Maksim Kabakou - Fotolia

Problem solve Get help with specific problems with your technologies, process and projects.

How does the BlackNurse attack overwhelm firewalls?

A new attack called "BlackNurse" can disrupt firewalls with a small amount of ICMP packets. Expert Judith Myerson explains how it works and why it's a security issue for enterprises.

I read about the attack called "BlackNurse," which uses low-volume ICMP requests to overload vulnerable firewalls with a denial-of-service attack. What's the issue here? If the attack traffic is so low, why is it causing problems with firewalls?

BlackNurse was able to shut down some firewalls because the firewalls in question didn't have CPU resources to process the ICMP requests.

TDC Group, a Danish telecommunications company, discovered BlackNurse; it also identified smaller Cisco Adaptive Security Appliance firewalls as among the vulnerable products. The attack occurred when these firewalls had no more CPU resources to process a steady stream of low-volume Internet Control Message Protocol (ICMP) requests. When Cisco was told about the attack, it didn't classify it as a security issue, as the attack was not on the Common Vulnerabilities and Exposures list. It was mentioned in a CERT-EU Security Advisory from November 14, 2016, but there was no US-CERT alert.

BlackNurse, however, is a security issue. It takes advantage of ICMP packets which are normally returned to ping sources for reply when the target's destination port is unreachable. TDC's security operations center found that the volume of the distributed denial of service (DDoS) traffic was very small. When the firewalls reached a threshold of 15-18 Mbps, BlackNurse sent a steady stream of 40,000 to 50,000 ICMP packets, which resulted some firewalls overloading (specifically, firewalls that used a single CPU).

Cisco permits all ICMP unreachable messages (Type 3), including the destination port unreachable messages (Type 3, Code 3). It recommends changing the firewalls' default configurations or fixing "defective" codes, but this is not a mitigation approach.

TDC recommends either rate limiting ICMP traffic on an upstream router or denying all incoming ICMP packets except for ICMP fragmentation packets (Type 3, Code 4). The exception is needed for path maximum transmission unit (MTU) discovery, which many operating systems depend on. The MTU size is determined to avoid IP fragmentation. If fragmentation occurs, IPsec traffic will not continue, and you will not be able to use a VPN.

Consider mitigating the BlackNurse vulnerability by upgrading to multiCPU firewalls, and make sure they are compatible with one another if they are from several different vendors. In addition, don't forget to update your set of DDoS mitigation tools.

Next Steps

Learn about the pros and cons of media access control address randomization schemes

Read more on out-of-band management for network devices

Discover how the hashcat tool can mitigate authentication flaws

This was last published in December 2016

Dig Deeper on Network device security: Appliances, firewalls and switches