Boris Sieklik
Evaluation of TFTP DDoS amplification attack
Sieklik, Boris; Macfarlane, Richard; Buchanan, William J.
Authors
Rich Macfarlane R.Macfarlane@napier.ac.uk
Associate Professor
Prof Bill Buchanan B.Buchanan@napier.ac.uk
Professor
Abstract
Web threats are becoming a major issue for both governments and companies. Generally, web threats increased as much as 600% during last year (WebSense, 2013). This appears to be a significant issue, since many major businesses seem to provide these services. Denial of Service (DoS) attacks are one of the most significant web threats and generally their aim is to waste the resources of the target machine (Mirkovic & Reiher, 2004). Dis-tributed Denial of Service (DDoS) attacks are typically executed from many sources and can result in large traf-fic flows. During last year 11% of DDoS attacks were over 60 Gbps (Prolexic, 2013a). The DDoS attacks are usually performed from the large botnets, which are networks of remotely controlled computers. There is an increasing effort by governments and companies to shut down the botnets (Dittrich, 2012), which has lead the attackers to look for alternative DDoS attack methods. One of the techniques to which attackers are returning to is DDoS amplification attacks. Amplification attacks use intermediate devices called amplifiers in order to amplify the attacker's traffic. This work outlines an evaluation tool and evaluates an amplification attack based on the Trivial File Transfer Proto-col (TFTP). This attack could have amplification factor of approximately 60, which rates highly alongside other researched amplification attacks. This could be a substantial issue globally, due to the fact this protocol is used in approximately 599,600 publicly open TFTP servers. Mitigation methods to this threat have also been consid-ered and a variety of countermeasures are proposed. Effects of this attack on both amplifier and target were analysed based on the proposed metrics. While it has been reported that the breaching of TFTP would be possible (Schultz, 2013), this paper provides a complete methodology for the setup of the attack, and its verification.
Citation
Sieklik, B., Macfarlane, R., & Buchanan, W. J. (2016). Evaluation of TFTP DDoS amplification attack. Computers and Security, 57, 67-92. https://doi.org/10.1016/j.cose.2015.09.006
Journal Article Type | Article |
---|---|
Acceptance Date | Sep 11, 2015 |
Online Publication Date | Oct 30, 2015 |
Publication Date | 2016-03 |
Deposit Date | Sep 8, 2015 |
Print ISSN | 0167-4048 |
Publisher | Elsevier |
Peer Reviewed | Peer Reviewed |
Volume | 57 |
Pages | 67-92 |
DOI | https://doi.org/10.1016/j.cose.2015.09.006 |
Keywords | TFTP; cybersecurity; computer programmes and software; risk management; DDoS |
Public URL | http://researchrepository.napier.ac.uk/id/eprint/8746 |
You might also like
Evaluation of the DFET Cloud.
(2015)
Presentation / Conference Contribution
Teaching penetration and malware analysis in a cloud-based environment.
(2015)
Presentation / Conference Contribution
Evaluating Digital Forensic Tools (DFTs).
(2014)
Presentation / Conference Contribution
A forensic image description language for generating test images.
(2012)
Presentation / Conference Contribution
Downloadable Citations
About Edinburgh Napier Research Repository
Administrator e-mail: repository@napier.ac.uk
This application uses the following open-source libraries:
SheetJS Community Edition
Apache License Version 2.0 (http://www.apache.org/licenses/)
PDF.js
Apache License Version 2.0 (http://www.apache.org/licenses/)
Font Awesome
SIL OFL 1.1 (http://scripts.sil.org/OFL)
MIT License (http://opensource.org/licenses/mit-license.html)
CC BY 3.0 ( http://creativecommons.org/licenses/by/3.0/)
Powered by Worktribe © 2025
Advanced Search