I am trying to understand reflection attacks but unfortunately wikipedia is too vague. I understand that in such an attack the attacker tries to authenticate with the target but does so in such a way that the target authentication system's challenge is sent to a spoofed client (instead of to the attacker). I also understand that this can somehow cause a loop or DOS. But I'm missing the details. Can someone explain how this works?
So these are two quite different things, the first is a classification of protocol exploit, the second is a method sometimes employed by DDoSsers. I give examples of both.
The classic example used to explain the concept of a reflection attack is the MIG in the middle.
How it should work
A military decides to implement a system that allows them to tell immediately if an aircraft on their radar is a good guy or a bad guy (referred to as Identify Friend from Foe (IFF) systems).
The system they implement goes something like;
Since only friendly aircraft know the value of the secret key
Otherwise, Alice knows that Bob must have known the value of
This process can be repeated in reverse so that Alice and Bob are mutually authenticated.
This system as it stands is completely broken, but lets first focus on the reflection attack you asked about.
The Reflection Attack
An enemy aircraft can defeat the system by reflecting the challenge back to some other member of the good guys team.
At the 4th interaction, Bob has authenticated himself to Alice who lets him fly past peacefully. Bob did this without knowledge of
Replay: If the values of
Brute Force: Bob will probably be aware of the derivation function
A basic Denial of Service attack is essentially a traffic flood, designed to exhaust bandwidth, memory or other resources at the target machine.
The idea is that the attacker is in control of a significantly larger amount of bandwidth than the victim, and so can easily overwhelm the victim.
The attacker can make life easier by using a technique referred to as traffic amplification by reflecting his traffic from one or more third-party machines.
It looks something like;
The attacker sends a message
If the magnitude of of the reply
I use the term 'magnitude' here to indicate that it can be anything: number of connections, data bandwidth, packet frequency etc. The point is if
If the attacker can use a large number of third parties simultaneously, such that the attacker's bandwidth is fully consumed, then he has truly multiplied his attack potency.