Weaponizing Middleboxes for TCP Reflected Amplification

Middleboxes are bad enough for the internet, but this makes them even worse.

Now I'm kind of wondering what would happen if you'd set up an attack that uses the infinite attack amplification vulnerability between two censorship regimes. Basically, have the Great Chinese firewall DDoS the Iranian censorship system. You could probably do some serious damage by saturating the links between the two countries!

Summary:

We discover a new way that attackers could launch reflected denial of service (DoS) amplification attacks over TCP by abusing middleboxes and censorship infrastructure. These attacks can produce orders of magnitude more amplification than existing UDP-based attacks.

This is the first reflected amplification attack over TCP that goes beyond sending SYN packets and the first HTTP-based reflected amplification attack.

We found multiple types of middlebox misconfiguration in the wild that can lead to technically *infinite amplification* for the attacker: by sending a single packet, the attacker can initiate an endless stream of packets to the victim.