Skip to main content

Research Repository

Advanced Search

Evaluation of TFTP DDoS amplification attack

Sieklik, Boris; Macfarlane, Richard; Buchanan, William J.


Boris Sieklik


Web threats are becoming a major issue for both governments and companies. Generally, web threats increased as much as 600% during last year (WebSense, 2013). This appears to be a significant issue, since many major businesses seem to provide these services. Denial of Service (DoS) attacks are one of the most significant web threats and generally their aim is to waste the resources of the target machine (Mirkovic & Reiher, 2004). Dis-tributed Denial of Service (DDoS) attacks are typically executed from many sources and can result in large traf-fic flows. During last year 11% of DDoS attacks were over 60 Gbps (Prolexic, 2013a). The DDoS attacks are usually performed from the large botnets, which are networks of remotely controlled computers. There is an increasing effort by governments and companies to shut down the botnets (Dittrich, 2012), which has lead the attackers to look for alternative DDoS attack methods. One of the techniques to which attackers are returning to is DDoS amplification attacks. Amplification attacks use intermediate devices called amplifiers in order to amplify the attacker's traffic. This work outlines an evaluation tool and evaluates an amplification attack based on the Trivial File Transfer Proto-col (TFTP). This attack could have amplification factor of approximately 60, which rates highly alongside other researched amplification attacks. This could be a substantial issue globally, due to the fact this protocol is used in approximately 599,600 publicly open TFTP servers. Mitigation methods to this threat have also been consid-ered and a variety of countermeasures are proposed. Effects of this attack on both amplifier and target were analysed based on the proposed metrics. While it has been reported that the breaching of TFTP would be possible (Schultz, 2013), this paper provides a complete methodology for the setup of the attack, and its verification.

Journal Article Type Article
Acceptance Date Sep 11, 2015
Online Publication Date Oct 30, 2015
Publication Date 2016-03
Deposit Date Sep 8, 2015
Print ISSN 0167-4048
Electronic ISSN 0167-4048
Publisher Elsevier
Peer Reviewed Peer Reviewed
Volume 57
Pages 67-92
Keywords TFTP; cybersecurity; computer programmes and software; risk management; DDoS
Public URL
Publisher URL