9 ms·
Blacknurse – Low bandwidth ICMP firewall attack
- Sami_Lehtinen 10y agoIt seems that ZyWall USG 50 requires less than 10 Mbit/s of traffic to go totally braindead due to CPU load. - This attack works like a charm, and 10 Mbit/s is quite much less than reported 180 Mbit/s. There's generic name for these attacks: Resource consumption attack.
- maaaats 10y ago[1] has some more explanation. > Even a single computer can take down big servers using BlackNurse Attack (...) Researchers at TDC Security Operations Center have discovered a new attack technique that lone attackers with limited resources (in this case, a laptop and at least 15Mbps of bandwidth) can use to knock large servers offline. (...) > By sending a Type 3 ICMP packets with a code of 3, a hacker can cause a Denial of Service (DoS) state by overloading the CPUs of certain types of server firewalls, regardless of the quality of internet connection. The BlackNurse traffic volume is very small, ranging from 15 Mbps to 18 Mbps (or about 40,000 to 50,000 packets per second), which is laughable compared to record-breaking 1.1 Tbps DDoS attack recorded against French Internet service provider OVH in September. [1]: http://thehackernews.com/2016/11/dos-attack-server-firewall.html http://thehackernews.com/2016/11/dos-attack-server-firewall....
- stcredzero 10y agoTo what extent are AWS EC2 servers affected?
- detaro 10y agono reason to believe they are vulnerable.
- nodesocket 10y agoThe question is not the AWS instances themselves, but VPC networking.
- api 10y agoSounds like a really inefficient data structure in stateful firewalls.
- jedisct1 10y agoDuplicate of https://news.ycombinator.com/item?id=12918897 https://news.ycombinator.com/item?id=12918897
- andy_ppp 10y agoHaha, nice of you to promote your own empty thread rather than accepting the one actually on the homepage.
- user5994461 10y agoThe lesson here: The title matters.
- detaro 10y agoduplicates are explicitly allowed if previous submission had no traction. Please don't link to "duplicates" if there is neither a discussion nor there has been excess amount of them.
- andy_ppp 10y agoTo be honest I've always been pretty amazed that the web doesn't fall apart much more easily than it actually does. The fact is that most sites work only with some kind of caching in front of them at any scale; my guess would be on a site by site basis there will be a slow performing piece of code somewhere that can be exploited with low resources on the part of the attacker. In a lot of cases, simply creating a session a couple of 100000 in a short enough space of time, would be enough to overload the majority of sites...
- drzaiusapelord 10y agoThese aren't web technologies at all, but firewall issues. This doesn't have anything to do with websites being inefficient, but how some firewalls handle some ICMP edge cases. I feel like the complexity of IPv4/6 is high and stuff like this will continue to be found. If you want a world-wide networking protocol, you need to deal with complexity, and complexity comes with issues like this. We should be geared up to fix stuff like this via quick patching. This stuff shouldn't be terribly surprising. I think the idea of "install and forget" for any internet enabled device is a dangerous line of thinking, especially for firewalls.
- andy_ppp 10y agoYes, I know that... my point is if you wanted you could take down Hacker News for example; pretty easy if you thought about it for a while right? You don't need this bug or a massive botnet.
- chillydawg 10y agoBotnets are a lot simpler to wield and make you a more credible threat vs a website who thinks they have no "slow code", but to who 1TB/sec would certainly do the trick.
- mzs 10y ago55XX are problematic: http://www.blacknurse.dk/testresults.txt http://www.blacknurse.dk/testresults.txt
- imglorp 10y agoSo, what's the current recommendation on accepting public ICMP these days? There used to be some debate on the tradeoff between usefulness and security.
- kevin_b_er 10y agoFor IPv4, yes. ICMP is required to route ipv6 correctly.
- Arnt 10y agoIt's required for v4 too, if you want PMTU discovery to work.
- user5994461 10y ago> So, what's the current recommendation on accepting public ICMP these days? The recommendation is to accept ALL ICMP traffic, from everywhere, to everywhere, whatever it is. I've wasted too much time debugging tricky network issues because a dude thought that blocking ICMP was a great idea.
