Reflection and Amplification Attacks反射與放大攻擊

A reflection attack is a type of DoS attack in which the attacker sends a flood of protocol request packets to various IP hosts. The attacker spoofs the source IP address of the packets such that each packet has as its source address the IP address of the intended target rather than the IP address of the attacker. The IP hosts that receive these packets become "reflectors." The reflectors respond by sending response packets to the spoofed address (the target), thus flooding the unsuspecting target.

反射攻擊是一種 DoS 攻擊，攻擊者會向多個 IP 主機傳送大量的協定請求封包。攻擊者會偽造這些封包的來源 IP 位址，使每個封包的來源位址成為預定目標的 IP 位址，而非攻擊者本身的 IP 位址。收到這些封包的 IP 主機就成為「反射者」。這些反射者會將回應封包傳送至偽造的位址（也就是目標），藉此淹沒毫不知情的目標。

If the request packets that are sent by the attacker solicit a larger response, the attack is also an amplification attack. In an amplification attack, a small forged packet elicits a large reply from the reflectors. For example, some small DNS queries elicit large replies. Amplification attacks enable an attacker to use a small amount of bandwidth to create a massive attack on a victim by hosts around the internet.

如果攻擊者傳送的請求封包會引來更大的回應，那麼這種攻擊同時也是放大攻擊。在放大攻擊中，一個偽造的小型封包會從反射者那裡引出大量回覆。例如，一些小型的 DNS 查詢就能引來大量回覆。放大攻擊讓攻擊者只需使用少量頻寬，就能透過網際網路上的眾多主機對受害端發動大規模攻擊。

It is important to note that reflection and amplification are two separate elements of an attack. An attacker can use amplification with a single reflector or multiple reflectors. Reflection and amplification attacks are very hard to trace because the actual source of the attack is hidden.

值得注意的是，反射與放大是攻擊中兩個各自獨立的要素。攻擊者可以利用單一反射者，也可以利用多個反射者來進行放大。反射與放大攻擊很難追蹤，因為攻擊的真正來源被隱藏起來。

A classic example of reflection and amplification attacks is the smurf attack, which was common during the late 1990s. Although the smurf attack no longer poses much of a threat (because mitigation techniques became standard practice some time ago), it provides a good example of amplification. In a smurf attack, the attacker sends numerous ICMP echo-request packets to the broadcast address of a large network. These packets contain a spoofed address of the victim as the source IPv4 address. Every host that belongs to the large network responds by sending ICMP echo-reply packets to the proclaimed source of the initiating packet. Since the source is spoofed (source IPv4 of the request changed to the IPv4 of the victim), the victim is flooded with unsolicited ICMP echo-reply packets.

反射與放大攻擊的經典範例是 smurf 攻擊，這種攻擊在 1990 年代末期相當常見。雖然 smurf 攻擊已不再構成太大的威脅（因為緩解技術很早以前就成為標準做法），但它仍是一個說明放大概念的好例子。在 smurf 攻擊中，攻擊者會向一個大型網路的廣播位址傳送大量 ICMP 回應請求封包，這些封包的來源 IPv4 位址被偽造成受害端的位址。屬於該大型網路的每一台主機都會回應，將 ICMP 回應回覆封包傳送給它認定的發起封包來源。由於來源已被偽造（請求的來源 IPv4 已被改成受害端的 IPv4），受害端便會被大量未經請求的 ICMP 回應回覆封包所淹沒。

The figure illustrates a smurf attack. Note the differentials in the bandwidth of the internet connections. The attacker has a very small, 56-Kbps dialup connection. The target has a much larger T1 connection (1.544 Mbps). The reflector network has an even larger DS3 connection (45 Mbps). The small 56K stream of echo requests with the spoofed source address of victim 10.1.1.5 is sent to the broadcast addresses of the large network. As a result, thousands of echo replies are sent to 10.1.1.5 for each spoofed echo, and the target T1 is fully consumed.

