Infrastructure Security

1. Infrastructure Security

Large-Scale DDoS Attacks in the United States and South Korea
In this report, we will report on incidents to which IIJ responded between July and September 2009.

At the same time, we will also cite the details behind large-scale DDoS attacks targeting Web servers
in the United States and South Korea, TCP vulnerabilities announced by CERT-FI,
and the mechanism behind silent phone calls caused by SIP packets.

1.1 Introduction
This whitepaper summarizes incidents to which IIJ responded, based on general information obtained by IIJ itself related tothe stable operation of the Internet, information from observations of incidents, information acquired through our services,
and information obtained from companies and organizations with which IIJ has cooperative relationships. This volume covers
the period of time from July 1 through September 30, 2009. A multiple number of Web servers in the United States and South
Korea were subject to large-scale DDoS attacks during this period. A series of vulnerabilities related to Web browsers werealso discovered during this time, and reports cited a vulnerability in DNS servers and other servers used frequently for theInternet. Additionally, a TCP vulnerability that affects many implementations was announced. Besides these announcements

and incidents, there were several incidents that resulted in direct financial damages, including cases of fake security softwareand extortion in connection with DDoS attacks. As seen above, the Internet continues to experience many security-related
incidents.

1.2 Incident Summary
Here, we discuss the IIJ handling and response to incidents that occurred between July 1 and September 30, 2009. Figure 1
shows the distribution of incidents handled during this period.*1
Other 23.4%

Vulnerabilities
40.3%

Political and Social
Situation 5.1%

History 9.1%

Security Incidents 22.1%

Figure 1: Incident Ratio by Category (July 1 to September 30, 2009)*1

Incidents discussed in this whitepaper are categorized as vulnerabilities, political and social situation, history, security incident and other.

Vulnerabilities: Responses to vulnerabilities associated with network equipment, server equipment or software used over the Internet, or used commonly inuser environments.

Political and Social Situations: Responses to incidents related to domestic and foreign circumstances and international events such as international
conferences attended by VIPs and attacks originating in international disputes.

History: Historically significant dates; warning/alarms, detection of incidents, measures taken in response, etc., related to an attack in connection with a past historical fact.

Security Incidents: Wide propagation of network worms and other malware; DDoS attacks against certain websites. Unexpected incidents and related response.
Other: Those incidents not directly associated with security problems, including highly concentrated traffic associated with a notable event.
Vol.5

November 20094

During this period, vulnerabilities were fixed in user applications such as Microsoft’s Internet Explorer*2, SMB2.0*3, and Visual
Studio Active Template Library*4. Many vulnerabilities were also corrected related to Web browsers, including vulnerabilities in

ActiveX killbit*5, JScript*6, Adobe Flash Player and Adobe Acrobat Reader*7, and Apple QuickTime*8.

In addition to the foregoing, vulnerabilities were discovered that affect the stability of BIND9*9, Squid*10 and other software

utilized frequently on servers. A Cisco router BGP vulnerability*11 was corrected, and a regular update for IOS was released toaddress several vulnerabilities during the period under study*12. A vulnerability related to TCP was publicly announced, which
affected a large number of implementations. See “1.4.2 TCP Vulnerability (Sockstress)” for more about this TCP vulnerability.
■ Political and Social Situations

IIJ pays close attention to various political and social situations related to international affairs and current events. During theperiod under study, Japan observed the 45th House of Representatives general election, the inauguration of the Consumer
Affairs Agency, and other political events. However, IIJ noted no related Internet attacks.
■ History

The period in question included several historically significant days, including the observance of the end of World War II andthe observance of the end of the Pacific War in Japan. In the past, historically motivated DDoS attacks and website alterations
have occurred during this time of the year, and IIJ paid particular attention to political and social situations. However, no directly
related attacks targeting IIJ facilities or customer networks were detected.
■ Security Incidents

Unanticipated security incidents not related to political or social situations occurred in the form of multiple large-scale DDoS

attacks against web servers in the United States and Republic of Korea (South Korea) during the first part of July. See “1.4.1
DDoS Attacks in the United States and South Korea” for more related to these incidents. Additionally, attacks on P2P filesharing networks from a cloud environment*13 and a DDoS attack against Twitter*14 occurred. In August, a DDoS attack wasaccompanied by a demand for money, euphemistically called a cost of measures*15.

*2

Microsoft Security Bulletin MS09-034 – Critical: Cumulative Security Update for Internet Explorer (972260) (http://www.microsoft.com/ technet/security/*3

Microsoft Security Bulletin MS09-050 – Critical: Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517) (http://www.microsoft.com/japan/

*4

*5
*6
*7
*8
*9
*10
*11
*12
*13

*14

*15

Vol.5

bulletin/ms09-034.mspx).

security/Bulletin/MS09-050.mspx).

Microsoft Security Bulletin MS09-035 – Moderate: Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)(http://www.microsoft.com/technet/security/bulletin/ms09-035.mspx) and Security Advisory for Adobe Flash Player APSA09-04 (http://www.adobe.com/
support/security/advisories/apsa09-04.html).

Microsoft Security Bulletin MS09-032 – Critical: Cumulative Security Update of ActiveX Kill Bits (973346) (http://www.microsoft.com/ technet/security/bulletin/MS09-032.mspx).

Microsoft Security Bulletin MS09-045 – Critical: Vulnerability in JScript Scripting Engine Could Allow Remote Code Execution (971961) (http://www.microsoft.
com/ technet/security/bulletin/ms09-045.mspx).

Security advisory for Adobe Reader, Acrobat and Flash Player APSA09-03 (http://www.adobe.com/support/security/advisories/apsa09-03.html). Security
updates available for Adobe Flash Player, Adobe Reader and Acrobat APSB09-10 (http://www.adobe.com/support/security/bulletins/apsb09-10.html).
About the security content of QuickTime 7.6.4 (http://support.apple.com/kb/HT3859).

BIND Dynamic Update DoS (https://www.isc.org/node/474). This vulnerability relates to a BIND server which holds zone information as a primary server. Even
servers that provide only cache functions still frequently have zone information such as localhost, and need to be patched.
Squid Proxy Cache Security Update Advisory SQUID-2009:2 (http://www.squid-cache.org/Advisories/SQUID-2009_2.txt).

Cisco Security Advisory: Cisco IOS Software Border Gateway Protocol 4-Byte Autonomous System Number Vulnerabilities (http://www.cisco.com/warp/
public/707/cisco-sa-20090729-bgp.shtml).

Cisco Security Advisory: Summary of Cisco IOS Software Bundled Advisories, September 23, 2009 (http://www.cisco.com/warp/public/707/cisco-sa20090923-bundle.shtml).

A cNotes article reported this incident. Attacks on Share P2P networks utilizing Amazon Web Service (http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi?p=Amazo
n+Web+Service%A4%F2%CD%F8%CD%D1%A4%B7%A4%BFShare%A5%CD%A5%C3%A5%C8%A5%EF%A1%BC%A5%AF%A4%D8%A4%CE%B
9%B6%B7%E2)(in Japanese).

Twitter’s tweet discussing the status of ongoing denial-of-service attacks (http://status.twitter.com/post/157191978/ongoing-denial-of-service-attack). The
Arbor Networks blog detailed the decrease in traffic volume “Where Did All the Tweets Go?” (http://asert.arbornetworks.com/2009/08/where-did-all-thetweets-go/)See the following article from Trend Micro regarding similar incidents “Botnet Extortion Attempts Extend to Japan (DDoS Attacks)” (http://blog.trendmicro.
co.jp/archives/1385)(in Japanese).
November 20095

Infrastructure Security■ Vulnerabilities

Infrastructure Security■ Other

As far as incidents not directly related to security, several international undersea cables were damaged by a typhoon in

Taiwan, affecting communications in and out of the area*16. A number of anti-virus software firms released 2010 updates, withconcurrent releases of counterfeit software nearly indistinguishable from these programs*17. Similarly, as Microsoft released its

free Microsoft Security Essentials*18 anti-virus tool during the period under study, fake security software (scareware) began toappear in search engine results, inducing unsuspecting users to click through*19.

