Menu
DoS technique lets a single laptop take down an enterprise firewall

DoS technique lets a single laptop take down an enterprise firewall

ICMP Type 3 Code 3 packets can overload firewalls, researchers warn

At a time when the size of distributed denial-of-service attacks has reached unprecedented levels, researchers have found a new attack technique in the wild that allows a single laptop to take down high-bandwidth enterprise firewalls.

The attack, dubbed BlackNurse, involves sending Internet Control Message Protocol (ICMP) packets of a particular type and code. ICMP is commonly used for the ping network diagnostic utility, and attacks that try to overload a system with ping messages -- known as ping floods -- use ICMP Type 8 Code 0 packets.

BlackNurse uses ICMP Type 3 (Destination Unreachable) Code 3 (Port Unreachable) packets instead and some firewalls consume a lot of CPU resources when processing them.

According to experts from the Security Operations Center of the Danish telecom operator TDC, it would take from 40,000 to 50,000 ICMP Type 3 Code 3 packets a second to overload a firewall. This is not a large number of packets and the bandwidth required to generate them is 15Mbps to 18Mbps, which means that BlackNurse attacks can be launched from a single laptop.

"The impact we see on different firewalls is typically high CPU loads," the TDC Security Operations Center (SOC) said in a technical report. "When an attack is ongoing, users from the LAN side will no longer be able to send/receive traffic to/from the Internet. All firewalls we have seen recover when the attack stops."

TDC SOC tested the attack successfully against Cisco Adaptive Security Appliance (ASA) firewalls in default configurations. Cisco's own documentation recommends that users allow ICMP Type 3 messages.

"Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPSec and PPTP traffic," the company warns in its user guidelines.

Some firewalls from Palo Alto Networks, SonicWall and Zyxel Communications are also affected, but only if they're misconfigured or if certain protections are not turned on.

"Palo Alto Networks Next-Generation Firewalls drop ICMP requests by default, so unless you have explicitly allowed ICMP in a security policy, your organization is not affected and no action is required," Palo Alto said in a blog post in response to TDC SOC's report.

Customers who need to allow ICMP requests can follow best practices for DoS protection to mitigate this attack, the company said. This involves enabling ICMP Flood and ICMPv6 Flood in their firewall's DoS protection profile.

Denial of service attacks are typically about generating more traffic than the target's Internet bandwidth can take. BlackNurse is unusual in this respect, because it cannot be stopped by provisioning additional bandwidth.

"On firewalls and other kinds of equipment a list of trusted sources for which ICMP is allowed could be configured," the TDC SOC experts advise. "Disabling ICMP Type 3 Code 3 on the WAN interface can mitigate the attack quite easily. This is the best mitigation we know of so far."

That said, there are many devices out there that are configured to accept ICMP traffic from the Internet. The TDC SOC has identified 1.7 million of them in Denmark alone.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Brand Post

What to expect from your IT Distributor

Whether you’re just starting out or you’ve been around since before the dot com rollercoaster, choosing the right distribution partner can be a pivotal factor in your success. This definitive guide outlines the traits that every IT partner needs to look for in their IT Distributor.

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments