How to prevent smurf atacks?

How to prevent smurf atacks?

[Francisco Alfonso Martinez Lopez]

Hi everybody,how I can denied smurf atacks over my host,it's a single 
connection to Internet,any possibilitie of denied smurf atack on the 
firewall?(my host execute dual boot:suse linux&windows)

Thanks in advance,folks!!(...and sorry for my english)



_________________________________________________________________
Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.

Re: How to prevent smurf atacks?

[Ramin Alidousti]

On Wed, Jun 05, 2002 at 01:27:41PM +0000, Francisco Alfonso Martinez Lopez wrote:

> 
> Hi everybody,how I can denied smurf atacks over my host,it's a single 
> connection to Internet,any possibilitie of denied smurf atack on the 
> firewall?(my host execute dual boot:suse linux&windows)

What exactly do you mean by "smurf attack"? Let us know and
the rules will follow...

Ramin

> 
> Thanks in advance,folks!!(...and sorry for my english)
> 
> 
> 
> _________________________________________________________________
> Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.
> 

Re: How to prevent smurf atacks?

[Nick Drage]

On Wed, Jun 05, 2002 at 01:27:41PM +0000, Francisco Alfonso Martinez Lopez wrote:

> Hi everybody,how I can denied smurf atacks over my host,it's a single
> connection to Internet,any possibilitie of denied smurf atack on the
> firewall?(my host execute dual boot:suse linux&windows)

A Smurf attack is effective just by the sheer weight of traffic sent to you,
rather than because of any weakness in your host, so unfortunately there is
nothing you can do on your host to harden it against this type of onslaught.

That's my understanding anyway, security related terms can become quite
imprecise over time, so I think we're discussing the same thing.

> Thanks in advance,folks!!(...and sorry for my english)

No problem :)

-- 
FunkyJesus System Administration Team

Re: How to prevent smurf atacks?

[Maciej Soltysiak]

> A Smurf attack is effective just by the sheer weight of traffic sent to you,
> rather than because of any weakness in your host, so unfortunately there is
> nothing you can do on your host to harden it against this type of onslaught.
How about:
- blocking ICMP directed at broadcast addreses?
- setting /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts to 1
- adding anti-spoofing rules, smurf attacks may have spoofed IPs, and that
  is when the attack gets its sharp edge. It may be spoofed as if it is
  originating from your network.

The same goes for fraggle attacks, those are UDP brodcast packets to
unserved ports with spoofed IPs.

If the destination and source IPs are in the same subnet, we can have
the net attacking itself.

I guess that is what we are talking about.

Regards,
Maciej Soltysiak

Re: How to prevent smurf atacks?

[Michael H. Warfield]

On Wed, Jun 05, 2002 at 09:53:03AM -0400, Ramin Alidousti wrote:
> On Wed, Jun 05, 2002 at 01:27:41PM +0000, Francisco Alfonso Martinez Lopez wrote:


> > Hi everybody,how I can denied smurf atacks over my host,it's a single 
> > connection to Internet,any possibilitie of denied smurf atack on the 
> > firewall?(my host execute dual boot:suse linux&windows)

> What exactly do you mean by "smurf attack"? Let us know and
> the rules will follow...

	A smurf attack is a spoofed ICMP packet (or possibly UDP packet,
but ICMP ECHO is the classic form) directed to a network broadcast address
and spoofed to be from the target.  The result is a flood of packets
from all the responding hosts hitting the target and potentially overwhelming
his bandwidth.  This is often referred to as smurf amplification and the
exploitable network referred to as a smurf amplifier.

	The prevention is to block directed (that is routed over a router)
broadcasts.  If he only has a single host with a single IP address, I don't
see how smurf affects him.  He could refuse to respond to any incoming
requests which are addressed to the broadcast address of the network
to which he's connected.  That would be a valid action on, say, a cable
modem where you are a member of a network.  But it only eliminates that
one IP address from participating.  I don't think it would be meaningful
if it were a dialup to an ISP where you just have a point to point
connection, though.

	The correct solution needs to be applied at the final (local)
router, though.  That is the device which should block any incoming
packets directed at the local broadcast address from outside of the
network.  Outside of that router, you can't reliably determine what
constitutes the local broadcast address and it's the single point where
external attacks can be stopped for the entire network.

> Ramin
> 
> > 
> > Thanks in advance,folks!!(...and sorry for my english)
> > 
> > 
> > 
> > _________________________________________________________________
> > Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.
> > 

-- 
 Michael H. Warfield    |  (770) 985-6132   |  mhw@WittsEnd.com
  /\/\|=mhw=|\/\/       |  (678) 463-0932   |  http://www.wittsend.com/mhw/
  NIC whois:  MHW9      |  An optimist believes we live in the best of all
 PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!

