1

My machine has been identified as amplifier for DRDoS attack. How can I trace how my machine has been used to do this and remove the software used?

I tried to check machine's system log but I can't find anything. They said there was a service on my machine active on port 17 udp, taking part to the attack, but I cannot find that, currently, using netstat.

1 Answer 1

2

If the DDoS is over, then whatever was listening on Port 17 may not be running any more, as the C&C server may have told it to shut down. It may also be possible that your PC was not sending traffic on udp/17 but rather it was creating requests to a different QOTD server on udp/17.

If you were the one sending amplified traffic, udp/17 is traditionaly QOTD (Quote of the Day) which really has no business running on any modern server. QOTD can be used for DNS amplification, sending up to 512 bytes for a forged UDP request.

The way to defend against this is to have a firewall that doesn't permit any inbound requests from services you don't explicitly punch through

However, it may simply be that your machine is infected with malware and is not being used as an amplifier, but rather you were requesting the amplification (e.g. you were sending fake UDP packets to another machine which did the amplification).

If you are running your own edge network, implement BCP38 (or petition your upstream ISP to implement it). This essentially says "Don't let any traffic in or out of your network that is not designated for or has not come from your network". If every edge network and ISP implemented this, UDP amplification attacks would disappear overnight. What this essentially means is that when your computer started forging UDP requests, your edge device would say "Oh, this UDP request is designated for 203.0.113.77 but I only know of the network 198.51.100.0/24, therefor this traffic is junk and I should discard it before letting it leave my network. (BCP38 is for client networks, not transit networks. Obviously if ISPs implemented this on all their networks then the internet would grind to a halt)

More importantly though if your machine is infected with this malware you need to nuke the entire machine and start again.

1
  • Thank you for all the interesting and useful informations! I think nuking is the most secure way to solve as far as i can. Mar 21, 2018 at 16:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .