Reflections on reflection (attacks)

Recently Akamai published an article about CLDAP reflection attacks. This got us thinking. We saw attacks from Conectionless LDAP servers back in November 2016 but totally ignored them because our systems were automatically dropping the attack traffic without any impact.

CC BY 2.0 image by RageZ

We decided to take a second look through our logs and share some statistics about reflection attacks we see regularly. In this blog post, I'll describe popular reflection attacks, explain how to defend against them and why Cloudflare and our customers are immune to most of them.

A recipe for reflection

Let's start with a brief reminder on how reflection attacks (often called "amplification attacks") work.

To bake a reflection attack, the villain needs four ingredients:

  • A server capable of performing IP address spoofing.
  • A protocol vulnerable to reflection/amplification. Any badly designed UDP-based request-response protocol will do.
  • A list of "reflectors": servers that support the vulnerable protocol.
  • A victim IP address.

The general idea:

  • The villain sends fake UDP requests.
  • The source IP address in these packets is spoofed: the attacker sticks the victim's IP address in the source IP address field, not their own IP address as they normally would.
  • Each packet Continue reading

Speed, Power, Performance: NSX & Memorial Day Motorsports

With Memorial Day weekend coming up, for me, it’s all about hot dogs, hamburgers, and fast car racing. I am huge Formula 1 fanatic, but Memorial Day is a bonanza of racing from the F1 Monaco Grand Prix, to NASCAR’s Coke 600, and of course the Indianapolis 500 all on the same day! The raw speed and performance of these races remind me of a 2016 VMworld presentation (NET8030) on NSX performance.

The argument still comes up now and again that “hardware is faster than software.” Network guys like me just assume that’s true. So, it came as a surprise to me when I watched the session which turned that assumption on its head. In this session, the presenter demonstrated that software is faster than hardware, way faster. Of course, I was dubious at first but quickly learned that physical networking and virtual networking is like the difference between the pace car and the race car. I always assumed the physical switch was the race car, but in the throughput presentation, Samuel showed two VM’s running on the same host with NSX routing, switching, and firewalling between them could get up to 106G! This information surprised me. Sort of like the same experience I had Continue reading

Reading List: WannaCry and Ransomware

A good bit has been written about the recent WannaCry outbreak over the last few weeks; rather than stringing the best out through Worth Reading posts, I have collected the three best posts on the topic here.

There are a number of takeaways and lessons to learn from the far-reaching attack that we witnessed. Let me tie those to voluntary cooperation and collaboration which together represent the foundation for the Internet’s development. The reason for making this connection is because they provide the way to get the global cyber threat under control. Not just to keep ourselves and our vital systems and services protected, but to reverse the erosion of trust in the Internet. —CircleID

Over the weekend a cyber attack known as “WannaCry” infected hundreds of computers all over the world with ransomware (malware which encrypts your data until you pay a ransom, usually in Bitcoin). The attack takes advantage of an exploit for Windows known as “EternalBlue” which was in the possession of NSA and, in mid April, was made public by a group known as “The Shadow Brokers.” Microsoft issued a patch for the vulnerability on March 14 for all supported versions of Windows (Vista and Continue reading

Memory-Like Storage Means File Systems Must Change

The term software defined storage is in the new job title that Eric Barton has at DataDirect Networks, and he is a bit amused by this. As one of the creators of early parallel file systems for supercomputers and one of the people who took the Lustre file systems from a handful of supercomputing centers to one of the two main data management platforms for high performance computing, to a certain way of looking at it, Barton has always been doing software-defined storage.

The world has just caught up with the idea.

Now Barton, who is leaving Intel in the …

Memory-Like Storage Means File Systems Must Change was written by Timothy Prickett Morgan at The Next Platform.

Help Shape the Future of the Internet

This year, the Internet Society celebrates its 25th anniversary.  Our own history is inextricably tied to the history of the Internet. We were founded in 1992 by Internet pioneers who believed that “a society would emerge from the idea that is the Internet” – and they were right.

As part of the celebration, this September we will launch a comprehensive report that details the key forces that could impact the future of the Internet. The report will also offer recommendations for the Future and we need your input.