1.3 Incident Survey
Of those incidents occurring on the Internet, IIJ focuses on those types of incidents that have infrastructure-wide effects,
continually conducting research and engaging in countermeasures. In this section, we provide a summary of our survey andanalysis results related to the circumstances of DDoS attacks, malware infections over networks, and SQL injections on Web
servers.

1.3.1 DDoS Attacks

Today, DDoS attacks on corporate servers are almost a daily occurrence. The methods involved in DDoS attacks vary widely.
Generally, however, these attacks are not the type that utilize advanced knowledge such as that of vulnerabilities, but rather
cause large volumes of unnecessary traffic to overwhelm network bandwidth or server processes for the purpose of hindering

services. Figure 2 shows the circumstances of DDoS attacks handled by the IIJ DDoS Defense Service between July 1 and
September 30, 2009.

This information shows traffic anomalies judged to be attacks based on IIJ DDoS Defense Service standards. IIJ also responds
to other DDoS attacks, but these incidents are excluded from the figure due to the difficulty in accurately ascertaining the factsof each situation.
(No. of Attacks)■Compound Attacks■Bandwidth Attacks■Server Attacks

16
14
12
10
8
6
4
2
0
2009.7.1

2009.8.1

2009.9.1(Date)

Figure 2: DDoS Attacks

2009.9.1 1
2009.8.1 0
0
0
date
TCP
UDP/ICMPHYBRID2009.9.2 2
2009.8.2
000
2009.7.1 0
01
2009.9.3 2
2009.8.3 2
00
2009.7.2 1
00
2009.9.4 1
2009.8.4
1
00
2009.7.3 1
00
2009.9.5 1
2009.8.5 2
00
2009.7.4 0
00
2009.9.6 2
2009.8.6
1
0
1
2009.7.5 2
00
2009.9.7 4
2009.8.7 2
00
2009.7.6 0
00
2009.9.8 1
2009.8.8
6
0
2
2009.7.7 1
00
2009.9.9 0
2009.8.9 14
002009.7.8 0
00
2009.9.10 1
2009.8.10
11
00
2009.7.90 include the0 following from NetworkWorld. “Asian undersea cable disruption slows Internet access” (http://www.networkworld.com/*16
Reports0about this incident
2009.9.11 3
2009.8.11 13
0
2
2009.7.10
300news/2009/081209-asian-undersea-cable-disruption-slows.html).
2009.9.12 1
2009.8.12
13
0
1
*17
Blog entry
accurately imitating Symantec products. Symantec Security Blogs: Nort “what” AV? (http://www.symantec.com/
2009.7.11
1 regarding 0counterfeit software0
2009.9.13 3
2009.8.13 100connect/blogs/nort-what-av).
2009.7.12
000
2009.9.14 4
2009.8.14
100*18Microsoft(http://www.microsoft.com/security_essentials/).
2009.7.13
3 Security Essentials
002009.9.15 4
0
0
0
*19
IIJ has confirmed
that0links leading 0
to fake software have ranked high2009.8.15
in English environment.
2009.7.14
2
2009.9.16 4
2009.8.16
000
2009.7.15 0002009.9.17 3
2009.8.17 2
002009.7.16 2
002009.9.18 2
Vol.5 November 20096
2009.8.18
100
2009.7.17 1
01
2009.9.19 1
2009.8.19 1
002009.7.18 0002009.9.20 0
2009.8.20
100
2009.7.19 0002009.9.21 3
2009.8.21 3
01
2009.7.20 0002009.9.22 0
2009.8.22
000
2009.7.21 001
2009.9.23 1
2009.8.23 0
0
0

0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0
0

0
0
0
0
1
0
0
0
0
0
0
0
0
1
0
0
0
6
0
0
0
0
0

(bandwidth and server performance) will largely determine the degree of impact. Figure 2 categorizes DDoS attacks into three
types: attacks on bandwidth capacity*20, attacks on servers*21, and compound attacks (several types of attacks on a single

target conducted at the same time).

During the three months under study, IIJ dealt with 192 DDoS attacks. This averages to 2.08 attacks per day, representing an

increase in the average daily number of attacks compared to our prior whitepaper. Considering the fact that a multiple numberof attacks occurring between August 9 and August 12 targeted a certain website for a lengthy period, the overall trend did nototherwise vary significantly from that discussed in our prior whitepaper.

Bandwidth capacity attacks accounted for 0% of all incidents. Server attacks accounted for 87% of all incidents, and compound

attacks accounted for the remaining 13%. The largest attack observed during the period under study was a compound attack

that tied up 566Mbps of bandwidth using 140,000pps packets. Of all attacks, 80% ended within 30 minutes of commencement,
while 19% lasted anywhere from 30 minutes to up to 24 hours. During the time period under study, IIJ noted one attack thatlasted for 94 hours and 30 minutes (approximately four days).

In most cases, we observed an extremely large number of IP addresses, whether domestic or foreign. We believe this isaccounted for by the use of IP spoofing*22 and botnet*23 usage as the method for conducting DDoS attacks.

1.3.2 Malware Activities

Here, we will discuss the results of the observations of the Malware Investigation Task Force (MITF)*24, a malware activity

observation project operated by IIJ. The MITF uses honeypots*25 connected to the Internet in a manner similar to general users
in order to observe communications arriving over the Internet. Most appear to be communications by malware selecting atarget at random, or scans attempting to locate a target for attack.

*20

Attack that overwhelms the network bandwidth capacity of a target by sending massive volumes of larger-than-necessary IP packets and fragments. The use*21

TCP SYN flood, TCP connection flood, and HTTP GET flood attacks. TCP SYN flood attacks send mass volumes of SYN packets that signal the start ofof UDP packets is called a UDP flood, while the use of ICMP packets is called an ICMP flood.

TCP connections, forcing the target to prepare for major incoming connections, causing the wastage of processing capacity and memory. TCP Connection
flood attacks establish mass volumes of actual TCP connections. HTTP GET flood attacks establish TCP connections on a Web server, and then send mass

*22
*23
*24
*25
Vol.5

volumes of HTTP GET protocol commands, wasting processing capacity and memory.

Misrepresentation of a sender’s IP address. Creates and sends an attack packet that has been given an address other than the actual IP address of theattacker in order to pretend that the attack is coming from a different location, or from a large number of individuals.

A “bot” is a type of malware that institutes an attack after receiving a command from an external C&C server. A network constructed of a large number of botsacting in concert is called a “botnet.”

Malware Investigation Task Force (MITF). The MITF began activities in May 2007 observing malware network activity through the use of honeypots in an attempt
to understand the state of malware activities, to gather technical information for countermeasures, and to link these findings to actual countermeasures.
A system designed to simulate damages from attacks by emulating vulnerabilities, recording the behavior of attackers, and the activities of malware.
November 20097

Infrastructure Security

There are many methods that can be used to carry out a DDoS attack. In addition, the capacity of the environment attacked

Infrastructure Security■ Status of Random Communications

Figure 3 shows trends in the total volumes of communications coming into the honeypots (incoming packets) between July 1
and September 30, 2009. Figure 4 shows the distribution of sender’s IP addresses by country. The MITF has set up numerous

honeypots for the purpose of observation. We have taken the average per honeypot, showing the trends for incoming packet
types (top ten) over the entire period subject to study.

Much of the communications arriving at the honeypots demonstrated client-targeted scanning behavior using TCP ports
utilized by Microsoft operating systems. As with the prior study, we observed scanning behavior attempting to exploit 2967/TCP

used by Symantec client software and 4899/TCP used by PC remote management tools. At the same time, communications
for which the goal was not clearly identifiable, such as 53248/TCP and 20689/TCP (not used by general applications), werealso observed. Attacks on 445/TCP, etc., targeting Microsoft vulnerabilities have continued since last October. Looking at theoverall sender distribution by country, we see that attacks sourced to China and Japan, 26.6% and 24.4%, respectively, werecomparatively higher than the rest.

(No. of Packets)
1,200

1,000
800

■Other■4899/TCP■22000/TCP■31138/TCP■20689/UDP■2967/TCP■53248/TCP■1433/TCP■2582/TCP■135/TCP■445/TCP

600
400
200
0
09.07.01

09.08.01(Date)

09.09.01

Figure 3: Communications Arriving at Honeypots (by Date, by Target Port, per Honeypot)
sensor 台数を 61 として計算
time

445/TCP

135/TCP

2582/TCP

1433/TCP

53248/TCP

2967/TCP

20689/UDP

31138/TCP

22000/TCP

4899/TCP

その他

2009.7.1

195.5409836

34.03278689

46.06557377

33.19672131

021.3442623

0.327868852

040.86885246

3.93442623

315.6557377

2009.7.2

181.7704918

49.36065574

45.16393443

11.93442623

0.081967213

037.59016393

9.983606557

231.2295082

2009.7.3
197.8196721
Other 27.4%

42.36065574

47.26229508

15.55737705

0

0

37

8.409836066

305.4098361

2009.7.4
IN 1.2%177.7704918

44.27868852

53.04918033

27.2295082
0
ISP A 6.5%
21.47540984
ISP B0 2.8%

20.6557377

0039.42622951

13.78688525

284.5081967

IT 1.2%
2009.7.5

163.1803279

44.59016393

41.83606557

26.3442623

0.016393443

039.03278689

3.721311475

256.7540984

RU 1.5% 151.4098361
2009.7.6

43.42622951

33.04918033

13.45901639

0027.18032787

12.36065574

217.4098361

37.63934426

29.55737705

9.672131148

0.049180328

023.6557377

2.426229508

197.5409836

43.45901639

36.19672131

13.59016393

0020.98360656

7.672131148

205.6393443

43.3442623

35.98360656

11.31147541

0023.80327869

6.786885246

141.3114754

43.44262295

26.32786885

ISP D0 1.7%
34.80327869
ISP E 1.3%
36.90163934 0
IIJ 1.1%
35.78688525 0
ISP F 1.0%
52.67213115 0
ISP G 1.0%
45.04918033
ISP H0 0.9%

0026.09836066

2.672131148

144.2131148

41.75409836

26.09836066

Other0 7.7%
54.93442623

8.639344262
5.180327869

0.016393443

028.7704918

7.06557377

208.2622951

38.55737705

28.91803279

29.78688525

494.7213115

7.803278689

0.016393443

025.83606557

8.06557377

188.6065574

43.1147541

24.7704918

32.95081967

210.3770492

9.245901639

0.016393443

016.06557377

17.19672131

128.4262295

0

0

16

6.180327869

142.6721311

Outside Japan 73.4%

BR 1.5% 168.0655738
2009.7.7
KR 1.5%2009.7.8
166.3114754
TH 3.3%2009.7.9
174.8196721
TW 3.5%2009.7.10
155.5409836
EU 3.8%2009.7.11
162.4590164
US 4.1%
2009.7.12
CN 24.4% 169.4098361
2009.7.13

156.5245902

Within Japan 26.6%

28.18032787
ISP C0 2.0%

42.19672131ISP 0I 0.6%

2009.7.14
171.2459016Distribution
38.8852459
20.55737705
21.26229508
115.0983607
Figure 4: Sender(Entire Period
underStudy) 7

untry code
A社

BE B 社

NFRA

EB D 社

com E 社
IIJ

F社

G社
H社
I社

その他
CN

2009.7.15

183.4098361

34.04918033

21.04918033

26.8852459

79.16393443

9.803278689

0013.73770492

15.63934426

126.6721311

2009.7.16

177.0327869

57.19672131

19.55737705

36.60655738

67.98360656

19.18032787

0013.70491803

10.03278689

203.6885246

2009.7.17

171.7868852

43.2295082

20.19672131

36.1147541

55.81967213

7.098360656

0012.95081967

5.983606557

203.4754098

2009.7.18

154.3770492

50.67213115

26.78688525

36.04918033

57.98360656

4.590163934

0015.3442623

1.901639344

142.3278689

2009.7.19

140.0983607

44.37704918

34.40983607

34.19672131

42.18032787

20.37704918

0014.72131148

1.606557377

94.67213115

2009.7.20

148.6885246

50.09836066

33.62295082

32.90163934

34.67213115

10.67213115

0014.29508197

1.737704918

104.9344262

2009.7.21

142.5409836

50.54098361

26.27868852

32.50819672

27.18032787

9.180327869

0010.36065574

1.901639344

135.9016393

2009.7.22

139.9836066

37.67213115

29.42622951

37.54098361

23.2295082

19.18032787

0.37704918

19.44262295

9.803278689

10.47540984

135.6065574

2009.7.23

153

39.72131148

27.86885246

25.09836066

21.83606557

7.786885246

045.24590164

9.245901639

9.836065574

138.4590164

0.032786885

55.01639344

9.098360656

16.78688525

106.1639344

ISP/Country2009.7.24
code
6.50%

2.77%
C社

1.69%

1.33%

1.09%

1.03%

0.99%

0.88%

0.58%

7.70%

24.36%

6.5%
2009.7.25

2.8%
2009.7.26

Percentage
Percentage Count
Name
Percentage
157.1803279 39.7704918
29.04918033 35.93442623 16.80327869 17.09836066
751706156.1311475 国内
50.63934426 26.6%
42.96721311

