DDoS amplification attacks¶
Attack pattern¶
Amplification turns a whisper into a flood by making someone else do the shouting. UDP asks nothing about who sent a request, so an attacker forges the victim’s address, sends a small query to a service that answers at length, DNS, NTP, memcached, and the service dutifully fires its large reply at the victim. A few megabits of forged requests become tens of gigabits of unsolicited answers, arriving from thousands of innocent servers rather than from the attacker at all.
1. DDoS amplification attack vectors [OR]
1.1 Protocol exploitation [OR]
1.1.1 DNS amplification
1.1.1.1 Open resolver exploitation
1.1.1.2 ANY query manipulation
1.1.1.3 DNSSEC record exploitation
1.1.2 NTP amplification
1.1.2.1 MONLIST command abuse
1.1.2.2 Time server reflection
1.1.2.3 Protocol version exploitation
1.1.3 Memcached amplification
1.1.3.1 UDP port 11211 exploitation
1.1.3.2 Unauthenticated access abuse
1.1.3.3 Extreme amplification factors (up to 51,000x)
1.2 Service-specific amplification [OR]
1.2.1 CLDAP exploitation
1.2.1.1 Connectionless LDAP reflection
1.2.1.2 Directory service abuse
1.2.1.3 Intermediate amplification factors
1.2.2 SSDP amplification
1.2.2.1 Universal Plug and Play abuse
1.2.2.2 IoT device exploitation
1.2.2.3 Discovery service manipulation
1.2.3 SNMP amplification
1.2.3.1 GetBulk request exploitation
1.2.3.2 Network device reflection
1.2.3.3 Management protocol abuse
1.3 Emerging protocol exploitation [OR]
1.3.1 TFTP amplification
1.3.1.1 Trivial file transfer protocol abuse
1.3.1.2 Configuration file retrieval attacks
1.3.1.3 Amplification factor of approximately 60x
1.3.2 WS-Discovery amplification
1.3.2.1 Web services protocol exploitation
1.3.2.2 SOAP message reflection
1.3.2.3 Moderate to high amplification factors
1.3.3 RIPv1 amplification
1.3.3.1 Routing protocol exploitation
1.3.3.2 Malformed request attacks
1.3.3.3 Network infrastructure targeting
1.4 Attack coordination techniques [OR]
1.4.1 Botnet deployment
1.4.1.1 IoT device recruitment
1.4.1.2 Zombie network utilisation
1.4.1.3 Command and control infrastructure
1.4.2 Source spoofing
1.4.2.1 IP address forgery
1.4.2.2 Reflection path obfuscation
1.4.2.3 Attribution prevention
1.4.3 Protocol combination
1.4.3.1 Multi-vector attack strategies
1.4.3.2 Simultaneous protocol exploitation
1.4.3.3 Defence evasion techniques
1.5 Amplification factor optimisation [OR]
1.5.1 Payload manipulation
1.5.1.1 Maximum response triggering
1.5.1.2 Protocol-specific optimisation
1.5.1.3 Bandwidth multiplication techniques
1.5.2 Reflector recruitment
1.5.2.1 Internet scanning for vulnerable services
1.5.2.2 Reflector pool maintenance
1.5.2.3 High-capacity server targeting
1.5.3 Timing synchronisation
1.5.3.1 Pulse attack coordination
1.5.3.2 Burst transmission techniques
1.5.3.3 Rate limiting evasion
1.6 Evasion and persistence [OR]
1.6.1 Detection avoidance
1.6.1.1 Legitimate-looking traffic mimicry
1.6.1.2 Low-rate attack variants
1.6.1.3 Protocol compliance maintenance
1.6.2 Source rotation
1.6.2.1 Reflector switching
1.6.2.2 IP address variation
1.6.2.3 Geographic distribution
1.6.3 Adaptive techniques
1.6.3.1 Defence counter-response
1.6.3.2 Mitigation evasion
1.6.3.3 Persistent attack maintenance
1.7 Application layer targeting [OR]
1.7.1 HTTP amplification
1.7.1.1 Web server reflection
1.7.1.2 Application-specific exploitation
1.7.1.3 Layer 7 attack vectors
1.7.2 Database service exploitation
1.7.2.1 MSSQL amplification
1.7.2.2 Query response manipulation
1.7.2.3 Database protocol abuse
1.7.3 API abuse
1.7.3.1 Web service exploitation
1.7.3.2 REST API manipulation
1.7.3.3 JSON/XML response amplification
1.8 Infrastructure exploitation [OR]
1.8.1 Cloud service abuse
1.8.1.1 Cloud-based reflector recruitment
1.8.1.2 Auto-scaling exploitation
1.8.1.3 Platform service manipulation
1.8.2 IoT device exploitation
1.8.2.1 Embedded device reflection
1.8.2.2 Consumer device abuse
1.8.2.3 Limited-security device targeting
1.8.3 Network device targeting
1.8.3.1 Router and switch exploitation
1.8.3.2 Management interface abuse
1.8.3.3 Infrastructure protocol manipulation
1.9 Advanced attack methodologies [OR]
1.9.1 Recursive amplification
1.9.1.1 Multi-stage reflection
1.9.1.2 Chain reaction techniques
1.9.1.3 Exponential amplification methods
1.9.2 Zero-day protocol exploitation
1.9.2.1 Unknown vulnerability abuse
1.9.2.2 Emerging protocol targeting
1.9.2.3 Protocol implementation flaws
1.9.3 State-exhaustion techniques
1.9.3.1 Connection table flooding
1.9.3.2 Session exhaustion attacks
1.9.3.3 Resource depletion methods
1.10 Criminal ecosystem operations [OR]
1.10.1 DDoS-for-hire services
1.10.1.1 Booter service utilisation
1.10.1.2 Stresser platform abuse
1.10.1.3 Commercial attack services
1.10.2 Ransom operations
1.10.2.1 Extortion campaign support
1.10.2.2 Financial motivation techniques
1.10.2.3 Payment coercion methods
1.10.3 Hacktivist coordination
1.10.3.1 Politically motivated attacks
1.10.3.2 Activist group coordination
1.10.3.3 Ideological targeting
Someone else does the shouting¶
UDP does not check who is asking. Without source validation, spoofing the victim’s address is trivial.
Some services answer far larger than they are asked: memcached has reached roughly 51,000 times amplification, turning a trickle into a torrent.
Reflectors are everywhere. Millions of open, misconfigured services stand ready to be pointed at a target.
The real source stays hidden behind the reflectors, which makes attribution and takedown hard.
Booter and stresser services sell this by the minute, so no skill is required to launch it.
The internet’s own scale supplies the bandwidth and the reflection points.