Researchers at Akamai have observed a new distributed denial-of-service (DDoS) attack amplification technique called “TCP Middlebox Reflection” being leveraged in the wild. According to Akamai’s report, this attack vector “abuses vulnerable firewalls and content filtering systems to reflect and amplify TCP traffic to a victim machine, creating a powerful DDoS attack” via middleboxes employed in deep packet inspection (DPI) systems. A middle box is a device that “performs packet inspection or content filtering by monitoring, filtering, transforming packet streams exchanged between two internet devices”. This attack vector is also considered powerful due to the amount of bandwidth it requires, “as the attacker needs as little as 1/75th (in some cases) that amount of bandwidth from a volumetric standpoint”. Researchers have observed various middlebox attack campaigns targeting multiple sectors, including webhosting, banking, media, travel, and gaming, and are likely going to rise in popularity. CTIX analysts are continuing to monitor this up-and-coming DDoS attack technique and note campaigns utilizing it in the future. For a deeper dive into the TCP Middlebox Reflection technique, please view Akamai’s Report linked below.