POSTER: Reflected attacks abusing honeypots

Autoři

HUSÁK Martin VIZVÁRY Martin

Rok publikování 2013
Druh Článek ve sborníku
Konference Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security
Fakulta / Pracoviště MU

Ústav výpočetní techniky

Citace
Doi http://dx.doi.org/10.1145/2508859.2512523
Obor Informatika
Klíčová slova communication; data sharing; ddos attack; honeypot; mitigation; reflection
Přiložené soubory
Popis We present the observation of distributed denial-of-service attacks that use reflection of the flooding traffic off reflectors. This type of attack was used in massive attacks against internet infrastructure of Czech Republic in March, 2013. Apart from common hosts in the network, honeypots were abused as the reflectors. It caused the false positive incident detection and helped attackers. Honeypots, which are by default set to accept any incoming network connection, unintentionally amplified the effect of reflection. We present an analysis of the attack from the point of view of honeypots and show the risks of having honeypots respond to any incoming traffic. We also discuss the possibilities of attack detection and mitigation and present lessons learned from handling the attack. We point out a lack of communication and data sharing during the observed attack.
Související projekty:

Používáte starou verzi internetového prohlížeče. Doporučujeme aktualizovat Váš prohlížeč na nejnovější verzi.

Další info