- jlgaddis 10y agohttp://shouldidisableicmp.com http://shouldidisableicmp.com ICMP types 3 and 4 should always be allowed. At your discretion, you may allow other types as well. Inbound, I allow types 0, 3, 4, 8, and 11, but I'm a network engineer. A paranoid security guy may prefer to block some of those.
- Karlozkiller 10y agoHuh. The solution is to not handle icmp type 3 or "hire official anti-ddos services"? I assume there's a way to maintain ICMP type 3 functionality while still mitigating this attack...?
- omribahumi 10y agoI was thinking you can block ICMP 3/3 if an IP address is used for ingress only (TCP/UDP server)
- zrm 10y agoBlocking ICMP type 3 breaks path MTU discovery. When the path MTU is less than the server's MTU, the client will typically send a request which is smaller than the path MTU and then the server's response isn't so it's the server that gets the ICMP message. Blocking type 3/3 can also make some other denial of service attacks easier because it takes longer for the server to figure out that the device at that IP doesn't want the packets the server is sending when the request is from a spoofed IP address.
- omribahumi 10y agoOk, then this is definitely a problem with UDP. But what about TCP only? AFAIK, TCP RST is usually used when a packet is received with no connection. The only place I'm aware of that uses ICMP 3/3 is the REJECT iptables target when the defaults are used.
- mikeash 10y agoGiven that there's a list of products unaffected by this attack, I assume it can be fixed without impacting functionality. It seems like a widespread implementation problem, rather than an inherent design flaw.
- esseti 10y agohow can i test some of the server i use?
- Karlozkiller 10y agoRun the commands from the article? hping3 -1 -C 3 -K 3 -i u20 <target ip> ofc that assumes you have access to hping/hping3. I plan to check my own server as soon as I can.
- virtualwhys 10y agoLooks like ASA >= 9.2.4 ships with `icmp unreachable rate-limit 1 burst-size 1`, which is I believe the workaround Cisco suggests: We recommend that you grant permission for the ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPsec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery
- deleted 10y ago[deleted]
- jedisct1 10y agohttps://github.com/jedisct1/blacknurse https://github.com/jedisct1/blacknurse
- chillydawg 10y agoThe worrying thing is that a suitably insane whackjob somewhere could spin up their ipcamera botnet and knock, say, half the planet's ISP offline at once. All routing would stop, the internet would simply grind to a halt. Am I missing something?
- lmm 10y agoNot all routing by any means. Just anyone using those particular Cisco and other routers. Fortunately the net routes around damage by design; as routers went offline, other paths would be found.
- realkitkat 10y agoOut of curiosity, why is this called Blacknurse? I couldn't make a connection from ICMP Destination Unreachable / port unreachable packet to the BlackNurse? (not that it matters, I am merely curious). Also - PoC is for IPv4; does anyone know if systems fail in a similar manner if ICMP6 Destination Unreachable / Port unreachable (ICMP6 T:3, C:4) is being used? (https://tools.ietf.org/html/rfc4443#section-3.1 https://tools.ietf.org/html/rfc4443#section-3.1)
- jasode 10y ago>Out of curiosity, why is this called Blacknurse? I can only guess that it's a play on "black hat" hacking as opposed to "white hat"[1]. Since ICMP messages are related to network "health" by way of pinging & diagnostics, a good "white nurse" would use that to monitor the health of the patient. However, an evil "black nurse" would use the ICMP protocol against the patient to kill it. [1]https://en.wikipedia.org/wiki/White_hat_(computer_security) https://en.wikipedia.org/wiki/White_hat_(computer_security)
- ianai 10y agoThey should have called it "evil nurse" or something less charged. Why even go there?
- 234dd57d2c8db 10y agoBecause maybe not everyone projects their own racism onto innocent words such as black, white, and yellow. We should "go there", because thought-crime and "watch what you say" type ideas are much more dangerous to our society than the term blacknurse.
