One laptop can take down major internet servers
You don’t need a massive botnet to launch overwhelming denial of service attacks — in some cases, a personal PC and so-so broadband are all that’s required. Researchers at TDC Security Operations Center have revealed a new attack technique, BlackNurse, that can take down large servers using just one computer (in this case, a laptop) and at least 15Mbps of bandwidth. Instead of bombarding a server with traffic, you send specially formed Internet Control Message Protocol packets that overwhelm the processors on server firewalls from Cisco, Palo Alto Networks and others. The firewalls end up dropping so much data that they effectively knock servers out of commission, even if they have tons of network capacity.
The good news? There are ways to fight against BlackNurse. TDC recommends setting up software filters to prevent this kind of flooding. Also, this is mainly a concern with firewall makers that allow ICMP packets from outside. Palo Alto, for instance, notes that its firewalls drop those kinds of requests by default — unless you change the settings and don’t follow its guidelines for anti-flood protection, you’re safe. Cisco doesn’t see a major issue, either.
The danger is that not every firewall is guaranteed to follow similar rules, and that some businesses may have reasons to tweak their settings to let ICMP data in. Even if the threat isn’t high, the discovery is a reminder that denial of service attacks can take many shapes. In the right circumstances, one person at home could be just as dangerous as a dedicated cyberattack group.
(38)