36.67213115

20.31147541

14.04918033

35.85245902

24.44262295

11.52459016

4.344262295

122.6229508

156.2622951

46.04918033

39.6557377

25.7704918

16.98360656

14.80327869

59.47540984

13.40983607

11.04918033

2.196721311

129.9672131

40.39344262

31.44262295

24.18032787

12.55737705

12.1147541

9.344262295

8.409836066

9.819672131

4.62295082

109.3770492

2009.7.27
1.98%

153.0327869
2.0%

151.5737705

44.6557377

30.96721311

32.04918033

10.59016393

23.80327869

5.721311475

11.96721311

8.901639344

1.901639344

108.9672131

2009.7.29

1.3%

154.0983607

57.85245902

28.70491803

21.52459016

11.18032787

9.770491803

3.278688525

14.49180328

9.426229508

0147.6065574

2009.7.30
1.1%

160.0983607

52.26229508

26.26229508

29.2295082

12.72131148

25.3442623

5.147540984

13.08196721

7.06557377

4.098360656

188.3934426

2009.7.31

1.0%

171.557377

55.6557377

23.93442623

21.85245902

13.24590164

22.2295082

42.06557377

11.27868852

8.213114754

5.803278689

196

2009.8.1

156.8688525

81.80327869

29.21311475

31.13114754

12.31147541

19.91803279

4.655737705

12.16393443

9.557377049

3.983606557

144.442623

2009.8.2

144.852459

160.8688525

36.75409836

25.81967213

12.13114754

22.21311475

10.09836066

20.39344262

9.131147541

30.04918033

222.6393443

144.9344262

20.63934426

28.7704918

24.37704918

7.950819672

24.98360656

33.16393443

41.09836066

6.62295082

6.68852459

118.3114754

141.8688525

48.80327869

35.40983607

33.93442623

7.803278689

25.83606557

22.1147541

49.1147541

6.704918033

2.967213115

119.6557377

262.147541

55.55737705

35.55737705

25.86885246

6.721311475

27.19672131

0.213114754

59.04918033

5.327868852

6.901639344

136.6229508

24.08196721

5.081967213

21.37704918

36.40983607

50.21311475

6.131147541

5.475409836

145.4754098

2009.7.28
1.7%

Vol.5 November 2009
1.0%

0.9%
2009.8.3

0.6%
2009.8.4

7.7%
2009.8.5

24.4%
2009.8.6

2082084
152.8852459 国外
55.90163934 73.4%
33.85245902

8

■ Malware Network Activity

Infrastructure Security

Date
総取2009.7.1 341
2009.7.2 332
specimens acquired during the period under study. Figure 6 shows the distribution of the specimen acquisition source for malware.
2009.7.3 366
26
In Figure 5, the trends in the number of acquired specimens show the total number of specimens acquired per day* , while the2009.7.4 664
number of unique specimens is the number of specimen variants categorized according to their digest of a hash function*27.
2009.7.5 497
2009.7.6 504
2009.7.7 577
On average, 592 specimens were acquired per day during the period under study, representing about 46 different malware
2009.7.8 325
variants. According to the statistics in our prior whitepaper, the average daily total for acquired specimens was 708, with 60
2009.7.9 724
different variants, indicating a slight decline in average number of specimens and number of variants.
2009.7.10 641
2009.7.11 605
2009.7.12 460
The distribution of specimens according to source country has Japan at 64.4%, with other countries accounting for the 35.6%
2009.7.13 568
balance. Of the total, malware infection activity among IIJ users was 1.5%—a significant decrease compared to the 16.8%
2009.7.14 584
figure reported in our prior whitepaper. Looking more closely at the malware variants, after June of this year, we see that this2009.7.15 364
2009.7.16 621
trend has resulted from a dramatic decline in activities attempting to infect computers with Virut*28 and its variants and activities2009.7.17 536
29related to Sdbot* and its variants on the IIJ network.
2009.7.18 425
2009.7.19 814
2009.7.20 513(Total No. of Specimens Acquired)(No. of Unique Specimens)
1,800
2009.7.21 438
120■Total No. of Specimens Acquired
2009.7.22 501■No. of Unique Specimens
1,600
100
2009.7.23 493
1,400
2009.7.24 458
1,200
80
2009.7.25 533
1,000
2009.7.26 642
60
2009.7.27 514
800
2009.7.28 564
600
40
2009.7.29 506
400
2009.7.30 596
20200
2009.7.31 672
002009.8.1 754(Date)
09.07.01
09.08.01
09.09.01
2009.8.2 176
2009.8.3 256
Figure 5: Trends in the Number of Malware Specimens Acquired (Total Number, Number of Unique Specimens)
2009.8.4 578
2009.8.5 520
Count
ISP/CountryCode
ISP/Country code
Percentage Percentage Count
Outside Japan 35.6%
Within Japan 64.4%
2009.8.6 Name
773
Other 2.0%
2009.8.7 808
14744
ZAQ(9617) A 社
27.70%
27.7%
34240
国内
64.4%
EU 0.1%
2009.8.8 874
7461
BIGLOBE(2518)
B社
14.02%
14.0%
US 0.1%
2009.8.9 744
4771
INFOWEB(2510)
C社
8.96%
9.0%
PH 0.2%
ISP A 27.7%
2009.8.10 860
VN 0.4%
3762
OCN(4713)D 社
7.07%
7.1%
2009.8.11 910
AU 0.8%1046
STNET(7522)
E社
1.97%
2.0%
KR 1.0%2009.8.12 768
ISP B 14.0%
I N 2.8%
773
IIJ(2497) IIJ
1.45%
1.5%
2009.8.13 802
ISP
C
9.0%
TW 6.8%2009.8.14 541
708
UCOM(17506)
F社
1.33%
1.3%
ISP D 7.1%
TH 7.8%ISP E 2.0%
2009.8.15 668
CN 13.6%
634
DION(4732)
G社
1.19%
1.2%
IIJ 1.5%
2009.8.16 419
177
KDDI(2516)
H社
0.33%
0.3%
ISP F 1.3%
2009.8.17 982
123
KMN(17529)
I
社
0.23%
0.2%
ISP G 1.2%
2009.8.18 1695
ISP H 0.3%
41
others
その他
0.08%
0.1%
2009.8.19 662
Figure 6: Distribution of Acquired Specimens by Source
ISP I 0.2%
7244
CN
CN
13.61%
13.6%
18989
国外
35.6%
2009.8.20 851
Other 0.1%
(Entire Period under Study)
2009.8.21 548
4154
TH
TH
7.80%
7.8%
2009.8.22 640
3600
TW
TW
6.76%
6.8%
2009.8.23 790
1513
IN
IN
2.84%
2.8%
*26 This indicates the malware acquired by honeypots.
2009.8.24 522
513
KR
KR
0.96%
1.0%
*27 This figure is derived by utilizing a one-way function (hash function) that outputs a fixed-length value for various input. The hash function is designed to2009.8.25 681
435
AU
AU
produce as many different outputs as possible for different inputs. While wecannot guarantee
the uniquenessof0.82%
specimens 0.8%
by hash value, given that2009.8.26 442
203
VNvalues, theVN
0.38% its best
0.4%
obfuscation and padding may result in specimens of the same malware having
different hash
MITF has expended
efforts to take this fact
2009.8.27 449
into consideration when using this methodology as a measurement index.
2009.8.28 342
108
PH
PH
0.20%
0.2%
*28 Virut is a virus spread through an infected file, and is not generally spread throughnetworks.
of thisvirus was attempted
as the result of
2009.8.29 760
65
US The propagation
US
0.12%
0.1%
an attack exploiting a vulnerability. See Trend Micro’s explanation of Virut (http://threatinfo.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=MAL_
2009.8.30 486
46
EU
EU
0.09%
0.1%
VIRUT). Also see an alert from the Information-Technology Promotion Agency, Japan (IPA) regarding Virut propagation via web content (http://www.ipa.go.jp/
2009.8.31 620
1108
others
その他
2.08%
2.0%
security/txt/2009/03outline.html)(in Japanese). A similar attempt to propagate malware was detected at the Cyber Clean Center, suspected to be related to2009.9.1 494
other malware infection activities (https://www.ccc.go.jp/report/200907/0907monthly.html)(in Japanese).
2009.9.2 256*29 An Sdbot is a type of bot conducting communications with the C&C server via IRC. See Trend Micro’s explanation of the Sdbot (http://threatinfo.trendmicro.
2009.9.3 288
com/vinfo/virusencyclo/default5.asp?vname=WORM_SDBOT.GEN).
2009.9.4 680
2009.9.5 447
2009.9.6 318
Vol.5 November 20099
2009.9.7 532
2009.9.8 531
2009.9.9 444
2009.9.10 596
2009.9.11 695

Next, we will take a look into the malware activity observed by the MITF. Figure 5 shows trends in the total number of malware

Infrastructure Security

The MITF prepares analytical environments for malware, conducting its own independent analyses of acquired specimens. The
results of these analyses show that during the period under observation, 4.5% of the malware specimens were worms, 89.6%

were bots, and 5.9% were downloaders. In addition, the MITF confirmed the presence of 44 botnet C&C servers*30 and 548
malware distribution sites.

1.3.3 SQL Injection Attacks

Of the types of different Web server attacks, IIJ conducts ongoing surveys related to SQL injection attacks*31. SQL injection

attacks have flared up in frequency numerous times in the past, remaining one of the major topics in the Internet security. SQL
injections are known to occur in one of three attack patterns: those that attempt to steal data, those that attempt to overload
database servers, and those that attempt to rewrite Web content.

Figure 7 shows trends of the numbers of SQL injection attacks against Web servers detected between July 1 and September

30, 2009. Figure 8 shows the distribution of attacks according to source. These data are a summary of attacks detected bysignatures on the IIJ Managed IPS Service. Japan was the source for 67.3% of attacks observed, while China and the UnitedStates accounted for 11.6% and 4.9%, respectively, with other countries following in order.

We noted a decrease in SQL injection attacks on web servers compared with our prior whitepaper. While the total number of
SQL injection attacks declined, the decrease among source countries outside of Japan was particularly notable. Accordingly,
the ratio of attacks sourced to Japan experienced a significant increase.

その他

As previously shown, attacks of various types were properly detected and dealt with in the course of service. However, suchattacks are constant and ongoing, calling for continued vigilance.

