What is the smurf reflection-amplification attack?

A smurf attack is a denial-of-serviceIt is an attack meant to shut down a machine or network, making it inaccessible to its intended users. (DoS) assault in which an attacker attempts to flood a server with Internet Control Message Protocol (ICMP) It is a protocol that devices within a network use to communicate problems with data transmission. packets. By sending queries to one or more computer networks using the falsified IP address of the targeted device, the computer networks respond to the targeted server, possibly multiplying the original attack flow and rendering the target unreachable.

Smurf attacks resemble ping floods, another denial-of-service (DoS) attack in which a hacker cascades systems with ICMP echo requests or pings.

How does it work?

ICMP packets are used in a DoS assault and network administration. Network administrators It is the person designated in an organization whose responsibility includes maintaining computer infrastructures with emphasis on local area networks up to wide area networks. use the ping program and ICMP packets to test networked hardware devices such as PCs, printers, and routers. A ping is widely used to determine whether a device is functioning and trace the period it takes for information to travel from the source device to the target and back. Unfortunately, because the ICMP protocol lacks a handshakeIn computing, a handshake is a signal between two devices or programs, used to, e.g., authenticate, coordinate. , hardware devices receiving queries cannot determine if the request is authentic.

Note: The ICMP packet does not have any ports as it was meant to communicate network-layer data between hosts and routers, not between application layers. Thus, it only transports network statistics used for testing and control purposes.

This form of DDoS assault is identical to a hacker contacting an office manager and pretending to be the firm's CEO. The hacker requests that the manager instruct each employee to get the executive back on his line and provide an update on their progress. The attacker provides a selected victim's callback number, and the victim subsequently receives as many unwanted phone calls as there are individuals in the workplace.

Steps

The following is a breakdown of a smurf assault scenario:

1. The smurf virus first constructs a faked packet with the source address set to the correct IP address of the targeted victim.

2. The packet routes to an IP broadcast address of a router or firewall, which sends requests to every host device address inside the broadcasting network, multiplying the number of requests by the number of networked devices on the web.

3. Each device in the network hears the broadcaster's request and then sends an ICMP echo reply packet to the target's faked address.

4. The intended victim is subsequently bombarded with ICMP echo reply packets, potentially overwhelming it and causing denial-of-service to genuine traffic.

Note: The smurf attack's amplification factor is proportional to the number of hosts on the intermediary network. An IP broadcast network with 500 hosts will generate 500 answers for each bogus echo request.

Types of smurf attacks

We will discuss two types of smurf attacks in this article:

Basic smurf attack

A simple smurf attack happens when the attacker sends an endless number of ICMP request packets to the victim network. Packages contain a source address set to the network's broadcast address, prompting any device on the web that receives the request to respond. This generates a large quantity of traffic, finally bringing the system down.

Advanced smurf attack

A fundamental smurf assault is the starting point for an advanced smurf attack. However, by specifying sources, echo requests may be configured to reply to additional third-party victims. This allows attackers to target several victims simultaneously, slowing down more extensive networks and targeting more significant groups of victims and broader portions of the web.

Prevention

Over the years, several mitigation measures for this attack vector have been developed and deployed, and the exploit is mainly regarded as solved. Mitigation strategies may still be required for a small number of outdated systems. Disabling IP broadcasting addresses on each network router and firewall is a straightforward approach. Older routers will likely have broadcasting enabled by default, but modern routers will deactivate it.