I read about the attack called "BlackNurse," which uses low-volume ICMP requests to overload vulnerable firewalls...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
with a denial-of-service attack. What's the issue here? If the attack traffic is so low, why is it causing problems with firewalls?
BlackNurse was able to shut down some firewalls because the firewalls in question didn't have CPU resources to process the ICMP requests.
TDC Group, a Danish telecommunications company, discovered BlackNurse; it also identified smaller Cisco Adaptive Security Appliance firewalls as among the vulnerable products. The attack occurred when these firewalls had no more CPU resources to process a steady stream of low-volume Internet Control Message Protocol (ICMP) requests. When Cisco was told about the attack, it didn't classify it as a security issue, as the attack was not on the Common Vulnerabilities and Exposures list. It was mentioned in a CERT-EU Security Advisory from November 14, 2016, but there was no US-CERT alert.
BlackNurse, however, is a security issue. It takes advantage of ICMP packets which are normally returned to ping sources for reply when the target's destination port is unreachable. TDC's security operations center found that the volume of the distributed denial of service (DDoS) traffic was very small. When the firewalls reached a threshold of 15-18 Mbps, BlackNurse sent a steady stream of 40,000 to 50,000 ICMP packets, which resulted some firewalls overloading (specifically, firewalls that used a single CPU).
Cisco permits all ICMP unreachable messages (Type 3), including the destination port unreachable messages (Type 3, Code 3). It recommends changing the firewalls' default configurations or fixing "defective" codes, but this is not a mitigation approach.
TDC recommends either rate limiting ICMP traffic on an upstream router or denying all incoming ICMP packets except for ICMP fragmentation packets (Type 3, Code 4). The exception is needed for path maximum transmission unit (MTU) discovery, which many operating systems depend on. The MTU size is determined to avoid IP fragmentation. If fragmentation occurs, IPsec traffic will not continue, and you will not be able to use a VPN.
Consider mitigating the BlackNurse vulnerability by upgrading to multiCPU firewalls, and make sure they are compatible with one another if they are from several different vendors. In addition, don't forget to update your set of DDoS mitigation tools.
Learn about the pros and cons of media access control address randomization schemes
Read more on out-of-band management for network devices
Discover how the hashcat tool can mitigate authentication flaws
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Judith Myerson
A cryptographic weakness was discovered in the Telerik web UI. Expert Judith Myerson alerts readers about this weakness and the alternative options ...continue reading
New media player vulnerabilities have been exposed that enable hackers to use subtitle files to control devices. Expert Judith Myerson explains how ...continue reading
Two critical, zero-day Foxit Reader vulnerabilities haven't been patched and pose a threat to enterprises. Judith Myerson explains the ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.