What Is a Smurf Attack? Definition & Defense
During a Smurf attack, hundreds or thousands of computers and other connected devices send scores of requests to one server that buckles under the pressure. When the server goes down, so does the website. And it will stay down until the attack stops.
How can tiny beings fight back against enemies twice or three times their size? Cartoons featuring Smurfs attempt to answer that question. They band together, and as an army, they're stronger than they would be alone. A computer Smurf attack works in much the same way.
Smurf attacks get their name from the cartoons. But make no mistake. A computer-based Smurf attack isn't entertaining. It's devastating. A distributed-denial-of-service (DDoS) attack like this costs businesses over $2.5 billion per episode.
Let's dig into how these threats work, and we'll help you understand how to protect yourself.
How Does a Smurf Attack Work?
Connection requests bounce between devices and servers every day. During a Smurf attack, the conversation is hijacked and twisted.
Smurf attacks begin with viruses. Visit an infected website or tap on a faulty link, and your device becomes part of an army, ready to attack when the command comes.
Hackers short on time can hire an army of bots instead. Hackers expect to pay about $25 per hour for an army of infected devices.
A typical Smurf attack unfolds via these steps:
- Spoofing: The hacker creates network packets that appear to come from the target's server.
- Request: A request inside each packet asks network nodes to reply. In a normal, natural connection between a device and a server, these requests are called ICMP echo requests, and they're meant to measure the distance between the two access points. Servers must respond, and they can't ignore the requests. It's this vulnerability that makes a Smurf attack possible.
- Looping: Each reply is sent right back to the network IP, and the system quickly becomes overwhelmed.
In some cases, hackers use IP broadcasting to amplify an attack. The packets are sent to every IP address within the network, and that flood can cause a complete breakdown of server function.
A Smurf attack isn't the same as a Fraggle attack, although the two are similar. During a Fraggle attack, hackers send UDP packets instead of ICMP echo requests.
Recover From Smurf Attacks
DDoS signs are clear and hard to ignore. When you spot them, you must act quickly to contain the damage.
You may be dealing with a Smurf attack if you notice:
- Slow server performance.
- Complaints from customers about your website's availability.
- Your inability to reach any website.
Dig into your network traffic, and you may notice unusual packet volume or signatures you've never seen before.
Resetting your server may help, and your hosting company could help you do just that. You may also need to connect with your security provider to close down your ability to respond to IP requests, at least temporarily.
While you direct your teams to stop the attack, look over your other assets. Hackers often use Smurf attacks to divert your attention while they dig into sensitive data or otherwise cause chaos. Let the security team work while you protect what's yours.
Craft a Smurf Attack Prevention Plan
You can't stop your server from responding to all echo requests. But you can amend your configurations to ensure you're not always vulnerable to a takedown.
Start by addressing:
- Broadcasts. Don't allow your routers to forward packets directed to broadcast addresses. And disable IP-directed broadcasts on your own routers too.
- Firewalls. Don't allow pings from outside your network to touch your server.
Next, ensure that you're running current versions of all software, and run a complete virus scan to eliminate any backdoors that might be open in your systems. Repeat these steps periodically, so you always have up-to-date protection.
Maintain Security Settings
It's hard to respond to every attack vector out there. And recovering from an intrusion is both costly and scary. Let us help. At Okta, we develop state-of-the-art solutions for companies just like yours. We can help you protect what's yours. Contact us to find out more.
References
The Average DDoS Attack Cost for Businesses Rises to Over $2.5 Million. (May 2017). ZD Net.
A Guide to Cyber Attacks: Denial of Service, Part 3. (September 2018). Information Age.
How Much Costs a DDoS Attack Service? Which Factors Influence the Final Price? (March 2017). Security Affairs.
Security Tip ST04-015: Understanding Denial of Service Attacks. (November 2019). Cybersecurity and Infrastructure Security Agency.
How Will You Face the High Price of DDoS Attacks? (June 2018). Security Intelligence.