Abusing TCP Retransmission for DoS Attack Inside Virtual Network

Abstract

Among DoS attack techniques, abusing UDP-based public servers like DNS or NTP for reflective amplification attack is continued to pose a great threat. Recent studies show that attacker can also use TCP retransmission before the three-way-handshake completion to perform this kind of attack. In this paper, we focus on the virtual environment, in which we evaluate the potential of abusing the virtual switch system to perform amplification attack. We created a virtual network that able to connect to an external network and observed the virtual switch system’s behavior while receiving TCP packets from outside the network. We show that the virtual switch system itself can retransmit TCP packets and therefore can be abused for amplification attack by an internal attacker. In other words, he/she can make amplification using TCP hosts from outside the network and the virtual switch system’s retransmission ability. Furthermore, we test the endurance of different OS and show that Windows OS family and macOS are more vulnerable than Linux Ubuntu OS against this kind of attack.