SNMP Reflected Amplification DDoS Attacks

Wed, 31 Jul 2013 00:00:00 +0000

Just recently on the NANOG mailing list a discussion popped up titled “SNMP DDoS: the vulnerability you might not know you have“.
There’s a couple of points here:

a) if you’re interested in the technical details of these attacks (and mitigation advice), pls see this excellent technical report the Broadband Internet Technical Advisory Group published last year (apparently Comcast had observed such attacks before).

b) Daniel and I gave a talk on attacking SNMP at HITB Dubai 2007 (Hi Amy & Dhillon! 😉) laying out the basic idea for that type of attack and we later described it in a bit more detail at ShmooCon 2009 where we even demoed it publicly (camera recording stopped at that point, for obvious reasons). We used (a slightly modified version of) this tool.
From the research we did at the time we can confirm this was/presumably still is a huge problem, at least for European carriers’ broadband segments (acting as amplifiers).

SNMP on Insinuator.net - Bold Statements

SNMP Reflected Amplification DDoS Attacks