HTTP̲

HTTP̲

HTTP̲

(No. Detected)

HTTP̲

800

HTTP̲

700

■Other■ HTTP_GET_SQL_Select_Top_1

600■ HTTP_OracleApp_soap

500■ HTTP_GET_SQL_UnionSelectHTTP̲■ HTTP_OracleAdmin_Web_Interface

URL̲D■ HTTP_IIS_MSSQL_XML_Script

URL̲D■ URL_Data_SQL_char

SQL̲In■ HTTP_GET_SQL_Convert_Int

400■ URL_Data_SQL_Cast_parentheses

300

URL̲D

200

■ URL_Data_SQL_1equal1

100■ SQL_Injection

0
09.07.01

09.08.01(Date)

09.09.01

Figure 7: Trends in SQL Injection Attacks (by Day, by Attack Type)
Other 12.5%
ID 0.3%
SQL_Injection URL_Data_SQL_char
日付
FR 0.4%
HTTP_GET_SQL_UnionSelectHTTP_OracleApp_soap

HTTP_GET_SQL_Select_Top_1

2009.7.2

02009.7.1

2009.7.3

2009.7.4

2009.7.5

2009.7.6

2009.7.7

2009.7.8

2009.7.9

304
TW 0.4%
85

38

7

179
AR 0.7%
82

36

12

10

SG 0.4%161

227
BR 0.7%109
KR 0.8%161

2009.7.10

194
US 4.9%205

2009.7.12

75

2009.7.11

2009.7.13

2009.7.14

2009.7.15

2009.7.16

2009.7.17

2009.7.18

2009.7.19

2009.7.20

2009.7.21

2009.7.22

66 11.6%
CN
78

124

101
97

165
*30
57

*31

183
73

143
73

19

52

13

54
7

54

49
6

8

14
8

30

39
3

32

34
7

2009.7.25

74

2

2009.7.27

2009.7.28

2009.7.29

20

89

69

190

12

24
1

12
7

3

3

6

1

9

12

0

0

0

6

0

0
JP 67.3%
0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

6

6

0

0

0

0

6

0

0

0

6

0

0

3

6

43
0

0

0

5

0

5

5

0

0

0

0

27

0

0

0

0

60

4

0

0

0

0

0

8

0

12

0

0

0

0

without proper
authorization,and stealor rewrite
Web content.
37
14
0 sensitive information
0002009.7.23

2009.7.26

180HTTP_OracleAdmin_Web_Interface

CN
2540
0
0
0
50
US
1076 0
0
0
0
0
56
KR
184
0
0
0
0
83
BR
147
0
0
0
0
17
0
73 AR
0
0
26
145
0
0
0
0
69
SG
96
0
0
1
0
53
TW
96
0
0
2
0
93
FR
0
0
55 80
2
313
0 Figure 8:1Distribution
0ID
74
of SQL0 Injection84Attacks by
0
17
13
Sourceその他 0 2734 0
その他

0

3

1

0

0

0

0

0

4

3

12

0

1

0

18

111
44

42

71

53

Attacks accessing a Web server to send SQL commands, thereby manipulating an underlying database. Attackers access or alter the database content

November
29 2009

306

3

JP
14736
HTTP_IIS_MSSQL_XML_Script URL_Data_SQL_Cast_parentheses

16
2
0 A server that0 provides commands
0010
Abbreviationof “Command& Control.”to a2botnet consistingof a large0number of bots.

Vol.5
172

2009.7.24

2

URL_Data_SQL_1equal1

20

22

28

25

11

10
0

8

0

0

2

9

0

2

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

6

0

0

2

0

0

10 0

0

0

7

0

10
0

0

0

0

0

0

0

0

0

51
0

0

0

0

1

3

0

0

0

0

3

0

0

0

0

0

0

0

0

0

0

0

0

0

0

0

4

0

0

28

17

52

105
67

68

17

39

36

71

42

HTTP_GET_SQL_

Incidents occurring over the Internet change in type and scope almost from one minute to the next. Accordingly, IIJ works
toward taking countermeasures by performing independent surveys and analyses. Here we will present information gatheredfrom surveys performed during the period from July 1 and September 30, 2009 related to DDoS attacks in the United Statesand South Korea, TCP vulnerability (Sockstress), and randomly arriving SIP packets.

1.4.1 DDoS Attacks in the United States and South Korea

In early July 2009, websites in the United States and South Korea were victimized by a series of simultaneous DDoS attacks*32.

In this section, we will discuss the circumstances of these attacks, based on information obtained by IIJ.
■ DDoS Attack Background

This particular series of DDoS attacks did not use botnets so widely encountered today, but rather malware designed specificallyfor these attacks. It is reported that this specially designed malware propagated through websites inside South Korea used forfile sharing*33. Because of this, many of the IP addresses traced as the source of the attack reportedly have been identified
as South Korean IP addresses*34. Malware files of a similar type were placed on similar web services outside South Korea,

infecting PCs in other countries*35. While it is unclear as to what timeframe these infection activities took place, it is believed thatthe propagation activities took place in a concentrated period immediately before the DDoS attacks in order to evade detection
and countermeasures by anti-virus software vendors*36. The total number of PCs infected by the malware is undetermined, but

a subsequent announcement out of South Korea indicated that the infection affected approximately 78,000 machines within
the country*37.

The DDoS attacks first occurred on July 5*38 and July 6 (Korean time), mainly targeting multiple government agencies’ web

servers in the United States. After July 7, the attacks moved to multiple websites in South Korea. The attacks in South Korea
affected not only government agencies, but also online banking sites, webmail services, and other popular online consumer

services. It has been reported that the infected PCs used for the DDoS attacks did not generate significant amounts of traffic
singly. Rather than occupying communication lines using massive volumes of traffic, the attacks mainly put a direct load on thetarget servers*39.

This particular DDoS attack died down on July 10, eventually running its course*40. That the malware was cleaned from 95%of the approximately 78,000 machines infected within four days was mostly due to the efforts of South Korean ISPs, security

organizations, and media*41. As a result of these efforts, the DDoS attack converged as of July 10. There was a report that only
several hundred hard drives were destroyed as a side effect of infection with the malware.

*32

F-Secure reported on its blog that several websites in the United States became inaccessible because of this DDoS attack (http://www.f-secure.com/weblog/*33

Web-based file-sharing services (so-called “uploaders” in Japan) are used frequently in South Korea by corporations and educational institutions. It is believed

*34
*35
*36
*37
*38
*39
*40
*41

archives/00001720.html). South Korean news organizations also reported that several websites in that country became inaccessible due to the attack.
that many users became infected when files containing the malware infection package were uploaded to several of these services.

The following report states that more than 100,000 PCs were conscripted in this attack, between 90% and 95% of which were located in South Korea (http://
www.shadowserver.org/wiki/pmwiki.php/Calendar/20090710).

The following is an alert from JPCERT/CC discussing the attack from Japan, “DDoS attack against Web sites in South Korea and US” (http://www.jpcert.or.jp/
at/2009/at090012.txt)(in Japanese).

As one circumstantial evidence, a specimen obtained and studied by IIJ forged a file creation date of 2004, while the time stamp in the PE header of each file
showed a date immediately prior to the launch of the attack, “July 4, 2009 0:38” for perfvwr.dll as an example.

Information related to the number of affected machines inside South Korea is detailed in a presentation at APNIC28 by KRNIC of KISA (Korean Internet &Security Agency) (http://meetings.apnic.net/__data/assets/pdf_file/0019/14077/lee-ddos-attack.pdf).

The first attack began at 2am, July 5 Korean local time. The time was 13:00 EDT July 4 (Independence Day) in the United States. There is no time zone
difference between Korea and Japan.

For example, the following alert from KrCERT indicates the circumstances of the DDoS attack traffic from this malware (http://www.krcert.or.kr/noticeView.
do?num=340). (in Korean)With traffic returning to normal levels, the Korean NCSC (National Cyber Security Center) lowered its warning level from an “alert” to a “notice” on July 12.

According to the details published by KrNIC in APNIC28 (http://meetings.apnic.net/28/program/apops/transcript#ji-young-lee). Subsequent to the DDoS
attack in South Korea, information about the malware used in the attack and tools dedicated to eliminate the malware were promptly provided by several anti-

virus vendors. Television news programs and popular web services issued notifications regarding the attack in conspicuous ways in efforts to alert the public

and publicize information regarding corrective action. Information was also released notifying users that backing up their system clocks to an earlier time wasan effective temporary measure against one of the malware variants that would destroy hard drives on a specific date (July 10).
Vol.5

November 200911

Infrastructure Security

1.4 Focused Research

Infrastructure Security■ Malware used in the DDoS Attacks

Once this attack occurred, IIJ first obtained several malware specimens from general malware-related information sources andorganizations. These specimens included malware that first induces malware infections for DDoS attacks, malware containing
functions for actual DDoS attacks and malware that continues to update attack targets.

