Millions of routers worldwide vulnerable to digital criminals, 800,000
of which are in the UK, with potential for serious disruption
 |
| Broadband providers should act to protect themselves and customers, say experts. Photograph: Denis Closon/Rex Features |
As many as 24m routers across the world can be used by
cybercriminals to launch massive attacks on internet infrastructure,
while simultaneously disrupting home connections and costing
communications companies dearly.
Research shown exclusively to the Guardian showed 800,000 of those routers are based in the UK, opening up the potential for serious disruption of the country’s data networks.
Over recent months, digital criminals have increasingly exploited these routers to generate massive attack traffic, as they look to disrupt web services. The process is called attack amplification and it starts with the attacker selecting a target website. They then pretend to be their target, using a technique known as internet protocol address spoofing.
The attacker then sends a small request over the internet, from their computer to a vulnerable home router. That router passes on the request to a machine held at the internet service provider (ISP), such as BT or Virgin Media. That machine is known as a resolver, as it resolves the request sent by the attacker.
The ISP machine will give a response that is far larger than the attacker’s initial request. That amplified response is then passed on to the eventual target, whom the attacker is impersonating.
When the attacker fires out vast numbers of requests to the millions of exploitable routers, massive responses are routed back to the target website. The result is a massive distributed denial of service (DDoS) attack – distributed because the requests the attacker sends come from a variety of different computers under his or her control, known as a botnet.
Internet pipes are clogged up, often wiping the original target offline and causing collateral damage, disrupting people’s home connections without them knowing and swamping ISP networks.
“All that traffic coming back down to the user can saturate the access network. What the user sees is what appears to be an outage or an intermittent or slow service,” said Bruce van Nice, from Nominum, a software company serving the telecoms industry, which provided the Guardian with the data. “The user doesn't know anything about what is going on.”
Attackers have started innovating to amplify their attacks more efficiently, creating websites with domain names that provide even bigger responses. Over a single day this year, Nominum said it recorded 5bn requests for such domains. This produced 12 terabytes of traffic, which is a significant amount of data flying around the internet solely for malicious means.
Nominum said over a single day in February more than 5.3m of the routers running the feature were used to generate attack traffic in Asia. An attack in January used up 70% of an internet providers Domain Name System servers.
“There's like this backdoor that's been opened to ISP networks, these home routers expose them,” van Nice added.
Broadband providers should act to protect themselves and customers, said Roland Dobbins, Senior ASERT Analyst at Arbor Networks. “There are very definite operational costs on ISPs which really make it incumbent upon them to actively scan their own [systems] to find abusable devices. It really makes economic sense for ISPs to look at this.”
The feature within home routers that allows this is known as an Open Domain Name System Proxy. It is part of the everyday process of translating web names such as theguardian.com to internet protocol addresses such as 77.91.251.10. The average internet user has little recourse other than to ask their provider to scan their systems to see if they have this feature switched on, Dobbins added.
BT declined to comment when contacted by the Guardian. Virgin Media said it provides advice to users to deal with issues like this, pointing them to sites like this.
Research shown exclusively to the Guardian showed 800,000 of those routers are based in the UK, opening up the potential for serious disruption of the country’s data networks.
Over recent months, digital criminals have increasingly exploited these routers to generate massive attack traffic, as they look to disrupt web services. The process is called attack amplification and it starts with the attacker selecting a target website. They then pretend to be their target, using a technique known as internet protocol address spoofing.
The attacker then sends a small request over the internet, from their computer to a vulnerable home router. That router passes on the request to a machine held at the internet service provider (ISP), such as BT or Virgin Media. That machine is known as a resolver, as it resolves the request sent by the attacker.
The ISP machine will give a response that is far larger than the attacker’s initial request. That amplified response is then passed on to the eventual target, whom the attacker is impersonating.
When the attacker fires out vast numbers of requests to the millions of exploitable routers, massive responses are routed back to the target website. The result is a massive distributed denial of service (DDoS) attack – distributed because the requests the attacker sends come from a variety of different computers under his or her control, known as a botnet.
Internet pipes are clogged up, often wiping the original target offline and causing collateral damage, disrupting people’s home connections without them knowing and swamping ISP networks.
“All that traffic coming back down to the user can saturate the access network. What the user sees is what appears to be an outage or an intermittent or slow service,” said Bruce van Nice, from Nominum, a software company serving the telecoms industry, which provided the Guardian with the data. “The user doesn't know anything about what is going on.”
Attackers have started innovating to amplify their attacks more efficiently, creating websites with domain names that provide even bigger responses. Over a single day this year, Nominum said it recorded 5bn requests for such domains. This produced 12 terabytes of traffic, which is a significant amount of data flying around the internet solely for malicious means.
Nominum said over a single day in February more than 5.3m of the routers running the feature were used to generate attack traffic in Asia. An attack in January used up 70% of an internet providers Domain Name System servers.
“There's like this backdoor that's been opened to ISP networks, these home routers expose them,” van Nice added.
Broadband providers should act to protect themselves and customers, said Roland Dobbins, Senior ASERT Analyst at Arbor Networks. “There are very definite operational costs on ISPs which really make it incumbent upon them to actively scan their own [systems] to find abusable devices. It really makes economic sense for ISPs to look at this.”
The feature within home routers that allows this is known as an Open Domain Name System Proxy. It is part of the everyday process of translating web names such as theguardian.com to internet protocol addresses such as 77.91.251.10. The average internet user has little recourse other than to ask their provider to scan their systems to see if they have this feature switched on, Dobbins added.
BT declined to comment when contacted by the Guardian. Virgin Media said it provides advice to users to deal with issues like this, pointing them to sites like this.
0 comments:
Post a Comment