DRDOS (Distributed Reflective Denial of Service). Florian Adamsky of the University of London has published a research paper detailing the family of protocols used by BitTorrent clients and can be abused for DRDOS attacks.
Most of us have a basic idea of what a DDOS attack is, but the DRDOS attack is a bit different.
While in a DDOS attack, a hacker controls a series of zombie computers that create excessive traffic to a target and the target is "blocked" and no longer accessible to third parties, in a DRDOS, the attacker generates traffic to legitimate network equipment. (called a mirror), which then relays the traffic to the victim.
Η κίνηση που αποστέλλεται στο κάτοπτρο είναι πλαστογραφημένη και περιέχει τη διεύθυνση IP του θύματος σαν προέλευση του packetυ, και όταν το κάτοπτρο (ή αν θέλετε ο ανακλαστήρας) ακολουθεί τους γενικούς κανόνες των πρωτοκόλλων του Διαδικτύου και προσπαθεί να δημιουργήσει μια connection, it does this with the victim's IP, instead of the attacker's.
Also, beyond the mission of a catwalk, the attackers have devised ways to use the mirror to boost traffic.
Protocols widely used in DRDOS attacks are TCP, DNS, and NTP. OR research study by Mr. Adamsky shows how too many protocols can be used by the BitTorrent family in DRDOS attacks, even with the ability to boost traffic.
According to Mr. Adamsky, the BitTorrent protocols that are affected are: UTP (Micro Transport Protocol), Distributed Hash Table (DHT), and Message Stream Encryption (MSE). These are the protocols used in BitTorrent, uTorrent and Vuze applications.
Επιπλέον, το πρωτόκολλο συγχρονισμού BTSync που χρησιμοποιείται με την εφαρμογή ανταλλαγής files BitTorrent Sync is also vulnerable.
"Our experiments show that BitTorrent has a bandwidth amplification factor (BAF) 50 times higher and in the case of BTSync up to 120 times higher," said Florian Adamsky.
But the bad news doesn't stop there. In addition to boosting traffic, the DRDOS attacks carried out via BitTorrent are detectable by regular firewalls due to the "dynamic range of encryption and handshake encryption".
Mitigation services for this type of attack would probably require Deep Packet Inspection (DPI), a solution that eats a lot of resources for most server infrastructures.
Such as says TorrentFreak, BitTorrent has fixed some of these issues in a recent beta, while Vuze and uTorrent are still vulnerable.
