{"id":7624,"date":"2017-02-28T01:05:15","date_gmt":"2017-02-28T01:05:15","guid":{"rendered":"http:\/\/blog.nsfocusglobal.com\/?p=409"},"modified":"2017-02-28T01:05:15","modified_gmt":"2017-02-28T01:05:15","slug":"does-a-dropbear-ddos-is-in-the-woods","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/does-a-dropbear-ddos-is-in-the-woods\/","title":{"rendered":"Does a Dropbear DDoS in the Woods?"},"content":{"rendered":"

Author: Guy Rosefelt – Dir, PM Threat Intelligence & Web Security<\/p>\n

Recently, NSFOCUS has seen some interesting DDoS behavior.\u00a0 Since Q4 of last year, there has been a rise in SSL\/VPN and SSH based DDoS attacks.\u00a0 Most people would not equate VPN or SSH as a viable mechanism for what is usually considered a volumetric art form, and they would be correct.\u00a0 But volumetric attacks are not the goal here; targeted VPN\/SSH DDoS attacks reduce the ability to determine attribution.<\/p>\n

How would this work? How could this be??\u00a0\u00a0 What am I having for lunch today??? The first two questions are relatively easy to answer; the third not so much.\u00a0How would this work?<\/p>\n

Threat actors are always looking for new ways to exploit things and not get caught.\u00a0\u00a0 One of the good things about DDoS attacks is that not much effort is required to determine where the attacking botnet came from – one just has to look at the source IPs of the incoming DDoS packets.\u00a0 Since botnets can be easily identified, their active lifespan is rather short as their IP addresses are quickly blocked. Such a waste of time and resources to build a good functioning botnet only to have it blocked after only a few attacks.<\/p>\n

But wait!\u00a0 What if there was a way to obfuscate the source IP addresses and prolong the short fleeting life of a well-crafted botnet? This is where the beauty of using VPN\/SSH tunnels comes in.\u00a0 Most VPN tunnels apply network address translation (NAT) to the traffic passing through the tunnels.\u00a0 This is to minimize network routing issues.\u00a0 But a secondary benefit of NAT is that it masks the true source IP of the packets in the tunnel.\u00a0 So if one could compromise a VPN\/SSH server and bent pipe (redirect) an attack through it, the source of the attack packets is hidden from the target.<\/p>\n

Conversely, if I could take over the systems running the VPN\/SSH clients, they would make a great botnet army whose attacks all look like they come from the VPN server the clients are connected to. In either case, many VPN servers do not keep the logs of VPN IP addresses assigned to clients for privacy and storage reasons, so trying to determine the true source IP of DDoS traffic becomes very difficult to determine.<\/p>\n

But how can this be?? Many people have said to me, “but, Guy!\u00a0 What have you been smoking to fuel such ridiculous and fanciful notions. To those, I say, “nay!\u00a0 I have something that resembles proof! It may not be irrefutable, but it is a start!”<\/p>\n

NSFOCUS monitors lots of DDOS traffic passing through our infrastructure and partner networks around the world.\u00a0 When we locate the sources of a DDoS attack, we try to scan those sources to determine what processes\/software are running that might be the trigger for the attack.\u00a0 Recently, NSFOCUS has traced attacks back to devices running Dropbear.<\/p>\n

Dropbear is a small open source SSH server and client app that runs on many POSIX platforms.\u00a0 I said “devices” and not “servers” for a reason –\u00a0 because of Dropbear’s small size and being free, it is used in a lot of embedded systems, like routers, IoT devices, etc.\u00a0 Below is a slide that shows recent DDoS activity coming from sources running Dropbear.<\/p>\n

\"\"<\/a><\/p>\n

You might be yelling at your computer screen, “but, Guy! How can that be?? Why are you dumping on Dropbear in the woods??”\u00a0 Easy my friend, I have what I like to call “facts”, and not alternative ones. In the past year, there have been a number of vulnerabilities found against Dropbear.\u00a0 Almost all allow arbitrary code execution.\u00a0 Other known vulnerabilities can facilitate session hijacking or Man-in-the-Middle (MTM) attacks within a SSH tunnel.\u00a0 All in all, lots of opportunities for mischief by a diligent attacker.<\/p>\n

\"\"<\/a><\/p>\n

Some of these vulnerabilities are still outstanding since the latest version of Dropbear was released in July 2016.What am I having for lunch today??? Still not sure but leaning towards a hot dog.\u00a0 What I am sure about is that there are over 11 million devices running Dropbear and all have the potential to facilitate and obfuscate a DDoS attack.<\/p>\n

\"\"<\/a><\/p>\n

And there isn’t a whole lot that can be done to mitigate that.\u00a0 Some suggestions are<\/p>\n