Having analyzed and conducted demonstration tests on these specimens, we learned that the malware utilized in these attacks
behaved as shown in Figure 9*42.

First, the initial malware package (msiexec*.exe, etc.) drops (creates) two types of malware (perfvwr.dll (or wmiconf.dll)
and wmcfg.exe) (1). The malware perfvwr.dll (or wmiconf.dll) first turns off the personal firewall of the infected PC prior tocommencing the attack. Next, the infected PC connects to three separate servers, creating a configuration file (uregvs.nls)

for the attack (2). The perfvwr.dll and wmiconf.dll malware files start a DDoS attack according to the configuration file (3).
The configuration file contains the length of time, target server, attack type and number of attacks for the DDoS attack. Thismalware-based attack is performed as shown in Figure 9 (4), in accordance with the configuration file. The results of the IIJ
demonstration tests showed that the attack traffic generated per machine was 110pps for TCP SYN flood, 110pps for TCP ACK

flood, and around 216pps for UDP and ICMP floods, with 107cps (commands per second) for HTTP GET flood and HTTP

POST flood. We also observed behavior of intermittent increases and decreases in communications via program-embedded
temporary suspension command.

Meanwhile, wmcfg.exe drops two more files—mstimer.dll and wversion.exe (5). The mstimer.dll file downloads a file calledflash.gif from multiple web servers (6), extracting and updating a file called wversion.exe from flash.gif (7), while at the sametime sending spam to multiple addresses (8). The wversion.exe file deletes the mstimer.dll file and itself, removing evidence(9). However, a function is inserted after the update to search and destroy files on the hard drive having certain extensions (10),writing certain character strings to the hard drive MBR*44, and preventing the PC from being turned on (11).

(4) DDoS Attack Behavior(2) Create

Download• Reads the configuration file (uregvs.nls), creates 30 attack threads for eachtarget host, and conducts the following attacks in parallel.

Updated on Three Servers• Attack Target Information
Updatedmsiexec2.exe, etc.
• Creates uregvs.nls• Deletes itself• Two TCP SYN floods, two TCP ACK floods, two UDP floods, two ICMP

floods, one ICMP smurf attack, two HTTP GET floods (or HTTP POST

uregvs.nls(configuration file
indicating attack
target, attack time, etc.)

Readfloods depending on the configuration) for a total of 11 attacks, repeated.

• Of the two TCP SYN flood, TCP ACK flood, UDP flood and ICMP flood
attacks, one uses IP spoofing (false IP address).

• Under HTTP GET flood, a mechanism for impersonating a general user

(3) DDoS Attack(1) Drop
Access(user agent designation, prohibition against using the cache, etc.) and aconfiguration for placing a communications load on a server are used*43.

GET Flood
TCP/UDP/ICMP Floodperfvwr.dll(wmiconf.dll)• Executes DDoS attack• Turns off personal firewall• Attack volume varies according to time based on temporary suspension
command located within the attack code.

Attack Target Hosts(8) Mass mailing(5) Drop(8) Mass Mailing Activities• Searches for specific files, and collects email addresses.

(6) Download

msiexec1.exe, etc.

• Drops Malware• Accesses update server• wmiconf.dll service registration• Deletes itself• Sends SPAM mails (Subject “memory of …”; From
“Independence”) to multiple addresses.

mstimer.dll

DownloadServers(several dozen)(1) Drop• Mass mailing• Downloads flash.gif• Extracts new wversion.exe fromflash.gif and executes

flash.gif(11) HDD destruction• A new wversion.exe
attached after the image

wmcfg.exe(7) Executable file
extraction• Drops malware• mstimer.dll service registration• Deletes itself

SPAM email

HDD(10) (11) HDD, File Destruction• mstimer.dll downloads flash.gif from the download server; extracts
wversion.exe; performs update and executes.

• The new wversion.exe file searches for files having certain extensions on July
10, and destroys them.

• Also on July 10: malware writes a certain character string (“Memory of the(5) Drop

Update(9) wversion.exe (old)• Deletes mstimer.dll• Deletes itself

Independence Day…”) to the HDD MBR, preventing the PC from being(10) File destruction

wversion.exe (new)• Destroys certain files• Destroys HDD data

turned on.

File• Deletes mstimer.dll (file, service).
• Deletes itself.

Figure 9: Behavior of Malware used in DDoS Attacks*42

Our descriptions of this behavior is based on our best efforts at directly gathering information; however, the description includes some information that IIJ was*43

Various patterns were noted; character strings forged Firefox, IE7.0, or IE8.0 in the User-Agent header. “ko” (Korean language) was designated in the Accept-

*44

Vol.5

not able to directly confirm about the roles and status of various Internet servers at the time of the DDoS attack.
Language header. The Cache-Control header of some requests showed no-store, must-revalidate.

MBR: Acronym for Master Boot Record. The MBR is a region at the front of the hard drive; normally programs used for launching the computer’s operating
system are stored in this region.
November 200912

Figure 10 shows the chronological order of the progression and related events for the attack described in this section.
Normally, DDoS attacks are designed for harassment or other clear intent targeting a certain website, and are generally one
type of security incident for which the purpose is comparatively easy to identify. The DDoS attack described here, however,

was highly complex (malware propagates within South Korea first, attacks targets in the U.S. and then South Korea*45 andintervening malware divides into two independent malware packages, etc.) and the purpose was difficult to identify.
■ Measures against This Particular Type of DDoS Attacks

Here, we will consider the difference between the measures against the damages incurred due to this particular DDoS attack
and those that would normally be taken against a DDoS attack. This attack consisted of the mass operations of numerous PCs
infected with the malware, making it difficult to institute access or bandwidth controls for the individual PC IP addresses fromwhich the attack traffic was generated. However, much of the attack traffic originated from within one country, and performing

access and bandwidth controls on a network basis appeared to be an effective temporary countermeasure. A characteristic of
this incident was the low volume of attack traffic from individual PCs infected with the malware. In particular, the web requests

involved in the attack were disguised to imitate user behavior, making the determination between normal and attack traffic
comparatively difficult. Even if anti-DDoS equipment were available, some adjustments would have been required to establish
the abnormal behavior detection threshold and operating mode configurations.

At IIJ, we believe it is necessary to research measures that would deal with this type of DDoS mechanism if such an attack
were to take place within Japan. Where the malware executed an attack based on a configuration file distributed beforehand,rather than dealing with the attack by taking action against a centrally controlled botnet, the only solution for stopping such an
attack is to eliminate the malware on each individually infected PC. As we saw take place in South Korea, to promptly delete

the malware from so many individual PCs requires the cooperation and coordination of many different organizations. To be able

to accomplish something on this scale, organizations must be vigilant and ready to engage in synergistic action when called
for*46.

Malware Infection DDoS Attack

Prior to July 4
Infection propagatedthrough file-sharing
services in South Korea

U.S. Web Servers Attacked
South Korean Web Servers Attacked

7/4 17:00-7/5 5:00
8 Websites

7/7 9:00-7/8 9:00
13 Websites

7/8 9:00-7/9 9:00
14 Websites

7/9 9:00-7/10 9:00
7 Websites

7/7 12:00-22:0013 Websites

7/5 13:00-22:0021 Websites* These attacks were defined by one configuration file

7/5 13:00-7/6 9:00
21 Websites

SPAM email sent
File destruction
HDD destruction

7/4

7/5

7/6

7/7

7/8

7/9

Number of targets includes those reported in media plus targets confirmed by IIJ

Figure 10: DDoS Attacks against the United States and South Korea: Chronological Order (UTC)

*45

*46

According to the specimen acquired, 13 U.S. websites (from July 7, 2009 18:00 to July 8 18:00) and 13 South Korean websites (from July 7, 2009 21:00 to
July 8 7:00) were attacked under the configuration in the same file. We see that this is the dividing line between where the attacks transitioned to domestic
South Korean servers.

