Difference between Amplification and Reflection Attack?

Question

• Reflection Attack: Reflection attacks are attacks that use the same protocol in both directions. The attacker spoofs the victim’s IP address and sends a request for information via UDP to servers known to respond to that type of request. The server answers the request and sends the response to the victim’s IP address.

• Amplification Attack: Amplification attacks generate a high volume of packets to flood the target website without alerting the intermediary, by returning a large reply to a small request.

I got that Reflection attack Generate request to some servers and reflect those reply to the victims IP. But what I don't understand is, from the definition of Amplification attack it seems almost like Reflection attack.

So my question is, what's the core difference between Amplification and Reflection attack?

For your information, it is not similar as dns reflection attack vs DNS amplification attack because I am asking in terms of DOS not specifically DNS which makes it much broader than that question.

Answer 1

TL;DR: amplification attack is a reflection attack where the reply is larger than the the request.

---

Reflection attack is if the reply is send back to the claimed origin of the request. With a spoofed source IP the attacker can make the reflecting server send the reply to the selected victim.

Amplification is if the reply is larger then the request. An amplification attack is a kind of reflection attack, where the attacker sends a small request with a spoofed source IP address and then this results in a big (i.e. amplified) reply to the claimed source of the request, i.e. the victim. By using this amplification an attacker can use few resources to attack a large target - the higher the amplification factor is the less resources are needed by the attacker.

A currently widely discussed amplification attack is using an insecure setup of memcached and due to the protocol spoken by memcached in can result in an amplification factor of about 50.000. See Memcrashed - Major amplification attacks from UDP port 11211 for more details. Other protocols used in the past for amplification attacks were for example NTP or DNS.