Organizations are recommended to regularly monitor network activities and apply the latest system patches to defend against risks associated with DDoS attacks, including TCP-related malicious activities. Preventing DDoS and TCP reflection attacks However, independent research found that many internet-connected devices can be abused for amplification up to a factor of almost 80,000x and retransmit more than 5,000 SYN-ACK packets within 60 seconds, if needed. This means that if an attacker A sends a UDP packet with a spoofed source IP address B to an endpoint C, C will have no way to verify whether that packet comes from B or A.ĭDoS attacks by way of TCP reflection is unusual since some believe that such an attack will not be able to amplify enough traffic to the extent that UDP-based reflections can, the research furthermore states. UDP is a connectionless protocol and, as such, unlike Transmission Control Protocol (TCP), has no handshake phase, in which the two endpoints agree on a sequence number that identifies a connection. The more the reflection IP sends the SYN-ACK requests to the target network, the higher the amplification gets. The amount of amplification depends on the number of retransmits by the reflection service, which could be determined by the attacker. If the network does not respond as expected, the IP address will continue to retransmit the SYN-ACK packet in an attempt to establish a three-way handshake, ensuing in amplification. These addresses respond to the spoofed SYN packet through a SYN-ACK packet sent to the target network. In the case of this TCP SYN-ACK reflection attack, the threat actors send a SYN packet, which is designed to appear as if it originated from the target’s network IP address, to a number of random or preselected reflection IP addresses or reflection services. The targets may also be at risk of being blacklisted by network administrators because of the spoofed SYN requests. The affected networks were flooded with SYN traffic and used as reflection services, which led to network congestion and, in some cases, secondary outages.

The scope of the impact was said to spread on the account that the attacks did not only affect the intended targets, but the networks used to generate the DDoS flood as well. Security company Radware shared its observations on multiple campaigns involving Transmission Control Protocol (TCP) reflection attacks, specifically SYN-ACK reflection attacks, against companies across the world. Over the past month, threat actors have been using a relatively non-conventional approach to mount a flurry of distributed denial-of-service (DDoS) attacks: through TCP amplification.

Packet sender ddos