After the record-breaking attacks and botnets that recruit any exposed device, now comes BlackNurse, a new technique that goes in the opposite direction so to speak. Instead of attacking systems with thousands of infected devices, BlackNurse merely needs a laptop with a connection fast enough, between 15 and 18 megabits per second, to overload commercial firewalls and take a server out of combat.
The era of massive DDoS has begun, and the question is no longer “How?” but “When will the next one be?”. The effects of the Mirai malware were chilling, even though experts don't consider it a high-quality resource. The vulnerabilities present in the hardware cause havoc, manufacturers don't take the necessary precautions, and someone with minimal skills can create giant botnets in a matter of days. Still, we're talking about entire legions of devices. The key behind any DDoS is nothing more than brute force, saturating servers and mitigation systems alike. Now imagine a miniaturized DDoS. A single computer, less than 20 megabits per second. Most anti-DDoS platforms would eat it up like candy, unless the DDoS is more specialized.
What Is BlackNurse?
Let's make room for BlackNurse, a new attack reported by the folks at TDC SOC. A traditional DDoS relies on the ICMP protocol, through which a system is rapidly bombarded with packets of type 8 (echo request) with code 0. However, BlackNurse attacks with ICMP packets of type 3 (Destination Unreachable) with code 3 (Destination port unreachable). BlackNurse caught the attention of specialists because the traffic speed and the number of packets per second were very low compared to a normal DDoS, yet their clients were still taken off the network. The study concludes that with just a laptop connected to a 15-18 Mbps link (or 40,000 packets per second) is enough for BlackNurse to generate extreme load on the processors of several enterprise firewalls. Under those conditions, the firewalls drop such a large number of packets that the servers on the other side simply disconnect.
Mitigation
Fortunately, BlackNurse affects a limited number of firewalls and is easy to block, as long as administrators apply the appropriate filters. The problem is that these filters conflict with the recommendation of some manufacturers. The case cited in the study is that of Cisco, which suggests granting permissions to ICMP Type 3, because otherwise the Path MTU Discovery is disabled, which in turn affects IPSec and PPTP traffic. In reality, it is enough to block ICMP Type 3 except for Code 4 (Fragmentation required). There are certain conditions regarding performance loss, but everything seems to indicate that BlackNurse can be contained without major upsets.
