Evaluation of TFTP DDoS Amplification Attack.

Macfarlane, Richard and Buchanan, William J (2016) Evaluation of TFTP DDoS Amplification Attack. Computers & Security, 57. pp. 67-92.

Full text not available from this repository. (Request a copy)


Web threats are becoming a major issue for both governments and companies. Generally, web threats increased as much as 600% during last year (WebSense, 2013). This appears to be a significant issue, since many major businesses seem to provide these services. Denial of Service (DoS) attacks are one of the most significant web threats and generally their aim is to waste the resources of the target machine (Mirkovic & Reiher, 2004). Dis-tributed Denial of Service (DDoS) attacks are typically executed from many sources and can result in large traf-fic flows. During last year 11% of DDoS attacks were over 60 Gbps (Prolexic, 2013a). The DDoS attacks are usually performed from the large botnets, which are networks of remotely controlled computers. There is an increasing effort by governments and companies to shut down the botnets (Dittrich, 2012), which has lead the attackers to look for alternative DDoS attack methods. One of the techniques to which attackers are returning to is DDoS amplification attacks. Amplification attacks use intermediate devices called amplifiers in order to amplify the attacker's traffic. This work outlines an evaluation tool and evaluates an amplification attack based on the Trivial File Transfer Proto-col (TFTP). This attack could have amplification factor of approximately 60, which rates highly alongside other researched amplification attacks. This could be a substantial issue globally, due to the fact this protocol is used in approximately 599,600 publicly open TFTP servers. Mitigation methods to this threat have also been consid-ered and a variety of countermeasures are proposed. Effects of this attack on both amplifier and target were analysed based on the proposed metrics. While it has been reported that the breaching of TFTP would be possible (Schultz, 2013), this paper provides a complete methodology for the setup of the attack, and its verification.

Item Type: Article
Electronic ISSN: 0167 4048
Uncontrolled Keywords: TFTP; cybersecurity; computer programmes and software; risk management; DDoS
University Divisions/Research Centres: Edinburgh Napier University, Institute for Informatics and Digital Innovation
Dewey Decimal Subjects: 000 Computer science, information & general works > 000 Computer science, knowledge & systems > 005 Computer programming, programs & data > 005.8 Data security
Library of Congress Subjects: Q Science > QA Mathematics > QA76 Computer software
Item ID: 8746
Depositing User: Computing Research
Date Deposited: 08 Sep 2015 09:58
Last Modified: 08 Jul 2016 11:08

Actions (login required)

View Item View Item

Edinburgh Napier University is a registered Scottish charity. Registration number SC018373