Constance Bommelaer de Leusse

A Health Check For Code And Infrastructure In The Cloud

As businesses continue their migration to the cloud, the issue of monitoring the performance and health of their applications gets more challenging as they try to track them across both on-premises environments and in both private and public clouds. At the same time, as they become more cloud-based, they have to keep an eye on the entire stack, from the customer-facing applications to the underlying infrastructure they run on.

Since its founding eight years ago, New Relic has steadily built upon its first product, a cloud-based application performance management (APM) tool that is designed to assess how well the …

A Health Check For Code And Infrastructure In The Cloud was written by Jeffrey Burt at The Next Platform.

IDG Contributor Network: Why we need more shades of gray

Few things in life can be expressed in black and white terms. Sure, a light switch is either on or it's off; one baseball team wins the World Series each year and one doesn't; and every line of computer binary starts with either a one or a zero.Most of the time, though, our lives are full of gray areas, not absolutes. Brent crude almost never drops below $40 a barrel, but it did happen once and the chances of it happening again are greater than zero. There may be a 60 or 70 percent chance of rain tomorrow, but it's rarely 100 percent. And, sometimes, even the Chicago Cubs win the World Series.So why is it that security practitioners often treat their threat environment as if it's black or white, rather than a spectrum of possible states or probable outcomes — even when this binary view diminishes the quality of their comprehension and decision-making and thus jeopardizes their actual security?To read this article in full or to leave a comment, please click here

Top 5 Reasons IoT projects fail

If you’re doing an Internet of Things deployment, prepare for failure. That’s the overarching takeaway from a survey Cisco conducted of more than 1,800 IT leaders in the U.S. and U.K.Up to 60% of IoT projects that respondents started stalled at the proof of concept phase, Cisco found. Just 26% of respondents said they had what they considered a successful IoT deployment. So where do IoT projects go south?+MORE AT NETWORK WORLD: Cisco: Secure IoT networks, not the devices +To read this article in full or to leave a comment, please click here

Worth Reading: The Embiggening Bite of GPUs

That is how CPUs got their name, after all. And perhaps this is a good time to remind everyone that systems used to be a collection of different kinds of compute, and that is why the central compute complex in an IBM System/360 was called the main frame. There were other frames, and in the case of RISC processors at IBM, the original 801 RISC chip that underlies half of its systems business today was commercialized as a controller for mainframe disk controllers. The Xeon processor that now dominates the datacenters of the world made a three-decade long jump off our desks. —The Next Platform

The post Worth Reading: The Embiggening Bite of GPUs appeared first on rule 11 reader.

IDG Contributor Network: Machine learning: Are we there yet?

In my recent blogs, I have written about automation tying the network to other domains of IT, and how it’s a capability available today that you should start using.Machine learning is another hot topic. While the timeline is several years out for many machine learning applications in networking, it has the potential to be one of those rare technologies that comes along every few decades and fundamentally transforms how networks run.To read this article in full or to leave a comment, please click here

IDG Contributor Network: Machine learning: Are we there yet?

In my recent blogs, I have written about automation tying the network to other domains of IT, and how it’s a capability available today that you should start using.Machine learning is another hot topic. While the timeline is several years out for many machine learning applications in networking, it has the potential to be one of those rare technologies that comes along every few decades and fundamentally transforms how networks run.To read this article in full or to leave a comment, please click here

Hackers can use malicious subtitles to remotely take control of your device

Do you use Kodi, Popcorn Time, VLC or Stremio? Do you use subtitles while you watch? If so, then you need to update the platform as Check Point researchers revealed that not all subtitles are benign text files and hackers can remotely take control of any device running vulnerable software via malicious subtitles.The attack is not in the wild, since Check Point developed the proof of concept attack vector; however, with news of the attack vector and an estimated 200 million video players and streaming apps running vulnerable software, attackers might jump on the malicious subtitle wagon to gain remote access to victims’ systems.To read this article in full or to leave a comment, please click here

1 … 2,041 2,042 2,043 2,044 2,045 … 3,836