Re: NetBIOS could be used as network flood amplier

[Francesco Vigo <f.vigo () anti-idle com>]

In-Reply-To: <E9A01F52DC939448BBDE44ED2E1C468F6710DD () muskie rc on ca>

Hi,

maybe there was some incomprehension about what I meant.

I am aware that "Broadcast Storm" is an old and well known problem, that 
affects misconfigured LANs. It's easy to find documentation about that 
matter, but that's not the point of my discussion.

A "Broadcast Storm", as far as I know, happens when a lot of machines in a 
local network, for some reason, start to send broadcast packets and fill 
the network capacity.

My argument was about a different thing: many flooders, like smurf and 
fraggle, work sending spoofed packets to broadcast addresses of 
misconfigured networks, making all the machines reply to the spoofed 
address, which is the "victim" host (outside the network) and gets 
flooded. (e.g. with ICMP echo replies, UDP echo replies, UDP chargen data, 
etc). I also noticed that there are a lot of variants of those programs 
which work also with DNS data or game servers data.
Everyone knows this.
The only thing i've done is looking if this kind of attack could work even 
with NetBIOS Name Request packets: after my tests I noticed that it works, 
and it usually generates a bigger amount of replied data than ICMP echos, 
UDP chargen or others.
I looked around in the Internet and found nothing about NetBIOS being used 
IN THIS WAY (I mean spoofed NetBIOS Name Requests sent to broadcast 
addresses of misconfigured networks to flood remote hosts), so I made 
additional tests and made them public.

Best Regards,

Francesco Vigo

--- Original Message
> From: "Russ" <Russ.Cooper () rc on ca>
> To: "Francesco Vigo" <f.vigo () anti-idle com>,
>       <bugtraq () securityfocus com>
>
> Its called a NetBIOS Broadcast Storm, and its 15 years old now. No need =
> to write your own code, many manufacturers, like Ungermann-Bass, IBM, =
> Tandem Computers and others all wrote code that could do this quite =
> effectively. The only difference between your code and theirs is that =
> theirs would do it when you didn't want them to.