T1498.002, Reflection Amplification, is a denial of service that bounces traffic off third party servers. It applies to Windows, IaaS, Linux and macOS and falls under impact.
How attackers use it
The adversary takes advantage of an intermediary server, a reflector, that will respond to a given source address. They send packets to reflectors with the source address spoofed to be the victim's. The reflectors then answer the victim. As with direct floods, more than one system or a botnet may be used, and more than one reflector can focus traffic on a target.
Amplification comes from protocols where the response is larger than the request. MITRE says the increase in attack traffic can be several orders of magnitude over the requests sent. DNS and NTP are two prominent protocols that have enabled these floods, and memcache showed amplification of up to 51,200 times the requesting packet.
For the victim, the traffic comes from many legitimate looking servers, so there is no single attacker address to block.
How to detect it
MITRE describes four analytics.
- Spoofed outbound traffic to common amplification protocols, such as DNS, NTP and Memcached, with unusual volume toward remote reflectors, while the victim receives far more traffic than it sent.
- Spoofed packets sent to amplification services from command line tools or scripts, with unusual outbound packet volume on known reflector ports.
- UDP traffic bursts to external amplification ports started by built in scripting or binaries.
- A cloud VM or container sending spoofed UDP requests to third party services on amplifier ports, with a high ratio of outbound to inbound traffic. MITRE names VPC Flow Logs in this case.
Indicators in MITRE's description: spoofed source addresses in outbound packets, outbound UDP to known amplifier ports, abnormal volume toward external reflectors, and skewed outbound to inbound ratios.
How to reduce the risk
MITRE lists filtering network traffic. Intercept flood traffic upstream when it exceeds your link capacity, through your ISP, a CDN or a specialist mitigation provider.
Two more habits help the wider internet. Do not leave open resolvers or other amplifying services exposed to the public, and block spoofed source addresses at your own network edge so your hosts cannot be used to send reflected traffic.
Quick check
Why is DNS a popular reflection protocol?
Responses can be much larger than requests, which amplifies the attack traffic.
