T1498.002 Reflection Amplification

Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target. This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address. This third-party server is commonly termed a reflector. An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim. Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used. Likewise, one or more reflectors may be used to focus traffic on the target.(Citation: Cloudflare ReflectionDoS May 2017) This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network.

Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack. Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers. The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume. Two prominent protocols that have enabled Reflection Amplification Floods are DNS(Citation: Cloudflare DNSamplficationDoS) and NTP(Citation: Cloudflare NTPamplifciationDoS), though the use of several others in the wild have been documented.(Citation: Arbor AnnualDoSreport Jan 2018) In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.(Citation: Cloudflare Memcrashed Feb 2018)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
DE.CM-01.02 Network traffic volume monitoring Mitigates T1498.002 Reflection Amplification
Comments
This diagnostic statement may block Denial of Service (DoS) attacks from occurring by adversaries that induces a reflection attack by sending packets to reflectors with the spoofed address of the victim. Filtering boundary traffic can be used to intercept incoming traffic and filtering out the attack traffic from the original traffic.
References
    PR.PS-01.04 Time services and synchronization Mitigates T1498.002 Reflection Amplification
    Comments
    NTP amplification is a specialized form of distributed denial-of-service (DDoS) reflection amplification attacks that exploits the Network Time Protocol (NTP) to overwhelm victims with high volumes of traffic. This diagnostic statement describes practice guidance to secure and manage time synchronization infrastructure. To mitigate this technique under best practice guidance, consider patching NTP Software to remove dangerous amplifying commands like monlist; enable authentication for NTP changes to mitigate anonymous abuse; filtering of inbound UDP port 123 prevents reception of NTP; limit access to NTP servers to just authorized hots rather than global organizational access to prevent potential wide-spread abuse of DDoS reflection attacks.
    References
      ID.IM-02.06 Accurate data recovery Mitigates T1498.002 Reflection Amplification
      Comments
      This diagnostic statement focuses on safeguarding IP addresses from potential attacks by adversaries targeting third party servers and causing DoS attacks. Additionally, the integration of third-party services is recommended to support the development of a comprehensive business continuity plan, ensuring an effective response to such incidents.
      References
        PR.IR-04.02 Availability and capacity management Mitigates T1498.002 Reflection Amplification
        Comments
        This diagnostic approach safeguards systems and network resources from adversaries seeking to block availability of services to user by attempting to conduct DoS attacks. Implementing mitigation strategies, such as filtering network traffic, enables blocking IP addresses and protocols used for transport.
        References
          PR.PS-01.04 Time services and synchronization Mitigates T1498.002 Reflection Amplification
          Comments
          NTP amplification is a specialized form of distributed denial-of-service (DDoS) reflection amplification attacks that exploits the Network Time Protocol (NTP) to overwhelm victims with high volumes of traffic. This diagnostic statement describes practice guidance to secure and manage time synchronization infrastructure. To mitigate this technique under best practice guidance, consider patching NTP Software to remove dangerous amplifying commands like monlist; enable authentication for NTP changes to mitigate anonymous abuse; filtering of inbound UDP port 123 prevents reception of NTP; limit access to NTP servers to just authorized hots rather than global organizational access to prevent potential wide-spread abuse of DDoS reflection attacks.
          References
            PR.IR-01.03 Network communications integrity and availability Mitigates T1498.002 Reflection Amplification
            Comments
            This diagnostic statement protects against Reflection Amplification through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
            References
              PR.PS-01.08 End-user device protection Mitigates T1498.002 Reflection Amplification
              Comments
              This diagnostic statement protects against Reflection Amplification through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
              References

                NIST 800-53 Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                CA-07 Continuous Monitoring mitigates T1498.002 Reflection Amplification
                CM-06 Configuration Settings mitigates T1498.002 Reflection Amplification
                SI-10 Information Input Validation mitigates T1498.002 Reflection Amplification
                SI-15 Information Output Filtering mitigates T1498.002 Reflection Amplification
                CM-07 Least Functionality mitigates T1498.002 Reflection Amplification
                AC-03 Access Enforcement mitigates T1498.002 Reflection Amplification
                AC-04 Information Flow Enforcement mitigates T1498.002 Reflection Amplification
                SC-07 Boundary Protection mitigates T1498.002 Reflection Amplification

                VERIS Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                action.hacking.variety.DoS Denial of service related-to T1498.002 Reflection Amplification
                action.malware.variety.DoS DoS attack related-to T1498.002 Reflection Amplification
                attribute.availability.variety.Degradation Performance degradation related-to T1498.002 Reflection Amplification
                attribute.availability.variety.Loss Loss related-to T1498.002 Reflection Amplification

                Azure Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                azure_ddos_protection Azure DDoS Protection technique_scores T1498.002 Reflection Amplification
                Comments
                This control can protect against network denial of service attacks.
                References
                azure_private_link Azure Private Link technique_scores T1498.002 Reflection Amplification
                Comments
                This control can protect against network denial of service attacks.
                References

                AWS Mappings

                Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                amazon_guardduty Amazon GuardDuty technique_scores T1498.002 Reflection Amplification
                Comments
                The following finding types in GuardDuty flag events where adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users. Backdoor:EC2/DenialOfService.UdpOnTcpPorts Backdoor:EC2/DenialOfService.UnusualProtocol Backdoor:EC2/DenialOfService.Udp Backdoor:EC2/DenialOfService.Tcp Backdoor:EC2/DenialOfService.Dns
                References
                  aws_config AWS Config technique_scores T1498.002 Reflection Amplification
                  Comments
                  The "elb-cross-zone-load-balancing-enabled" managed rule can verify that load balancing is properly configured, which can mitigate adversaries' ability to perform Denial of Service (DoS) attacks and impact resource availability. "cloudfront-origin-failover-enabled" can verify that failover policies are in place to increase CloudFront content availability. Coverage factor is minimal for these rules, since they are specific to a subset of the available AWS services, resulting in an overall score of Minimal.
                  References
                    aws_network_firewall AWS Network Firewall technique_scores T1498.002 Reflection Amplification
                    Comments
                    AWS Network Firewall has the ability to pass, drop, or alert on traffic based on the network protocol as well as perform deep packet inspection on the payload. This functionality can be used to block the sources of smaller-scale network denial of service attacks. This mapping is given a score of Minimal because often times it is necessary to block the traffic at an Internet Service Provider or Content Provider Network level.
                    References
                      aws_shield AWS Shield technique_scores T1498.002 Reflection Amplification
                      Comments
                      AWS Shield will set and use a static network flow threshold to detect incoming traffic to AWS services. This will reduce direct network DOS attacks by applying an undisclosed combination of traffic signatures, anomaly algorithms, and other analysis techniques to detect malicious traffic in real-time. AWS Shield Advance identifies anomalies in network traffic to flag attempted attacks and execute inline mitigations to resolve the issue.
                      References