Teardrop attack explained
The Teardrop attack is one of the popular DoS (Denial-of-Service) attacks. It aims to overwhelm its target with malicious fragmented data packets, which the victim is not able to reconstruct and finally is incapable of operating. This attack takes advantage of a specific vulnerability inside the TCP/IP reassembly operation. The fragmented data packets exceed the capacity of the victim until, at some point, it crashes in its try to process them.
How to detect the Teardrop attack?
In the IP header of the packets is paced a field named “fragment offset.” It indicates the starting position, or the offset, of the data transmitted in fragmented packets. When the sum of the offset and the size of the packets are not equal, they overlap. The victim is incapable of reassembling the packets, and the DoS attack is completed.
Why is it important?
The vulnerability that the Teardrop attack uses usually refers to more aged operating systems (OS). For instance, Windows 3.1x, Windows 95, Windows NT, Windows Vista, Windows 7, and Linux with kernels earlier to 2.1.63.
The truth is that a significant number of businesses and institutions are still using older, obsolete, or unpatched operating systems. Typically, the reason for that is because they run legacy applications, which require these older versions of operating systems. Therefore, all of these businesses and institutions are extremely vulnerable to the Teardrop attack. Unfortunately, in many cases, such a threat aims to take down mission-critical applications.
How to stop the Teardrop attack?
As a user, you could perform several things in order to prevent and stop a potential Teardrop attack. They are the following:
- Disabling the Server Message Block (SMB): In case you are using a legacy OS, that means you are no longer receiving the needed security patches from vendors like Microsoft. Therefore, you could disable two ports – 139 and 445. Server Message Block (SMB) gives the ability to users to have access to shared files, printers, and serial ports.
- Protecting network layers: Due to the fact that the Teardrop attack targets the network layer, it would be best if you implement a firewall that will filter junk data.
- Utilizing caching servers: There is a chance to avoid the Teardrop attack by implementing caching servers. These servers are able to guarantee that their websites are up and running even if a DoS attack is initiated. That is possible thanks to the stored local duplicates.
- Using proxies: With proxy servers, users are able to examine the incoming data packets for fragmentation violations and don’t let them pass through into the network. It is very helpful for recognizing unwanted data and stopping it from arriving in.
Conclusion
The Teardrop attack is a cyber threat that should not be neglected. In case you are a user that is still working with legacy operating systems, make sure to take some measures for prevention.