I read about the attack called "BlackNurse," which uses low-volume ICMP requests to overload vulnerable firewalls...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
with a denial-of-service attack. What's the issue here? If the attack traffic is so low, why is it causing problems with firewalls?
BlackNurse was able to shut down some firewalls because the firewalls in question didn't have CPU resources to process the ICMP requests.
TDC Group, a Danish telecommunications company, discovered BlackNurse; it also identified smaller Cisco Adaptive Security Appliance firewalls as among the vulnerable products. The attack occurred when these firewalls had no more CPU resources to process a steady stream of low-volume Internet Control Message Protocol (ICMP) requests. When Cisco was told about the attack, it didn't classify it as a security issue, as the attack was not on the Common Vulnerabilities and Exposures list. It was mentioned in a CERT-EU Security Advisory from November 14, 2016, but there was no US-CERT alert.
BlackNurse, however, is a security issue. It takes advantage of ICMP packets which are normally returned to ping sources for reply when the target's destination port is unreachable. TDC's security operations center found that the volume of the distributed denial of service (DDoS) traffic was very small. When the firewalls reached a threshold of 15-18 Mbps, BlackNurse sent a steady stream of 40,000 to 50,000 ICMP packets, which resulted some firewalls overloading (specifically, firewalls that used a single CPU).
Cisco permits all ICMP unreachable messages (Type 3), including the destination port unreachable messages (Type 3, Code 3). It recommends changing the firewalls' default configurations or fixing "defective" codes, but this is not a mitigation approach.
TDC recommends either rate limiting ICMP traffic on an upstream router or denying all incoming ICMP packets except for ICMP fragmentation packets (Type 3, Code 4). The exception is needed for path maximum transmission unit (MTU) discovery, which many operating systems depend on. The MTU size is determined to avoid IP fragmentation. If fragmentation occurs, IPsec traffic will not continue, and you will not be able to use a VPN.
Consider mitigating the BlackNurse vulnerability by upgrading to multiCPU firewalls, and make sure they are compatible with one another if they are from several different vendors. In addition, don't forget to update your set of DDoS mitigation tools.
Learn about the pros and cons of media access control address randomization schemes
Read more on out-of-band management for network devices
Discover how the hashcat tool can mitigate authentication flaws
Dig Deeper on Network device security: Appliances, firewalls and switches
Related Q&A from Judith Myerson
Active defense systems work as deception techniques on private networks, but are they good for enterprise use? Expert Judith Myerson discusses some ...continue reading
IP address hijacking incidents are on the rise because IPs can be easily targeted. Expert Judith Myerson explains how these attacks work and how they...continue reading
A boot mode vulnerability allowed attackers to eavesdrop on calls made on certain Android devices. Expert Judith Myerson explains how the complex ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.