POSTER: Reflected attacks abusing honeypots
| Authors | |
|---|---|
| Year of publication | 2013 |
| Type | Article in Proceedings |
| Conference | Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security |
| MU Faculty or unit | |
| Citation | |
| Doi | http://dx.doi.org/10.1145/2508859.2512523 |
| Field | Informatics |
| Keywords | communication; data sharing; ddos attack; honeypot; mitigation; reflection |
| Attached files | |
| Description | We present the observation of distributed denial-of-service attacks that use reflection of the flooding traffic off reflectors. This type of attack was used in massive attacks against internet infrastructure of Czech Republic in March, 2013. Apart from common hosts in the network, honeypots were abused as the reflectors. It caused the false positive incident detection and helped attackers. Honeypots, which are by default set to accept any incoming network connection, unintentionally amplified the effect of reflection. We present an analysis of the attack from the point of view of honeypots and show the risks of having honeypots respond to any incoming traffic. We also discuss the possibilities of attack detection and mitigation and present lessons learned from handling the attack. We point out a lack of communication and data sharing during the observed attack. |
| Related projects: |