UDP-Based Amplification Attacks ( overwhelming a victim’s system with UDP traffic)

[LASER_oneXM]

Systems Affected
Certain application-layer protocols that rely on the User Datagram Protocol (UDP) have been identified as potential attack vectors. These include

• Domain Name System (DNS),
• Network Time Protocol (NTP),
• Connection-less Lightweight Directory Access Protocol (CLDAP),
• Character Generator Protocol (CharGEN),
• Simple Service Discovery Protocol (SSDP),
• BitTorrent,
• Simple Network Management Protocol version 2 (SNMPv2),
• Kad,
• Portmap/Remote Procedure Call (RPC),
• Quote of the Day (QOTD),
• Multicast Domain Name System (mDNS),
• Network Basic Input/Output System (NetBIOS),
• Quake Network Protocol,
• Steam Protocol,
• Routing Information Protocol version 1 (RIPv1),
• Lightweight Directory Access Protocol (LDAP),
• Trivial File Transfer Protocol (TFTP), and
• Memcache.

Overview


A distributed reflective denial-of-service (DRDoS) is a form of distributed denial-of-service (DDoS) attack that relies on publicly accessible UDP servers and bandwidth amplification factors (BAFs) to overwhelm a victim’s system with UDP traffic.

Detection

Detection of DRDoS attacks is not easy because of their use of large, trusted servers that provide UDP services. Network operators of these exploitable services may apply traditional DoS mitigation techniques. To detect a DRDoS attack, watch out for abnormally large responses to a particular IP address, which may indicate that an attacker is using the service.

There are a few things victims of DRDoS attacks can do to detect such activity and respond:
..
....
...
......