2

So I've been reading up on Mirai. And I found out that it implements a rather unique attack, described here, where it floods the victim with GRE packets. GRE is IP protocol number 47.

Now here's what I don't understand. Namely. Wouldn't the security groups on literally any webserver anyone would ever set up ever just throw out packets with non-standard protocol numbers (i.e. anything except TCP, UDP, and ICMP)? Shouldn't these be trivial to block with a firewall? I just don't get how these could be an effective DDOS considering how easy they are to filter by firewall/security group. What am I missing here?

Improve this question

1 Answer 1

Reset to default
1

Small amounts of unwanted traffic are easy to filter with a firewall as long as it's distinguisable from wanted traffic, which would be the case here with GRE.

The point you're missing is that the victim is receiving much more traffic than it can handle. So much more that all uplinks are saturated, so valid traffic isn't coming through to the destination anymore. Filtering at the end point is useless then, so you need other, complexer strategies like scrubbing or upstream filtering to deal with these kinds of attacks.

Improve this answer
2
  • So why do you figure the botnet would have used GRE packets? How could they possibly be any better than a SYN flood?
    – Elliot Gorokhovsky
    Commented Dec 5, 2016 at 15:54
  • There doesn't have to be a reason, and I can only speculate, but one could be that some of the simpler firewalls only focus on blocking ports in UDP and TCP and may forget other protocols. Another one could be that it may be less easy to attack in the networks being used to do the DDoS, GRE traffic can be bursty.
    – Teun Vink
    Commented Dec 5, 2016 at 19:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .