Blacknurse – Low bandwidth ICMP firewall attack(blacknurse.dk)
blacknurse.dk
Blacknurse – Low bandwidth ICMP firewall attack
http://blacknurse.dk/
21 comments
@realkitkat the name Blacknurse was chosen because the guy who found it is educated as a nurse, and always used black t-shirts
It's somewhat strange to see pfSense and the likes not being affected, yet expensive Cisco hardware gets killed by it...
how can i test some of the server i use?
Run the commands from the article?
hping3 -1 -C 3 -K 3 -i u20 <target ip>
ofc that assumes you have access to hping/hping3. I plan to check my own server as soon as I can.
hping3 -1 -C 3 -K 3 -i u20 <target ip>
ofc that assumes you have access to hping/hping3. I plan to check my own server as soon as I can.
Looks like ASA >= 9.2.4 ships with `icmp unreachable rate-limit 1 burst-size 1`, which is I believe the workaround Cisco suggests:
We recommend that you grant permission for the ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPsec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery
We recommend that you grant permission for the ICMP unreachable message type (type 3). Denying ICMP unreachable messages disables ICMP Path MTU discovery, which can halt IPsec and PPTP traffic. See RFC 1195 and RFC 1435 for details about Path MTU Discovery
[deleted]
[1] has some more explanation.
> Even a single computer can take down big servers using BlackNurse Attack (...) Researchers at TDC Security Operations Center have discovered a new attack technique that lone attackers with limited resources (in this case, a laptop and at least 15Mbps of bandwidth) can use to knock large servers offline. (...)
> By sending a Type 3 ICMP packets with a code of 3, a hacker can cause a Denial of Service (DoS) state by overloading the CPUs of certain types of server firewalls, regardless of the quality of internet connection. The BlackNurse traffic volume is very small, ranging from 15 Mbps to 18 Mbps (or about 40,000 to 50,000 packets per second), which is laughable compared to record-breaking 1.1 Tbps DDoS attack recorded against French Internet service provider OVH in September.
[1]: http://thehackernews.com/2016/11/dos-attack-server-firewall....
> Even a single computer can take down big servers using BlackNurse Attack (...) Researchers at TDC Security Operations Center have discovered a new attack technique that lone attackers with limited resources (in this case, a laptop and at least 15Mbps of bandwidth) can use to knock large servers offline. (...)
> By sending a Type 3 ICMP packets with a code of 3, a hacker can cause a Denial of Service (DoS) state by overloading the CPUs of certain types of server firewalls, regardless of the quality of internet connection. The BlackNurse traffic volume is very small, ranging from 15 Mbps to 18 Mbps (or about 40,000 to 50,000 packets per second), which is laughable compared to record-breaking 1.1 Tbps DDoS attack recorded against French Internet service provider OVH in September.
[1]: http://thehackernews.com/2016/11/dos-attack-server-firewall....
To what extent are AWS EC2 servers affected?
The question is not the AWS instances themselves, but VPC networking.
no reason to believe they are vulnerable.
Sounds like a really inefficient data structure in stateful firewalls.
It seems that ZyWall USG 50 requires less than 10 Mbit/s of traffic to go totally braindead due to CPU load. - This attack works like a charm, and 10 Mbit/s is quite much less than reported 180 Mbit/s.
There's generic name for these attacks: Resource consumption attack.
There's generic name for these attacks: Resource consumption attack.
Duplicate of https://news.ycombinator.com/item?id=12918897
duplicates are explicitly allowed if previous submission had no traction. Please don't link to "duplicates" if there is neither a discussion nor there has been excess amount of them.
Haha, nice of you to promote your own empty thread rather than accepting the one actually on the homepage.
The lesson here: The title matters.
To be honest I've always been pretty amazed that the web doesn't fall apart much more easily than it actually does.
The fact is that most sites work only with some kind of caching in front of them at any scale; my guess would be on a site by site basis there will be a slow performing piece of code somewhere that can be exploited with low resources on the part of the attacker.
In a lot of cases, simply creating a session a couple of 100000 in a short enough space of time, would be enough to overload the majority of sites...
The fact is that most sites work only with some kind of caching in front of them at any scale; my guess would be on a site by site basis there will be a slow performing piece of code somewhere that can be exploited with low resources on the part of the attacker.
In a lot of cases, simply creating a session a couple of 100000 in a short enough space of time, would be enough to overload the majority of sites...
These aren't web technologies at all, but firewall issues. This doesn't have anything to do with websites being inefficient, but how some firewalls handle some ICMP edge cases. I feel like the complexity of IPv4/6 is high and stuff like this will continue to be found. If you want a world-wide networking protocol, you need to deal with complexity, and complexity comes with issues like this.
We should be geared up to fix stuff like this via quick patching. This stuff shouldn't be terribly surprising. I think the idea of "install and forget" for any internet enabled device is a dangerous line of thinking, especially for firewalls.
We should be geared up to fix stuff like this via quick patching. This stuff shouldn't be terribly surprising. I think the idea of "install and forget" for any internet enabled device is a dangerous line of thinking, especially for firewalls.
Yes, I know that... my point is if you wanted you could take down Hacker News for example; pretty easy if you thought about it for a while right? You don't need this bug or a massive botnet.
Botnets are a lot simpler to wield and make you a more credible threat vs a website who thinks they have no "slow code", but to who 1TB/sec would certainly do the trick.
55XX are problematic: http://www.blacknurse.dk/testresults.txt
So, what's the current recommendation on accepting public ICMP these days? There used to be some debate on the tradeoff between usefulness and security.
> So, what's the current recommendation on accepting public ICMP these days?
The recommendation is to accept ALL ICMP traffic, from everywhere, to everywhere, whatever it is.
I've wasted too much time debugging tricky network issues because a dude thought that blocking ICMP was a great idea.
The recommendation is to accept ALL ICMP traffic, from everywhere, to everywhere, whatever it is.
I've wasted too much time debugging tricky network issues because a dude thought that blocking ICMP was a great idea.
http://shouldidisableicmp.com
ICMP types 3 and 4 should always be allowed.
At your discretion, you may allow other types as well.
Inbound, I allow types 0, 3, 4, 8, and 11, but I'm a network engineer. A paranoid security guy may prefer to block some of those.
ICMP types 3 and 4 should always be allowed.
At your discretion, you may allow other types as well.
Inbound, I allow types 0, 3, 4, 8, and 11, but I'm a network engineer. A paranoid security guy may prefer to block some of those.
For IPv4, yes.
ICMP is required to route ipv6 correctly.
It's required for v4 too, if you want PMTU discovery to work.
Huh. The solution is to not handle icmp type 3 or "hire official anti-ddos services"? I assume there's a way to maintain ICMP type 3 functionality while still mitigating this attack...?
Given that there's a list of products unaffected by this attack, I assume it can be fixed without impacting functionality. It seems like a widespread implementation problem, rather than an inherent design flaw.
I was thinking you can block ICMP 3/3 if an IP address is used for ingress only (TCP/UDP server)
Blocking ICMP type 3 breaks path MTU discovery. When the path MTU is less than the server's MTU, the client will typically send a request which is smaller than the path MTU and then the server's response isn't so it's the server that gets the ICMP message.
Blocking type 3/3 can also make some other denial of service attacks easier because it takes longer for the server to figure out that the device at that IP doesn't want the packets the server is sending when the request is from a spoofed IP address.
Blocking type 3/3 can also make some other denial of service attacks easier because it takes longer for the server to figure out that the device at that IP doesn't want the packets the server is sending when the request is from a spoofed IP address.
Ok, then this is definitely a problem with UDP.
But what about TCP only? AFAIK, TCP RST is usually used when a packet is received with no connection. The only place I'm aware of that uses ICMP 3/3 is the REJECT iptables target when the defaults are used.
But what about TCP only? AFAIK, TCP RST is usually used when a packet is received with no connection. The only place I'm aware of that uses ICMP 3/3 is the REJECT iptables target when the defaults are used.
The worrying thing is that a suitably insane whackjob somewhere could spin up their ipcamera botnet and knock, say, half the planet's ISP offline at once.
All routing would stop, the internet would simply grind to a halt. Am I missing something?
All routing would stop, the internet would simply grind to a halt. Am I missing something?
Not all routing by any means. Just anyone using those particular Cisco and other routers. Fortunately the net routes around damage by design; as routers went offline, other paths would be found.
Out of curiosity, why is this called Blacknurse? I couldn't make a connection from ICMP Destination Unreachable / port unreachable packet to the BlackNurse? (not that it matters, I am merely curious).
Also - PoC is for IPv4; does anyone know if systems fail in a similar manner if ICMP6 Destination Unreachable / Port unreachable (ICMP6 T:3, C:4) is being used? (https://tools.ietf.org/html/rfc4443#section-3.1)
Also - PoC is for IPv4; does anyone know if systems fail in a similar manner if ICMP6 Destination Unreachable / Port unreachable (ICMP6 T:3, C:4) is being used? (https://tools.ietf.org/html/rfc4443#section-3.1)
>Out of curiosity, why is this called Blacknurse?
I can only guess that it's a play on "black hat" hacking as opposed to "white hat"[1].
Since ICMP messages are related to network "health" by way of pinging & diagnostics, a good "white nurse" would use that to monitor the health of the patient. However, an evil "black nurse" would use the ICMP protocol against the patient to kill it.
[1]https://en.wikipedia.org/wiki/White_hat_(computer_security)
I can only guess that it's a play on "black hat" hacking as opposed to "white hat"[1].
Since ICMP messages are related to network "health" by way of pinging & diagnostics, a good "white nurse" would use that to monitor the health of the patient. However, an evil "black nurse" would use the ICMP protocol against the patient to kill it.
[1]https://en.wikipedia.org/wiki/White_hat_(computer_security)
They should have called it "evil nurse" or something less charged. Why even go there?
Because maybe not everyone projects their own racism onto innocent words such as black, white, and yellow. We should "go there", because thought-crime and "watch what you say" type ideas are much more dangerous to our society than the term blacknurse.
I don't think any harm is intended in this choice of words, but that doesn't mean one shouldn't try to be cognizant of the subtle cumulative effect they might have.
The problem is that it's really obvious, too. It's not like they used some term that just happened to have been used in the past as slang but is now a commonplace word without the same meaning. You don't need to get out a dictionary to spot the problem.
So is black metal music racist? Give me a break, people have associated black with evil things such as monsters stalking the night, plague, and death for 3000 years and probably before it. You are paranoid and overreacting. You're projecting your own racial insecurities onto the world where there simply is none, especially in this case.
I didn't suggest any of this was racist. I despise the hysterical, wolf-crying, race-baiting PC police, but that doesn't mean that we can't try to make the word a better place by avoiding to pile on the black=evil association in our culture and in the English language, especially when coining new terms. It's not a horrible moral failing not to do so, but it would be nice.
>So is black metal music racist?
Well, there are a lot of racist black metal musicians.
Well, there are a lot of racist black metal musicians.
Metal is not a person, but a nurse is. All the difference. My point isn't to suggest it's racist, but to ask why even go there? If they changed the term slightly no one would have to double think.
And you say that as someone who's suffered discrimination, obviously.
I think the reason that Black Nurse might be particularly bad is that during slavery, black women were forced to feed their owners' children instead of their own.
Just because you don't see something as problematic doesn't mean that it isn't.
Just because you don't see something as problematic doesn't mean that it isn't.
I haven’t thought of the term in that sense until reading your post. Not because I am unaware of black issues, but because I’m not an American and my context simply lacks the implied connotation for the term in question.
The political correction you ask for is USA-centric. I don’t know if the people behind blacknurse.dk are American, but, if the domain is an indication, they may not be.
The political correction you ask for is USA-centric. I don’t know if the people behind blacknurse.dk are American, but, if the domain is an indication, they may not be.
wanted to go and test this against my home network. read page: "NOT AFFECTED: pfSense"
Damnit, I'm protected by the glory of FreeBSD-based firewalls.
I still tried anyway, but nothing happened :(
Damnit, I'm protected by the glory of FreeBSD-based firewalls.
