Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Re: NetBIOS could be used as network flood amplier
From: Francesco Vigo (f.vigoanti-idle.com)
Date: Fri Apr 04 2003 - 18:47:39 CST
maybe there was some incomprehension about what I meant.
I am aware that "Broadcast Storm" is an old and well known problem, that
affects misconfigured LANs. It's easy to find documentation about that
matter, but that's not the point of my discussion.
A "Broadcast Storm", as far as I know, happens when a lot of machines in a
local network, for some reason, start to send broadcast packets and fill
the network capacity.
My argument was about a different thing: many flooders, like smurf and
fraggle, work sending spoofed packets to broadcast addresses of
misconfigured networks, making all the machines reply to the spoofed
address, which is the "victim" host (outside the network) and gets
flooded. (e.g. with ICMP echo replies, UDP echo replies, UDP chargen data,
etc). I also noticed that there are a lot of variants of those programs
which work also with DNS data or game servers data.
Everyone knows this.
The only thing i've done is looking if this kind of attack could work even
with NetBIOS Name Request packets: after my tests I noticed that it works,
and it usually generates a bigger amount of replied data than ICMP echos,
UDP chargen or others.
I looked around in the Internet and found nothing about NetBIOS being used
IN THIS WAY (I mean spoofed NetBIOS Name Requests sent to broadcast
addresses of misconfigured networks to flood remote hosts), so I made
additional tests and made them public.
--- Original Message
>From: "Russ" <Russ.Cooperrc.on.ca>
>To: "Francesco Vigo" <f.vigoanti-idle.com>,
>Its called a NetBIOS Broadcast Storm, and its 15 years old now. No need =
>to write your own code, many manufacturers, like Ungermann-Bass, IBM, =
>Tandem Computers and others all wrote code that could do this quite =
>effectively. The only difference between your code and theirs is that =
>theirs would do it when you didn't want them to.