- fivre 10y agowanted to go and test this against my home network. read page: "NOT AFFECTED: pfSense" Damnit, I'm protected by the glory of FreeBSD-based firewalls. I still tried anyway, but nothing happened :(
- Panino 10y agoThis reminds me of an attack in the late 1990s called Pulse, which was a low-bandwidth flood of RST packets against Cisco routers. With a T1 line (1.5mbps) you could bring down a T3 (45mbps).
- uiri 10y agoThis is really old news. These kinds of attacks have been well documented for over a decade.[1] An ICMP type 3 code 3 or type 3 code 2 packet MUST be treated the same as a TCP Reset packet (per RFCs). You can also do blind performance degradation attacks with ICMP type 4 or type 3 code 4 packets. Thankfully, ICMP type 4 has been deprecated for a while now so those packets can be safely ignored. [1] https://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html https://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html
- Animats 10y agoIf you get a Destination Unreachable at a firewall, what do you do with it? Unless the firewall has been passing traffic to the supposedly-unreachable destination, the firewall should drop it. Are firewalls mishandling this, or doing it too slowly?
- NetStrikeForce 10y agoI'm not a so called security expert nor I'm in the security business anymore, so please take this with a pinch of salt. Isn't rate limiting a thing anymore? Especially for packets that should not be coming at this rate. 40k-50k pps? Who gets that amount of ICMP type 3 code 4 as a baseline to consider it normal? Also, many networks out there "deprioritize" ICMP packets. I see how (mainly) Cisco seems to have screwed up on their ASAs, but in all honesty they've never been the paradigm of firewall security. Before the -X line, which is when I was a very active user of ASAs, the interface buffers of almost any ASA up to the 5580 were insufficient for some kinds of traffic that generated high pps with not so huge bandwidth. Actually, now that I think about it, I wonder if this "Black Nurse" is partly the result of the ASA's insufficient buffers and not just an actual firmware issue. All in all, this feels very amateurish to me and I'm surprised people are buying into it - I guess doom and gloom sells pageviews. I mean, if their conclusion is the below, I don't see how this is making so much noise: "We believe,that what we see when our customers get hit by the BlackNurse attack is that the firewall admins have just followed recommendations or misconfigured firewalls. Mitigation on firewalls could be to change default config or to patch any code that can lead to a DoS state." (from http://www.blacknurse.dk/Blacknurse_v.1.7.pdf http://www.blacknurse.dk/Blacknurse_v.1.7.pdf)
- zwetan 10y agofor those interested in detail etc. you can find a POC here https://github.com/jedisct1/blacknurse https://github.com/jedisct1/blacknurse
- oneplane 10y agoIt's somewhat strange to see pfSense and the likes not being affected, yet expensive Cisco hardware gets killed by it...
- peterwwillis 10y agoMitigating control plane attacks on Cisco devices: http://itsecurity.telelink.com/control-plane-attack/ http://itsecurity.telelink.com/control-plane-attack/ Control plane security overview: http://www.cisco.com/c/en/us/products/collateral/security/ios-network-foundation-protection-nfp/prod_white_paper0900aecd805ffde8.html http://www.cisco.com/c/en/us/products/collateral/security/io... Control plane best practices: http://www.cisco.com/c/en/us/about/security-center/copp-best-practices.html http://www.cisco.com/c/en/us/about/security-center/copp-best... Protecting the Router Control Plane: https://tools.ietf.org/html/rfc6192 https://tools.ietf.org/html/rfc6192 You'll probably also want to read the Network Security Baseline: http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/Baseline_Security/securebasebook/sec_chap1.html http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Se... More resource exhaustion DoS: TTL expiry attack http://www.cisco.com/c/en/us/about/security-center/ttl-expiry-attack.html http://www.cisco.com/c/en/us/about/security-center/ttl-expir... Troubleshooting high CPU use (on 7500's) http://www.cisco.com/c/en/us/support/docs/routers/7500-series-routers/41160-highcpu-ip-input.html http://www.cisco.com/c/en/us/support/docs/routers/7500-serie...
- bbachmann 10y ago@realkitkat the name Blacknurse was chosen because the guy who found it is educated as a nurse, and always used black t-shirts