Hackers are starting to use TCP Middlebox Reflection as a weapon in DDoS attacks.

"The attack takes advantage of misconfigured firewalls and content filtering systems to reflect and magnify TCP traffic to a target PC, resulting in a massive DDoS assault," Akamai researchers said in a paper released on Tuesday. In these attacks, the adversary sends a flood of DNS or NTP requests to the targeted asset with a forged source IP address, leading the destination server to transport the replies back to the faked host in an amplified manner, exhausting the bandwidth allocated to the target. "The most important message is that the new vector is beginning to see real-world exploitation," Seaman added. "Typically, when awareness and popularity of a given vector develops across the DDoS landscape and more attackers begin to construct technology to utilize the new vector, more widespread misuse of that vector is likely to follow."Read More