Bobcares

WeSupport

Call Us! 1-800-383-5193
Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Emergency Response Time custom

Our experts have had an average response time of 11.06 minutes in March 2021 to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

ACK scan DOS attack – How to mitigate

by | Feb 26, 2021

Wondering how to mitigate ACK scan DOS attack? We can help you.

ACK scans are generally used to identify ports or hosts that may be filtered and resistant to any other form of scanning. An adversary uses TCP ACK segments to gather information about firewall or ACL configuration.

Attackers scan our router or send unwanted traffic/requests like SYN, ACK, FIN to specific UDP/TCP Port. Sometimes, they also send continuous unwanted traffic into particular open port/s. This can crash our router and make it out of service.

Here at Bobcares we often handle DOS attack as a part of our Server Management Services.

Today let’s see some of the steps which our Support Engineers follow to mitigate this issue.

How does ACK scan DOS attack work?

A target system is presented with a packet with the ACK flag set with a sequence number of zero to an interesting port.

Generally, if the sequence number is not zero, there is a violation of TCP rules associated with that parameter.

And the target sends back an RST. The presence of the RST provides an attacker a good indication that the host is alive but behind some form of filtering like a firewall, a router, or even some proxies.

A TCP ACK segment when sent to a closed port or sent out-of-sync to a listening port, the expected behavior is for the device to respond with an RST. This helps the attacker to get an idea about the type of firewall.

When combined with SYN techniques an attacker will get a clear picture of the types of packets that get through to a host and can understand the firewall rule-set.

ACK scanning, when combined with SYN scanning, also allows the adversary to analyze whether a firewall is stateful or non-stateful.

Two potential rules for detecting this behavior are:

alert tcp 172.16.16.0/24 any -> 172.16.17.0/24 any (flags:A; ack:0; msg: “Potential Ack Scan”; sid: 10001;)

or

alert tcp 172.16.16.0/24 any -> 172.16.17.0/24 any (flags:AR; msg: “Ack and RST detected-Potential Ack Scan”; sid: 10002;)

In the first rule, the assumption is that the Acknowledgment flag will be set and the sequence value will be set to “0”.  This will make the target return an “RST”.

The second rule looks for the existence of an “RST” with the Acknowledgment flag set rather than looking for the existence of a zero-sequence value. The existence of these two flags together simultaneously can also be an indicator of an ACK scan being used for reconnaissance purposes, or “firewalking”.

Any SYN-ACK responses are possible connections: an RST(reset) response means the port is closed, but there is a live computer here. No responses indicate SYN is filtered on the network.

An attacker can scan the router or send unwanted traffic/request like SYN,ACK,FIN to specific UDP/TCP Port.

Generally, if the router is accessible from outside of the network, the attacker can access it by brute force. A typical Probe response is given below:

Probe Response - Assigned State
-------------------------------------------------------------------
TCP RST response - unfiltered
No response received (even after retransmissions) - filtered
ICMP unreachable error - filtered

An example of a typical ACK scan:

# nmap -sA -T4 <target>

Starting Nmap ( http://nmap.org )
Nmap scan report for target
Not shown: 994 filtered ports
PORT STATE SERVICE
22/tcp unfiltered ssh
25/tcp unfiltered smtp
53/tcp unfiltered domain
70/tcp unfiltered gopher
80/tcp unfiltered http
113/tcp unfiltered auth
Nmap done: 1 IP address (1 host up) scanned in 4.01 seconds

 

Steps to Mitigate

1. Set up a firewall to filter scan attempts.

We can use the following commands to filter scan attempts with iptables.

iptables -A INPUT -p tcp –tcp-flags SYN,ACK SYN,ACK -m state –state NEW -j DROP
iptables -A INPUT -p tcp –tcp-flags ALL NONE -j DROP

iptables -A INPUT -p tcp –tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -A INPUT -p tcp –tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp –tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

iptables -A INPUT -p tcp –tcp-flags FIN,RST FIN,RST -j DROP
iptables -A INPUT -p tcp –tcp-flags ACK,FIN FIN -j DROP
iptables -A INPUT -p tcp –tcp-flags ACK,PSH PSH -j DROP
iptables -A INPUT -p tcp –tcp-flags ACK,URG URG -j DROP

2. Reset the IP if it’s dynamic. Just turn the router off for the DHCP lease time or spoof a different MAC address.

3. Appropriate rules can be applied to DROP PKT like: burst limit/rate, Source limit, destination limit, connection limit, length, etc.

We can use the following IPtables commands for this:

$ sudo iptables --append INPUT --source 123.123.123.123 --jump DROP

or

# iptables -A INPUT -m state --state NEW -j DROP

 

[Need assistance? We are happy to help you]

Conclusion

In short, we saw how the ACK scan DOS attack works along with the steps which our Support Engineers follow to mitigate this.

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

GET STARTED

var google_conversion_label = "owonCMyG5nEQ0aD71QM";

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF