3

I was reading the Wikipedia article on Smurf attack. As far as I understand, the only protection from a smurf attack is to rely on other people to configure their hosts in a way that these hosts won't participate in a smurf attack.

That is, you need to trust others to protect your computers.

If that's the case, I feel like there should be some kind of enforcement on hosts to indeed make the configurations for a collective network security. Because in theory, an admin can say: "like a give a damm about what happens to other people" and refuse to configure his network to prevent to participate in such types of attacks. I know that it would be a very pointless act but in theory it can happen.

So my question is, are there such enforcement policies?

4

No, there are is no technical enforcement for such attacks (I take you mention the Smurf attack as an example).

TCP/IP comes from a place where the reliability of the network was key, not its security. This is why there are no basic security elements built into the protocol and, historically, we relied on "best practices" (like the one to change the default for routers in the case of the Smurf attack) to protect ourselves and others. Some protocols were also changed to disable malicious behavior which was not thought of initially.

There are however organisational ways to address such issues, a typical one being blacklists of various sorts. This does not work too well, is hardly scaleable but this is the best we have today.

4

Attacks similar to smurf exist outside of computers and there is no technical enforcement either by default. Just imagine that somebody is subscribing you to 100's of mail order catalogs, with the result that your post box will overflow quickly.

The usual way to deal with this is to react once the possible vulnerability gets actively used and then try to add filters or rules to fight such an attack. This might be a better screening of subscriptions or the requirement to verify first that the potential recipient really ordered the catalogs. It might be laws which make breaking the rules not impossible but painful enough for the attacker to deter potential followers etc. And the same way it is done with computers, i.e. add filters to block harmful data (like filtering out source spoofed packets), add IDS to find out the origin of an attack etc.

  • "It might be laws which make breaking the laws not impossible but painful enough for the attacker to deter potential followers etc." I couldn't understand what this means. – Utku Nov 11 '15 at 10:56
  • @Utku: I've meant "breaking the rules" ... it's like with laws against stealing: no technical measures can deter all stealing, but if you punish breaking the law hard enough than most others will refrain from breaking it. – Steffen Ullrich Nov 11 '15 at 11:12
  • Ah I see. But the approach in your answer is to find the original attacker and somehow punish him right? – Utku Nov 11 '15 at 11:28
  • @Utku: yes, either make sure that the attack does not affect you (i.e. filter) or make sure that nobody tries the attack (i.e. punish attackers). This is no different from physical security against burglary where you have locks (filter attack) and laws (punish attacker). – Steffen Ullrich Nov 11 '15 at 11:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.