Re: How to prevent smurf atacks?

[Nick Drage]

On Wed, Jun 05, 2002 at 04:04:06PM +0200, Maciej Soltysiak wrote:
> > A Smurf attack is effective just by the sheer weight of traffic sent to
> > you, rather than because of any weakness in your host, so unfortunately
> > there is nothing you can do on your host to harden it against this type
> > of onslaught.

> How about:
> - blocking ICMP directed at broadcast addreses?

Yes, but that stops you being a source of a smurf attack, rather than the
victim.  I think the original poster didn't want to be a victim, which I
don't think you can prevent bar blocking ICMP from broadcast addresses at
the borders ( where "broadcast addresses" isn't as easy to determine as I
imply ).

Of course, stopping yourself being a source of the problem is good too :)

> - setting /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts to 1

:)

> - adding anti-spoofing rules, smurf attacks may have spoofed IPs, and that
>   is when the attack gets its sharp edge. It may be spoofed as if it is
>   originating from your network.

No they won't, they'll be spoofed as the IP address of the victim.  Well,
unless one of your IP addresses is the intended victim, but that strikes me
as unlikely - and it'd be hard to spot without MAC address checking rules
anyway.

> The same goes for fraggle attacks, those are UDP brodcast packets to
> unserved ports with spoofed IPs.
> 
> If the destination and source IPs are in the same subnet, we can have
> the net attacking itself.
> 
> I guess that is what we are talking about.

Sort of.  I think.  Probably.  Not that this is another vague term or
anything :)

-- 
FunkyJesus System Administration Team

Re: How to prevent smurf atacks?

[Ramin Alidousti]

On Wed, Jun 05, 2002 at 10:05:33AM -0400, Michael H. Warfield wrote:

> On Wed, Jun 05, 2002 at 09:53:03AM -0400, Ramin Alidousti wrote:
> > On Wed, Jun 05, 2002 at 01:27:41PM +0000, Francisco Alfonso Martinez Lopez wrote:
> 
> 
> > > Hi everybody,how I can denied smurf atacks over my host,it's a single 
> > > connection to Internet,any possibilitie of denied smurf atack on the 
> > > firewall?(my host execute dual boot:suse linux&windows)
> 
> > What exactly do you mean by "smurf attack"? Let us know and
> > the rules will follow...
> 
> 	A smurf attack is a spoofed ICMP packet (or possibly UDP packet,
> but ICMP ECHO is the classic form) directed to a network broadcast address
> and spoofed to be from the target.  The result is a flood of packets
> from all the responding hosts hitting the target and potentially overwhelming
> his bandwidth.  This is often referred to as smurf amplification and the
> exploitable network referred to as a smurf amplifier.
> 
> 	The prevention is to block directed (that is routed over a router)
> broadcasts.  If he only has a single host with a single IP address, I don't
> see how smurf affects him.  He could refuse to respond to any incoming
> requests which are addressed to the broadcast address of the network

or originating from a broadcast source which make you participate
in the attack (where you become the bad guy)...

> to which he's connected.  That would be a valid action on, say, a cable
> modem where you are a member of a network.  But it only eliminates that
> one IP address from participating.  I don't think it would be meaningful
> if it were a dialup to an ISP where you just have a point to point
> connection, though.

See above.

> 
> 	The correct solution needs to be applied at the final (local)
> router, though.  That is the device which should block any incoming
> packets directed at the local broadcast address from outside of the
> network.  Outside of that router, you can't reliably determine what
> constitutes the local broadcast address and it's the single point where
> external attacks can be stopped for the entire network.

Excellent. By this definition, I think it's doable to come up with
rules to minimize the affects of this kind of attack.

BTW, the reason I asked the original poster for his definition of this
term was that I had the feeling that he'd heard the term but didn't know
what it was and was only looking for a off-the-shelf rule set. It sounded
like "how can I set up a firewall" or "how can I protect my network from
bad guys". If I was wrong about this assumption, my apologies to the
original poster :-)

Ramin

> > > Thanks in advance,folks!!(...and sorry for my english)
> > > 
> > > 
> > > 
> > > _________________________________________________________________
> > > Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp.
> > > 
> 
> -- 
>  Michael H. Warfield    |  (770) 985-6132   |  mhw@WittsEnd.com
>   /\/\|=mhw=|\/\/       |  (678) 463-0932   |  http://www.wittsend.com/mhw/
>   NIC whois:  MHW9      |  An optimist believes we live in the best of all
>  PGP Key: 0xDF1DD471    |  possible worlds.  A pessimist is sure of it!