The evil creativity of malicious people doesn’t have a limit. New malware and techniques for executing attacks appear constantly, and more people experience the unfortunate consequences.
The Smurf attack is not new on the radar, but it keeps harming victims. Understanding how it works is the first step to design an efficient security strategy to protect your business.
What is a Smurf attack?
The Smurf attack belongs to the category of Distributed Denial of Service (DDoS) attacks. It was called like that due to the Smurf malware used to execute it. Its objective is to bring down computer networks, so their resources can’t be available for legit users. The vulnerability it exploits belongs to the Internet Control Message Protocol (ICMP).
When a victim suffers a Smurf attack, it means one of its servers is getting flooded with a massive amount of queries through the ICMP. Those queries are sent using a fake IP address of the victim to a specific computer or multiple ones to amplify the attack. When all the computers answer to the server, traffic will grow in such amount that the server’s resources will be consumed so much faster than normal, and the victim will be taken down.
What’s the role of ICMP on a Smurf attack?
ICMP is mean to enable the Smurf attack. The ICMP complies with different tasks. We will go directly to the ones that allow criminals to enable the Smurf attack.
- It allows bugs’ diagnosis and reports via sending data packets from the receiver to the sender.
- Through it, devices can identify communication issues.
- With ICMP, just like with the Ping command, you can produce an echo to check if a specific device is reachable or not. You just need to send an echo request (message) to that device you are interested in and wait for the acknowledgment or echo reply.
The problem that plays a big advantage for criminals is that ICMP doesn’t include the security handshake in its functionality. Then, devices don’t have a way to verify whether the queries they get are legit or not. Besides, to have ICMP data packets going around networks is part of the normal routine, based on the diagnosis, report, and more functions ICMP complies with. Rarely, a firewall will stop an ICMP packet. And that’s another advantage for attackers.
How does a Smurf attack work?
A Smurf attack starts with the Smurf malware (software) that is used to direct big loads of traffic to the victim’s server. It will replace the IP address of data packets with the forged IP address of the victim.
Data packets will go to a router’s broadcast IP address for being sent to every device connected to the network, so the attack gets amplified.
Then, those devices that received the data packets will answer to the victim’s server due to the forged IP address attached to the packets. The number of queries coming from devices on a big network can be nuts! And that is exactly the criminals’ purpose.
All these not-required queries will conflict with the victim. It will be harder to process them. Its resources, starting with bandwidth, will be over. The server goes down.
Because of this modus operandi, a Smurf attack is also defined as a resource consumer attack. This is because all the ping traffic produced by the ICMP echoes won’t leave bandwidth enough to serve legit users.
Conclusion.
A smurf attack is a dangerous DDoS. To think it can’t happen to your business is a big mistake. Better be aware and have a plan to prevent!