In Japan, cyber security exercises have been conducted such as those sponsored by "Anti-Cyber Attack Exercises in the Telecommunications Business
Sector"(http://www.soumu.go.jp/menu_news/s-news/2006/061201_4.html) (in Japanese) of the Ministry of Internal Affairs and Communications, and thoseby Telecom-ISAC Japan (https://www.telecom-isac.jp/english/index.html). There also have been international exercises including APCERT drills (http://www.
apcert.org/documents/pdf/APCERT-drill-2008.pdf). IIJ actively participates in these exercises.
Vol.5

November 200913

Infrastructure Security■ Summary of the Attack

Infrastructure Security

1.4.2 TCP Vulnerability (Sockstress)

In September 2009, Finnish CSIRT organization CERT-FI published the state of the response to vulnerabilities related to TCP.

*47 This announcement was picked up widely in the press. In this section, we will explain these TCP vulnerabilities and responses.
■ Background

The vulnerabilities themselves were first identified one year prior to the Finnish announcement. Two researchers from asecurity vendor Outpost24 first identified the issue. These researchers developed a tool to speed up network scanning called
Unicornscan*48. During their use of this new tool, they happened to notice unexpected behavior in TCP, and created a tool
called Sockstress*49 to generate traffic that exploited this behavior (this tool has not been publicly released).

Based on the information demonstrating the existence of these vulnerabilities, CERT-FI took the lead in organizing a communitythat encouraged product developers to take appropriate measures. In Japan, this issue is being handled by the Information
Security Early Warning Partnership*50.
■ Details of the Vulnerabilities

The tool for exploiting these vulnerabilities (Sockstress) has not been released to the public, nor have the complete details

about these vulnerabilities been disclosed. Here, we offer a commentary regarding “zero window size,” which has been mostwidely discussed in the public.

An attack using zero window size occurs as follows:
サーバ

1. Establish a TCP connection from a client to a server.

2. During communications, the client specifies zero as its

receive window size to declare “buffer full, cannot receive

Connection

any more data.” In this state, the server will temporarilysuspend data transmission via this TCP connection.

Attacker

The server will continue to query the current client-side①

receive window size in certain intervals, maintaining the＝0Server
SYN

Establish TCP
connection

SYN/ACK
ACK

接続の保持
connection
as long as a response is received.

3. Steps 1 and 2 above from client to server are repeated
データ送信停止②

Window size=0

Set window size to 0

over and over again.

4. Server resources are exhausted, and new TCPWindow size query

connections cannot be accepted.

合わせ

＝0

Connection maintained
Data transmission
suspended

Window size=0

In fact, the time for an attack to become effective depends on③

the server implementation, resources and capacity. It is also

Maintain a high-volume connection

Connection management
information
Connection management
information
Connection management
information

possible that while the load climbs high, an attack doesn’t
become successful.

Attacker

ServerConnection management
information
Connection management
information
Connection management
information

接続管理情報

Maintaining a connection under a zero window size state is
接続管理情報actually a normal operation under TCP standards RFC793*51

Figure 11: S erver-side stack through zero window size
designationsand 接続管理情報
RFC1122*52. Even regular clients using TCP for
接続管理情報

サーバ

*47
*48

接続管理情報Response to TCP vulnerabilities (https://www.cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html) (http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-

接続管理情報2008-4609) (http://www.microsoft.com/technet/security/bulletin/ms09-048.mspx), etc.

*49
*50

Unicornscan (http://www.unicornscan.org/).

While Sockstress itself has not been released publicly, related information has been summarized (http://sockstress.com/).

The Information Security Early Warning Partnership is a framework for vulnerability information dissemination to product developers based on the Ministryof Economy, Trade and Industry directive #235. Under this partnership, the IPA (http://www.ipa.go.jp/security/english/quarterlyrep_vuln.html#Partnership)acts as the vulnerability information reception agent, while the JPCERT Coordination Center (http://www.jpcert.or.jp/english/vh/project.html)serves as thecoordinating agent to product developers. Information about vulnerabilities is published through JVN (http://jvn.jp/en/). IIJ participates in this partnership as a
*51
*52
Vol.5

developer of proprietary router and other products.

RFC793 Transmission Control Protocol (http://www.ietf.org/rfc/rfc793.txt).

RFC1122 Requirements for Internet Hosts - Communication Layers (http://www.ietf.org/rfc/rfc1122.txt).
November 200914

designation of zero window size can be used to mount an attack, presenting a method that forces the server to maintain TCP

connections at volumes exceeding system resources. However, this zero window size attack is not a new method. For example,
the IETF*53 TCPM Working Group*54 broached this subject in July 2006*55, well before the advent of Sockstress.
■ A Protocol Issue or an Implementation Issue?

As shown above, the zero window size designation is a normal state according to protocol specifications. However, a large
volume of TCP connections in this state is seen as an issue. To resolve this issue, arguments call for either making changes to
the TCP protocol itself, or establishing a timeout value or other adjustment in the implementation as a workaround.

Arguments in the earlier-mentioned IETF TCPM Working Group state that this type of attack is an issue of the OS or server
implementation resource management. The consensus is that the solution should be made within implementation inconsideration of individual circumstances, rather than treating this as a protocol issue.
■ Effectiveness of Countermeasures

IIJ picked up the Microsoft patch as one means of dealing with this zero window size issue and performed demonstration testsof an implementation before and after applying the patch. Figure 12 shows the results of this test*56.

As shown in the results of this test, the patched implementation demonstrates a stronger resistance to this type of attack.
However, this countermeasure forces the termination of existing TCP connections to make room in resources to accept newconnections. We have to admit that important connections may also be unavoidably terminated. This countermeasure does

not completely prevent this type of attack. Not only Microsoft, but many of the other entities publishing a patch dealing with thisissue have adopted measures that similarly control the usage of limited resources.

Attack Test Machine

ServerHigh volume of connections maintained

due to malicious use of zero window size

Disabled

ClientTime
Physical Memory Usage for
Non-Paged Memory

Normal Requests

Web Server
Response Rate

* After a certain point, the web server response rate was “0.” When
shut down, the OS encountered an abnormal termination (bluescreen) and experienced other abnormal behavior.

Server OS Environment: Windows Vista + MS09-048 patch

EnabledServer Software: Attack target – program designed for the test
Client Connection – Web Server IIS 7.0

Test:

Execute an attack from the attack test machine to the server for a given period of time.
At the same time, attempt to connect from the client to the server at given intervals,

Time

recording whether or not the server responds.

Physical Memory Usage for
Non-Paged Memory

The Memory Pressure Protection (MPP) function incorporated in the MS09-048 patch
was enabled and disabled, and the results were compared.

Web Server
Response Rate

* The response rate dropped temporarily, but improved with newconnections. The OS exhibited no abnormal behavior. However,existing connections were terminated in order through MPP.

Figure 12: Demonstration Test and Results*53

IETF is the acronym for the Internet Engineering Task Force. An organization that develops the standardization of Internet technologies. (http://www.ietf.org/)*55

Discussion launched on the TCPM WG mailing list (http://www.ietf.org/mail-archive/web/tcpm/current/msg02189.html) and subsequently submitted Internet

*54

*56

TCPM is a short name for TCP Maintenance and Minor Extensions Working Group (http://www.ietf.org/dyn/wg/charter/tcpm-charter.html).
Draft “Clarification of sender behavior in persist condition” (https://datatracker.ietf.org/drafts/draft-ananth-tcpm-persist/), etc.

In fact the Microsoft Web Server, Internet Information Service (IIS) includes functions to adjust web response according to OS load status. Simply performing
the attack in question on the Web Service did not result in abnormal OS behavior. Accordingly, this experiment used this attack to place loads on otherservices.

Vol.5

November 200915

Infrastructure Security

communications can designate zero window size as normal communications control. The issue pointed out here is that theInfrastructure Security

As we have shown, this issue has been treated as an implementation vulnerability. However, because one cannot tell an

attack connection from a normal connection from TCP standards, one has to conclude that this is an issue of system resource

management for systems that receive a large volume of connections. There might be other similar issues that cannot be

fundamentally resolved through implementation modifications*57, and it is likely that more will be uncovered in the future.

Accordingly, servers open to the Internet must be carefully operated continuously.

1.4.3 Randomly Arriving SIP Packets■ Fraudulent SIP Communications

From last year, IIJ has continued to observe SIP (Session Initiation Protocol)*58 packets intermittently arriving at honeypots.