I still tried anyway, but nothing happened :(
This reminds me of an attack in the late 1990s called Pulse, which was a low-bandwidth flood of RST packets against Cisco routers. With a T1 line (1.5mbps) you could bring down a T3 (45mbps).
This is really old news. These kinds of attacks have been well documented for over a decade.[1] An ICMP type 3 code 3 or type 3 code 2 packet MUST be treated the same as a TCP Reset packet (per RFCs). You can also do blind performance degradation attacks with ICMP type 4 or type 3 code 4 packets. Thankfully, ICMP type 4 has been deprecated for a while now so those packets can be safely ignored.
[1] https://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html
[1] https://www.gont.com.ar/drafts/icmp-attacks-against-tcp.html
If you get a Destination Unreachable at a firewall, what do you do with it? Unless the firewall has been passing traffic to the supposedly-unreachable destination, the firewall should drop it. Are firewalls mishandling this, or doing it too slowly?
I'm not a so called security expert nor I'm in the security business anymore, so please take this with a pinch of salt.
Isn't rate limiting a thing anymore? Especially for packets that should not be coming at this rate. 40k-50k pps? Who gets that amount of ICMP type 3 code 4 as a baseline to consider it normal? Also, many networks out there "deprioritize" ICMP packets.
I see how (mainly) Cisco seems to have screwed up on their ASAs, but in all honesty they've never been the paradigm of firewall security. Before the -X line, which is when I was a very active user of ASAs, the interface buffers of almost any ASA up to the 5580 were insufficient for some kinds of traffic that generated high pps with not so huge bandwidth.
Actually, now that I think about it, I wonder if this "Black Nurse" is partly the result of the ASA's insufficient buffers and not just an actual firmware issue.
All in all, this feels very amateurish to me and I'm surprised people are buying into it - I guess doom and gloom sells pageviews. I mean, if their conclusion is the below, I don't see how this is making so much noise:
"We believe,that what we see when our customers get hit by the BlackNurse attack is that the firewall admins have just followed recommendations or misconfigured firewalls. Mitigation on firewalls could be to change default config or to patch any code that can lead to a DoS state."
(from http://www.blacknurse.dk/Blacknurse_v.1.7.pdf)
Isn't rate limiting a thing anymore? Especially for packets that should not be coming at this rate. 40k-50k pps? Who gets that amount of ICMP type 3 code 4 as a baseline to consider it normal? Also, many networks out there "deprioritize" ICMP packets.
I see how (mainly) Cisco seems to have screwed up on their ASAs, but in all honesty they've never been the paradigm of firewall security. Before the -X line, which is when I was a very active user of ASAs, the interface buffers of almost any ASA up to the 5580 were insufficient for some kinds of traffic that generated high pps with not so huge bandwidth.
Actually, now that I think about it, I wonder if this "Black Nurse" is partly the result of the ASA's insufficient buffers and not just an actual firmware issue.
All in all, this feels very amateurish to me and I'm surprised people are buying into it - I guess doom and gloom sells pageviews. I mean, if their conclusion is the below, I don't see how this is making so much noise:
"We believe,that what we see when our customers get hit by the BlackNurse attack is that the firewall admins have just followed recommendations or misconfigured firewalls. Mitigation on firewalls could be to change default config or to patch any code that can lead to a DoS state."
(from http://www.blacknurse.dk/Blacknurse_v.1.7.pdf)
for those interested in detail etc. you can find a POC here
https://github.com/jedisct1/blacknurse
https://github.com/jedisct1/blacknurse
Control plane security overview: http://www.cisco.com/c/en/us/products/collateral/security/io...
Control plane best practices: http://www.cisco.com/c/en/us/about/security-center/copp-best...
Protecting the Router Control Plane: https://tools.ietf.org/html/rfc6192
You'll probably also want to read the Network Security Baseline: http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Se...
More resource exhaustion DoS: TTL expiry attack http://www.cisco.com/c/en/us/about/security-center/ttl-expir...
Troubleshooting high CPU use (on 7500's) http://www.cisco.com/c/en/us/support/docs/routers/7500-serie...