InfoSec Write-ups – Medium–
One of the key principles of the CIA triad model ( a theoretical model that describes , 3 key components that must be kept to keep your system secure ) is Availability , that is keeping your systems up .
The other 2 principals are confidentiality ( the need to encrypt our data ) and integrity (making sure that the data is not tempered, using hash functions and so on )
So I decided to put my streamer https://amzn.to/33pTEln to test and start a denial of service attack against it , using ICMP Flood . (this is for educational purposes only , as it is illegal . i have done it on my LAN devices only )
Terminology
ICMP flood is a common DoS attack in which an attacker takes down a victim’s computer by overwhelming it with ICMP echo requests, also known as pings. The icmp packet is nothing more than a small packet sent through the network to a particular IP address. This packet contains 64 bytes — 56 data bytes and 8 bytes of protocol header information.
Every operating system supports icmp echo requests and listens to the icmp echo reply, in that way , you can measure the round trip time that it takes for the icmp reply to get back . we use ping all the time to check for stability and connectivity issues
In unix and the more up to date operating systems as MAC-OS , we have the option to send ping requests , with lots of options as the count size , the number of echo requests to send , the packet size in bytes ( you can actually send a bigger icmp then the default 56 bytes, known also as ping of death ) and finally you can send a flood of packets which results in hundreds and thousands of icmp packet sent in 1 second instead of the more traditional 5 packets a second
So lets use the flood option on my Mac ( using the -f option on the terminal ) which actually meant , i was doing a denial of service attack against my android TV streamer .
The amount of packers is meant to overwhelm the streamer and consume lots of it’s CPU and Memory resources along with some network congestion .
i could have used Hping ( one of my favourite linux tools ) and other more oriented tools for this purpose, on my ubuntu linux VM’s , but i decided to stick with a more common and traditional tool that every Mac user has
To do so , I needed 2 things:
- The ip address of my streamer
- And Root privileges
So i have used the the sudo command followed by my password
My streamer ip address was 10.0.3.147 and for those who aren’t familiar with this streamer , it is one of the most popular android TV streamers in the recent years . inside you will find A Cortex-A53 quad-core 64-bit CPU and a Mali-450 GPU , it also comes with a RAM size of 2 GB and storage of 8 GB eMMC. I have had 6 months experience with it and it works as expected , supports 4k , fast , intuitive and really cheap
Wireshark View
I have also used wireshark to capture the traffic sent using my terminal
The streamer does some UPNP requests using SSDP protocol, connected to some multicast groups as expected , and then i started the flood
I wanted to check 2 things
CPU usage — couldn’t really find an app that will show me the CPU load on , it seems that apps running on android 8.1 has some issues showing that information
User experience — will i feel that navigating and opening apps becomes slow ?
Well, at first , nothing was noticed, but then 3 minutes later , I started to feel that navigating between the different apps on the home screen was becoming slower , I tried to open youtube, took about a minute to load ( thumbnails ). The downgrade was felt mostly on apps that needed to open and load resources from the external servers
Conclusions
Don’t try it at home, even if your kid plays Fortnite and consumes all the bandwidth in your home
Memory and cpu resources as expected running fast after some time , but still the streamer proved to be running decent hardware
3rd party apps , that were opened with no cached content , seemed to have the most difficulty
- disclaimer : please do not use it against any of the devices in your surroundings, it is illegal and the purpose was educational only
Some may call it a DOS attack, i just tried to find how my streamer behaves under stress was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Hacker's Directory 