下圖說明一次 smurf 攻擊。請注意各段網際網路連線頻寬的差異：攻擊者只有非常小的 56 Kbps 撥接連線；目標端則有大得多的 T1 連線（1.544 Mbps）；反射者網路的連線甚至更大，為 DS3 連線（45 Mbps）。攻擊者以小小的 56K 資料流傳送回應請求，並將來源位址偽造成受害端 10.1.1.5，傳送到大型網路的廣播位址。結果，每個偽造的回應請求都會引來數千個回應回覆傳送給 10.1.1.5，使目標端的 T1 頻寬被完全耗盡。

Smurf attacks can easily be mitigated on a Cisco IOS device by using the no ip directed-broadcast interface configuration command, which has been the default setting since Cisco IOS Software Release 12.0. With the no ip directed-broadcast command configured for an interface, broadcasts destined for the subnet to which that interface is attached will be dropped rather than being broadcast.

在 Cisco IOS 裝置上，只需使用介面設定指令 no ip directed-broadcast 就能輕易緩解 smurf 攻擊，這也是自 Cisco IOS 軟體 12.0 版以來的預設設定。當介面設定了 no ip directed-broadcast 指令後，目的地為該介面所連接子網路的廣播封包將會被丟棄，而不會被廣播出去。

While smurf attacks no longer pose the threat they once did, newer reflection and amplification attacks may pose a huge threat. For example, in March 2013, DNS amplification was used to cause a DDoS that made it impossible for anyone to access an organization's website. This attack was so massive that it also slowed internet traffic worldwide. The attackers were able to generate up to 300 Gbps of attack traffic by exploiting DNS open recursive resolvers, which respond to DNS queries, including queries outside their IP range. By sending an open resolver, a very small, deliberately formed query with the spoofed source address of a target, an attacker can evoke a significantly larger response to the intended target. These types of attacks use large numbers of compromised source systems and multiple DNS open resolvers, so the effects on the target devices are magnified. The Open Resolver Project cataloged 28 million open recursive DNS resolved on the internet in 2013.

雖然 smurf 攻擊已不再構成過去那樣的威脅，但更新型的反射與放大攻擊仍可能帶來巨大威脅。舉例來說，2013 年 3 月曾有人利用 DNS 放大攻擊發動 DDoS，使某組織的網站完全無法存取。這次攻擊規模極大，甚至拖慢了全球的網際網路流量。攻擊者藉由利用 DNS 開放式遞迴解析器（會回應包括其 IP 範圍以外的 DNS 查詢），產生高達 300 Gbps 的攻擊流量。攻擊者向開放式解析器傳送一個經過刻意設計、來源位址已被偽造成目標的極小查詢，就能引出遠大於原查詢的回應傳給目標。這類攻擊會使用大量已遭入侵的來源系統與多個 DNS 開放式解析器，使對目標裝置造成的影響進一步放大。開放式解析器計畫（Open Resolver Project）在 2013 年於網際網路上編列出 2,800 萬個開放式遞迴 DNS 解析器。

In February 2014, a Network Time Protocol (NTP) amplification attack generated a new record in attack traffic, over 400 Gbps. NTP has some characteristics that make it an attractive attack vector. Like DNS, NTP uses UDP for transport. Like DNS, some NTP requests can result in replies that are much larger than the request. For example, NTP supports a command that is called monlist, which can be sent to an NTP server for monitoring purposes. The monlist command returns the addresses of up to the last 600 machines with which the NTP server has interacted. If the NTP server is relatively active, this response is much bigger than the request sent, making it ideal for an amplification attack.

2014 年 2 月，一次網路時間協定（NTP）放大攻擊創下攻擊流量新紀錄，超過 400 Gbps。NTP 具備一些特性，使其成為極具吸引力的攻擊向量。與 DNS 相同，NTP 使用 UDP 進行傳輸；同樣與 DNS 相似，某些 NTP 請求所得到的回覆會遠大於請求本身。舉例來說，NTP 支援一個名為 monlist 的指令，可傳送給 NTP 伺服器用於監控用途。monlist 指令會回傳最近與該 NTP 伺服器互動過的最多 600 台機器的位址。如果該 NTP 伺服器相對活躍，這個回應會比傳送的請求大得多，非常適合用於放大攻擊。