Subject: mboned: multicast attack using SAP group

From: Pekka Savola <[email-masked]>
Date: Wed, 11 Jan 2006 14:59:50 +0200 (EET)

Hi,

Something a bit different from your typical "MSDP attacks" 
recording...

It seems that just recently, around 11:38-11:48 GMT, there was a 
multicast attack.  The CPU on all routers where we have SAP enabled 
went up, and instead of 5 Kbit/s of regular SAP traffic, now we saw 
something like 30 Mbit/s.  So, I'd guess someone thought flooding the 
SAP group was a good DoS attack attempt or a nice test..

Maybe the good news is that multicast must be getting commonplace if 
it's already an interesting attack vector.. :)

-- 
Pekka Savola                 "You each name yourselves king, yet the
Netcore Oy                    kingdom bleeds."
Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings
_______________________________________________________________
user interface: http://darkwing.uoregon.edu/~llynch/mboned.html
web archive:  http://darkwing.uoregon.edu/~llynch/mboned/

---

From: Marshall Eubanks <[email-masked]>
Date: Wed, 11 Jan 2006 09:09:42 -0500

I did not see that here.

You should be able to figure out where the packets were coming from  
fairly easily.

Regards
Marshall

On Jan 11, 2006, at 7:59 AM, Pekka Savola wrote:

> something like 30 Mbit/s.  So, I'd guess someone thought flooding  
> the SAP group was a good DoS attack attempt or a nice test..
>
> Maybe the good news is that multicast must be getting commonplace  
> if it's already an interesting attack vector.. :)
>
> --

---

From: John Kristoff <[email-masked]>
Date: Wed, 11 Jan 2006 10:08:05 -0600

On Wed, 11 Jan 2006 14:59:50 +0200 (EET)

> SAP group was a good DoS attack attempt or a nice test..

Hmm... I wonder if someone I sent the stuff too I advertised here
ended up hitting a production network (I made strong warnings not
to do that :-):

  <https://mail.internet2.edu/wws/arc/wg-multicast/2005-11/msg00006.html>

Do you have any more details about the SAPs?  Perhaps I need to send
another strongly worded warning out to the testers.  ...and everyone
else who runs multicast needs to start looking at things like source
specific SAs limiters.  :-)

John

---

From: David Meyer <[email-masked]>
Date: Wed, 11 Jan 2006 08:01:20 -0800

> it's already an interesting attack vector.. :)

	Too late, we opened that up with MSDP :-(

	Dave

---

From: "Mike O'Connor" <[email-masked]>
Date: Wed, 11 Jan 2006 11:26:14 -0500

Pekka,

Thanks for the clue, I'm investigating network problems at that time 
this morning.

-Mike O'C

Marshall Eubanks wrote:

>> Something a bit different from your typical "MSDP attacks"  recording...
>>

-- 
Mike O'Connor,                  E-mail: [email-masked]
Network Engineer                Energy Sciences Network (ESnet)
Phone: +1 631 344-7410     
Ernest O. Lawrence Berkeley National Laboratory (Berkeley Lab)

---

From: Toerless Eckert <[email-masked]>
Date: Wed, 11 Jan 2006 09:05:27 -0800

> 	Too late, we opened that up with MSDP :-(

Not really. MSDP was an unintended civilian victim of a hacker
attack. I think what Pekka was wondering about is whether multicast
has reached enough visibility to become the intentional target of attacks.
Not sure if that would be a good thing though. I'm pretty happy if
multicast is used in all IPTV deployments and no hacker even knows the word
multicast ;-)

I would guess this was no targeted attack, but some unintential mistake.
Raises of course agan the question to all network operators if they've
hardened their multicast service well enough (there's enough tweaks
inmost products today to do that, but those are likely only deployed
"on demand" - as usual).

Cheers
    Toerless

---

From: David Meyer <[email-masked]>
Date: Wed, 11 Jan 2006 09:22:55 -0800

> multicast is used in all IPTV deployments and no hacker even knows the word

	Ok, though this is not strictly true. 

	Dave

---

From: Jimmy Kyriannis <[email-masked]>
Date: Thu, 12 Jan 2006 18:19:09 -0500

Saw the event here as well, at 6:38am EDT (UTC synchronized).  It 
appears someone sent well over 2GB of data to the SAP group address:

Start        End          SrcIPaddress    SrcP  DstIPaddress    DstP 
P   Fl Pkts       Octets
05:41:38.468 06:11:39.280 194.116.6.50    34571 
224.2.127.254   9875  17  0  1760       503360
06:11:40.296 06:38:01.956 194.116.6.50    34571 
224.2.127.254   9875  17  0  1533       438438
06:38:04.433 06:40:48.261 194.116.6.50    34585 
224.2.127.254   9875  17  0  2649245    752434590
06:41:45.663 06:45:00.163 194.116.6.50    34585 
224.2.127.254   9875  17  0  3200506    909080700
06:46:01.396 06:47:35.768 194.116.6.50    34585 
224.2.127.254   9875  17  0  1643338    466795032
06:49:45.213 06:51:09.741 194.116.6.50    34585 
224.2.127.254   9875  17  0  1406081    399422574

This sort of activity should obviously be addressed, but router 
manufacturers need to be more resilient about processing control 
traffic such as this and not allowing their products to swallow 
non-conformant data and melt down right afterwards.

Jimmy

---

From: John Zwiebel <[email-masked]>
Date: Thu, 12 Jan 2006 15:50:54 -0800

On Jan 12, 2006, at 3:19 PM, Jimmy Kyriannis wrote:

> traffic such as this and not allowing their products to swallow non- 
> conformant data and melt down right afterwards.

True.

OTOH, using SDR to store multicast source information in the internet  
(by periodically
retransmitting it) rather than on some name server (or call it a  
'content address server')
and expecting it to work in an interdomain environment is just silly.

IMHO indiscriminately allowing SAP advertisements across your domain  
boundary is asking for trouble.
_______________________________________________________________
user interface: http://darkwing.uoregon.edu/~llynch/mboned.html
web archive:  http://darkwing.uoregon.edu/~llynch/mboned/

---

From: Marshall Eubanks <[email-masked]>
Date: Thu, 12 Jan 2006 19:51:46 -0500

What  I would like to know is, who blocked it, and how ? It did not
get here.

Marshall

On Jan 12, 2006, at 6:50 PM, John Zwiebel wrote:

> OTOH, using SDR to store multicast source information in the
> internet (by periodically
> IMHO indiscriminately allowing SAP advertisements across your
> domain boundary is asking for trouble.

---

From: Marshall Eubanks <[email-masked]>
Date: Fri, 13 Jan 2006 10:47:52 -0500

And, why did my message take 15 hours to get to MBoned ?

---

From: David Meyer <[email-masked]>
Date: Fri, 13 Jan 2006 07:58:58 -0800

> And, why did my message take 15 hours to get to MBoned ?

	I've asked Lucy. Hopefully we can get to the bottom of
	the delay. 

	Dave