CAPEC-490: Amplification

Description

An adversary may execute an amplification where the size of a response is far greater than that of the request that generates it. The goal of this attack is to use a relatively few resources to create a large amount of traffic against a target server. To execute this attack, an adversary send a request to a 3rd party service, spoofing the source address to be that of the target server. The larger response that is generated by the 3rd party service is then sent to the target server. By sending a large number of initial requests, the adversary can generate a tremendous amount of traffic directed at the target. The greater the discrepancy in size between the initial request and the final payload delivered to the target increased the effectiveness of this attack.

Likelihood of attack: Not rated by MITRE
Typical severity: Not rated by MITRE
Abstraction: StandardA specific methodology or technique used in an attack.

Mechanism of attack: Abuse Existing Functionality

Prerequisites

This type of an attack requires the existence of a 3rd party service that generates a response that is significantly larger than the request that triggers it.

Mitigations

To mitigate this type of an attack, an organization can attempt to identify the 3rd party services being used in an active attack and blocking them until the attack ends. This can be accomplished by filtering traffic for suspicious message patterns such as a spike in traffic where each response contains the same large block of data. Care should be taken to prevent false positive rates so legitimate traffic isn't blocked.

Related weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or Throttling

ATT&CK techniques (CAPEC taxonomy mapping)

T1498.002Network Denial of Service: Reflection Amplification

Across MITRE's defensive frameworks

Linked through the 1 ATT&CK technique above.

Counter with D3FEND

Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.

Related attack patterns

Parent

CAPEC-125FloodingMeta

Description

Mitigations

To mitigate this type of an attack, an organization can attempt to identify the 3rd party services being used in an active attack and blocking them until the attack ends. This can be accomplished by filtering traffic for suspicious message patterns such as a spike in traffic where each response contains the same large block of data. Care should be taken to prevent false positive rates so legitimate traffic isn't blocked.