7 ms·

TCP-Starvation

63 points by simosx 9y ago

anfractuosity 9y ago
Is this similar to Slowloris at all? Edit: With Slowloris it looks like the connection isn't closed client side though? Although I'm just wondering they're dropping the FINs anyway.
- rini17 9y ago
  With Slowloris there are no missing TCP packets and client sends the correct request but VERY slowly.
  - anfractuosity 9y ago
    Cheers, yeah that's a good point
Matheus28 9y ago
This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 sockets open in your process, 30 per IP is plenty to prevent most attackers. IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.
- gruez 9y ago
  >IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64. Works great until your users use an ISP that hands out /128 rather than /64
  - moviuro 9y ago
    > ISP that hands out /128 rather than /64 Seriously? Who even hands out one single /64 or smaller? it's not like handing out /48s instead is going to deplete the IPv6 pool space [0]. [0] https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+earth https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+e...
    - magnat 9y ago
      > Who even hands out one single /64 or smaller? Budget VPS/dedicated server providers, such as OVH: https://www.kimsufi.com/en/servers.xml https://www.kimsufi.com/en/servers.xml
      - moviuro 9y ago
        I didn't even try to use their provided IP(s). I immediately turned to https://tunnelbroker.net https://tunnelbroker.net (only tunnel broker left?)
      - jandrese 9y ago
        DigitalOcean hands out /124s. Then they realized that blackholes were hitting multiple droplets (VMs) at once because people blackhole entire /64s, so their solution was to block ports on IPv6 instead of doing the sensible thing and handing out /64s to the droplets instead.
        deleted 9y ago
        [deleted]
      - slenk 9y ago
        Doesn't Comcast only hand out /64 to its residential customers?
zonovar 9y ago
It's a very old attack (~2000) named NAPTHA. http://www.securiteam.com/securitynews/6B0031F0KA.html http://www.securiteam.com/securitynews/6B0031F0KA.html
toredash 9y ago
Surprised by the amount of work done on the research but none(?) on past research on the same topic
- 60654 9y ago
  "Three weeks in the lab saves you three days in the library," as the old grad school quip goes. :) (And yeah, this is a classic failure mode of TCP...)
messy_desk 9y ago
It seems like the author thought his work was novel because he discovered using a firewall to stop a local client from sending FIN or RST. Of course, this is a triviality if you understand how to craft this type of attack using raw packets/custom TCP code.
amelius 9y ago
What is a good tool on Linux for testing such attacks?

63 points by simosx 9y ago

Is this similar to Slowloris at all? Edit: With Slowloris it looks like the connection isn't closed client side though? Although I'm just wondering they're dropping the FINs anyway.

rini17 9y ago
With Slowloris there are no missing TCP packets and client sends the correct request but VERY slowly.
- anfractuosity 9y ago
  Cheers, yeah that's a good point

Matheus28 9y ago

This is a really, really old attack. One way to protect against this is by limiting the number of open connections per IP. So if you can have up to 30000 sockets open in your process, 30 per IP is plenty to prevent most attackers. IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64.

gruez 9y ago
>IPv6 changes this a bit, so one might want to do a limit per subnet, say 30 per /64. Works great until your users use an ISP that hands out /128 rather than /64
- moviuro 9y ago
  > ISP that hands out /128 rather than /64 Seriously? Who even hands out one single /64 or smaller? it's not like handing out /48s instead is going to deplete the IPv6 pool space [0]. [0] https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+earth https://www.wolframalpha.com/input/?i=2%5E48+%2F+people+on+e...
  - magnat 9y ago
    > Who even hands out one single /64 or smaller? Budget VPS/dedicated server providers, such as OVH: https://www.kimsufi.com/en/servers.xml https://www.kimsufi.com/en/servers.xml
    - moviuro 9y ago
      I didn't even try to use their provided IP(s). I immediately turned to https://tunnelbroker.net https://tunnelbroker.net (only tunnel broker left?)
    - jandrese 9y ago
      DigitalOcean hands out /124s. Then they realized that blackholes were hitting multiple droplets (VMs) at once because people blackhole entire /64s, so their solution was to block ports on IPv6 instead of doing the sensible thing and handing out /64s to the droplets instead.
      - deleted 9y ago
        [deleted]
    - slenk 9y ago
      Doesn't Comcast only hand out /64 to its residential customers?

zonovar 9y ago

It's a very old attack (~2000) named NAPTHA. http://www.securiteam.com/securitynews/6B0031F0KA.html http://www.securiteam.com/securitynews/6B0031F0KA.html

toredash 9y ago

Surprised by the amount of work done on the research but none(?) on past research on the same topic

60654 9y ago
"Three weeks in the lab saves you three days in the library," as the old grad school quip goes. :) (And yeah, this is a classic failure mode of TCP...)

messy_desk 9y ago

It seems like the author thought his work was novel because he discovered using a firewall to stop a local client from sending FIN or RST. Of course, this is a triviality if you understand how to craft this type of attack using raw packets/custom TCP code.

amelius 9y ago

What is a good tool on Linux for testing such attacks?