
> Dipl.-Ing. Andreas Jungmaier              |                         _
> Computer Networking Technology Group      | ASCII ribbon campaign  ( )
> University of Essen                       |  - against HTML email   X
> http://www.exp-math.uni-essen.de/~ajung   |              & vcards  / \
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
> 
> iD8DBQE8a+3fXAsLBNOCSsARAm4GAJ9P8xD5loz/k4p2eSHeYefJj/3uEgCfbM15
> WsAQnnBB9g6F3Vsmyqqj0xI=
> =TK7O
> -----END PGP SIGNATURE-----
> 
> _______________________________________________
> tsvwg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/tsvwg

_______________________________________________
tsvwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tsvwg

---

From: [email-masked]
Date: Thu, 14 Feb 2002 18:22:01 +0200

Hi all,

	This is TCP specific, but it is a very interesting lecture about DoS attacks... Check this out if you are interested:

	http://grc.com/dos/grcdos.htm

	I had to read it until the end when I started. Maybe because I didn't really know that much about DoS attacks... :-)

	Enjoy!

	BR Iván Arias Rodríguez

> From: ext Tuexen Michael [mailto:[email-masked]]
> Sent: 14. February 2002 18:10
> To: 'Andreas Jungmaier'; Randall Stewart
> Cc: Loughney John (NRC/Helsinki); [email-masked]; Hollaus Thomas;
> [email-masked]
> Subject: RE: [Tsvwg] Possible DoS in SCTP ?
> 
> 
> Dear all,
>