| Name |
Amplification |
|
| Likelyhood of attack |
Typical severity |
| Medium |
High |
|
| Summary |
An adversary may execute an amplification where the size of a response is far greater than that of the request that generates it. The goal of this attack is to use a relatively few resources to create a large amount of traffic against a target server. To execute this attack, an adversary send a request to a 3rd party service, spoofing the source address to be that of the target server. The larger response that is generated by the 3rd party service is then sent to the target server. By sending a large number of initial requests, the adversary can generate a tremendous amount of traffic directed at the target. The greater the discrepancy in size between the initial request and the final payload delivered to the target increased the effectiveness of this attack. |
| Prerequisites |
This type of an attack requires the existence of a 3rd party service that generates a response that is significantly larger than the request that triggers it. |
| Solutions | To mitigate this type of an attack, an organization can attempt to identify the 3rd party services being used in an active attack and blocking them until the attack ends. This can be accomplished by filtering traffic for suspicious message patterns such as a spike in traffic where each response contains the same large block of data. Care should be taken to prevent false positive rates so legitimate traffic isn't blocked. |
| Related Weaknesses |
|
CWE ID
|
Description
|
| CWE-770 |
Allocation of Resources Without Limits or Throttling |
|
| Related CAPECS |
|
CAPEC ID
|
Description
|
| CAPEC-125 |
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target. |
|
| Taxonomy: ATTACK |
|
Entry ID
|
Entry Name
|
| 1498.002 |
Network Denial of Service:Reflection Amplification |
|