These SIP packets were sent to large numbers of IP addresses across the Internet, attempting to connect to terminals that
could interpret SIP. Depending on the configuration, certain VoIP routers and IP telephones play a ring alert merely at the arrivalof these SIP packets. This was the underlying cause behind the large number silent call reports*59.
■ SIP-Based VoIP Communication Mechanism

As indicated by the name, SIP is one protocol used to control a session, based on a request-and-response model similar to

HTTP. SIP is used in IP phone services and other VoIP communications. However, while the HTTP specification defines datatransmission as well, SIP only controls the initiation, modification, and termination of a session between VoIP terminals, leaving

data transmission to other protocols such as Real-time Transport Protocol (RTP)*60 for audio, etc. Figure 13 shows an exampleof SIP communications via IP telephone.

(1) When a call is initiated via IP telephone, the origin of the call (User Agent:UA) first sends an INVITE message to the call receiver.
(2) When the call receiver gets the INVITE message, a ring tone is sounded to notify the called user. At the same time,“180Ringing” (meaning that a call is in progress) is returned to the originator of the INVITE message.

(3) When the call target picks up the receiver, the receiving terminal sends a 200 OK message to the originator of the call.

(4) Having received this message, the originator of the call sends an ACK response to the call receiver, and the session isestablished.

This is the basic operation. In general, SIP servers are used when connecting, rather than directly connecting the twoterminals*61.

Terminal (User Agent)

Terminal (User Agent)■ Attacks Targeting IP-PBX

To control adoption and maintenance costs, more corporations

SIP

today are replacing existing PBX*62 systems with IP phonesystems using IP-PBX*63. With the availability of low-cost
IP-PBX appliances, it is likely that this trend will continue togather momentum.

Call Request

INVITE sip:

INVITE

foo@****tran

sport=udp SIP/2.0

180 Ringing

Ringing

200 OK

Accepted

ACK

While IP-PBX does present significant adoption benefits

Audio Callin terms of cost savings, different than existing telephone

SIP

Session Established

Audio Data

networks, IP-PBX is connected to a network that features

Aud

other connections with non-VoIP equipment, including the*57

Figure 13: Initiating SIP-Based Audio Communications

For example, a survey report on TCP robustness by CPNI of United Kingdom (https://www.cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf) anda summary survey report of existing TCP/IP vulnerabilities by the IPA (http://www.ipa.go.jp/security/vuln/vuln_TCPIP.html)(in Japanese). These reports
publicized several of these issues, providing developers with commentary on important points related to TCP/IP protocol stack implementations. The latter

*58
*59
*60
*61
*62
*63
Vol.5

report also includes a guide for system operators.

We also addressed random SIP packets in Vol.4 of this report (http://www.iij.ad.jp/en/development/iir/pdf/iir_vol04_EN.pdf).

For example, a cNotes article reported this incident. “INVITE Flood? Fraudulent SIP Calls” (http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi?p=INVITE+Flood%3F++%C9%D4%C0%B5% A4%CASIP%C3%E5%BF%AE)(in Japanese).

Real-time Transport Protocol is a data transfer protocol for transmitting a data stream in real time. Used for audio and video transmission, most VoIP equipment
supports RTP.

An SIP server includes proxy, redirect, and register functions; normally, communications with another party are handled via SIP servers.

A PBX (Private Branch eXchange) is a telephone exchange local to a particular office. It connects internal and external (public switched telephone network)lines and controls incoming and outgoing calls.

A PBX that includes VoIP functions. Asterisk (http://www.asterisk.org/) is one example.
November 200916

and internal attacks than a traditional PBX. Most of today’s VoIP products utilize SIP on UDP; accordingly, SIP packets with false

IP addresses and caller phone numbers can be easily created. In fact, there have been cases overseas of hackers exploiting
vulnerabilities to fraudulently operate an IP-PBX, capturing IP telephone service contract information in an attempt at fraudulent

use*64. Other cases have involved numerous phone calls with false caller numbers, attempting to have the callees call backto premium toll numbers, thus fraudulently building up charges and stealing money*65. The random SIP packets observed by
IIJ were not for the purpose of causing silent calls, but more likely attempts to find IP-PBXs having an exploitable vulnerability.
■ VoIP Security Countermeasures

It is vital to always operate equipment correctly and securely. For example, gain a correct understanding of the types of threats

involved*66, receive periodic updates regarding recommended settings and product information from your VoIP equipmentvendor, confirm important issues related to service usage with your ISP, etc. If possible, configure VoIP equipment withencryption functions, enable settings to only accept SIP packets from certain SIP servers, and incorporate other appropriate
access controls via functions and settings to prevent SIP messages from unknown sources. Adopting VoIP-compatible firewalls,
IDS and IPS, as well as a session border controller*67 is also an effective preventive measure.

We believe that the growth of VoIP will continue, along with increasingly widespread adoption of personal-use IP phones andcorporate IP-PBXs. On a traditional phone, users would hesitate to answer a call coming in from a complete stranger. This samecaution should apply to both traditional and newly emerging threats involved in VoIP communications.

1.5 Conclusion
This whitepaper has provided a summary of security incidents to which IIJ has responded. In this volume, we have included
security incidents in which IIJ was not directly involved, mainly addressing the DDoS attacks in the United States and South

Korea. We believe that our mission encompasses the collection and analysis of information stemming from incidents that occur
in other countries to be better able to rapidly respond should a similar incident occur in Japan in the future.

By identifying and publicizing incidents and associated responses in whitepapers such as this, IIJ will continue to inform thepublic about the dangers of Internet usage, providing the necessary countermeasures to allow the safe and secure use of theInternet.

Authors:
Mamoru Saito
General Manager of the Division of Emergency Response and Clearinghouse for Security Information, IIJ Service Business Department- After working insecurity services development for enterprise customers, Mr. Saito became the representative of the IIJ Group emergency response team, IIJ-SECT in 2001,
participating in FIRST, an international group of CSIRTs. Mr. Saito serves as a steering committee member of several industry groups, including TelecomISAC Japan, Nippon CSIRT Association, Information Security Operation provider Group Japan, and others. In recognition of its close activities with both
domestic and international organizations, the IIJ-SECT was awarded the “commendation from Director-General, Commerce and Information Policy Bureau,
Ministry of Economy, Trade and Industry (CATEGORY - Promotion of Information Security)” at the FY 2009 Informatization Month Opening Ceremony.
Hirohide Tsuchiya (1.2 Incident Summary)
Hirohide Tsuchiya, Hiroshi Suzuki (1.3 Incident Survey)
Hiroshi Suzuki (1.4.1 DDoS Attacks in the United States and South Korea)
Tadaaki Nagao, Yuji Suga (1.4.2 TCP Vulnerability (Sockstress))
Hirohide Tsuchiya (1.4.3 Randomly Arriving SIP Packets)
Division of Emergency Response and Clearinghouse for Security Information, IIJ Service Business Department
Contributors:
Shigeki Ohara System Development Section, System Infrastructure Division, IIJ Service Business Department
Masahiko Kato, Masafumi Negishi Division of Emergency Response and Clearinghouse for Security Information, IIJ Service Business Department*64

For example, an alert issued by the Internet Crime Complaint Center (IC3: an organization involved in combating cyber crime) in cooperation with U.S. law-

*65

The F-Secure blog post “Beware of One-Ring Fraud,” (http://www.f-secure.com/weblog/archives/00001744.html) for example.

*66
*67

Vol.5

enforcement agencies (FBI, etc.) (http://www.ic3.gov/media/2008/081205-2.aspx).

See the following report as one source of information regarding known vulnerabilities and threats. “Survey Report regarding Known SIP Vulnerabilities Version
2.0” by the IPA. (http://www.ipa.go.jp/security/vuln/vuln_SIP.html)(in Japanese).

A device installed at the boundary of the VoIP network. Responsible for controlling necessary ports according to SIP packet content, and for controlling
functions allowing for normal VoIP communications, even in an NAT environment.
November 200917

Infrastructure Security

Internet, and closed IP networks. Because of this, one must consider the fact that the IP-PBX is more susceptible to external