Notes and Receipts (PCAPs) for TCP and ICMP Noise Storms
The GitHub repository "2024-09-noise-storms" includes notes and PCAP files on TCP and ICMP Noise Storms, characterized by spoofed packets, geopolitical links, and various theories on their motivations.
Read original article
The GitHub repository named "2024-09-noise-storms" contains notes and packet capture (PCAP) files related to TCP and ICMP Noise Storms, phenomena first observed in January 2020. These events are characterized by large-scale spoofed packet transmissions, primarily from Brazil, involving millions of spoofed IP addresses. The traffic consists mainly of TCP packets on port 443 and ICMP packets, with recent ICMP packets notably containing the ASCII string "LOVE." The time-to-live (TTL) values for these packets are spoofed between 120 and 200. Noise Storms have evolved to target smaller segments of the internet with increasing intensity and are often linked to significant geopolitical events. The TCP traffic appears to mimic various operating systems, successfully avoiding detection by AWS while impacting other service providers. Theories regarding the motivations behind these storms include covert communications, DDoS attacks, misconfigured routers, or attempts to manipulate network congestion. For further insights, the repository is associated with a specific episode of Storm⚡️Watch that discusses these phenomena in detail.
- The repository contains samples of TCP and ICMP Noise Storms.
- Noise Storms are linked to geopolitical events and involve spoofed packets.
- TCP traffic primarily targets port 443, while ICMP packets include a specific ASCII string.
- The phenomenon has evolved to affect smaller internet segments with increased intensity.
- Various theories exist regarding the motivations behind these noise storms.
Related
The Rise of Packet Rate Attacks: When Core Routers Turn Evil
Packet rate attacks, a new trend in DDoS attacks, overload networking devices near the target. OVHcloud faced attacks exceeding 100 Mpps, some from MikroTik Routers, prompting enhanced protection measures.
Threat Actor Abuses Cloudflare Tunnels to Deliver Rats
Proofpoint reported increased cybercriminal activity using Cloudflare Tunnels to deliver malware, particularly remote access trojans. Campaigns involve phishing emails and exploit temporary tunnels, necessitating adaptive cybersecurity defenses.
Hackers breach ISP to poison software updates with malware
A Chinese hacking group, StormBamboo, breached an ISP to inject malware into software updates, exploiting insecure mechanisms. They redirected requests to install malware on victims' devices, including a malicious Chrome extension.
Bringing insights into TCP resets and timeouts to Cloudflare Radar
Cloudflare launched a dashboard and API for real-time insights into TCP connection resets and timeouts, revealing that 20% of connections face issues, potentially indicating malicious activity or network errors.
Mysterious "LOVE" packet storms flood the internet since 2020
GreyNoise has been monitoring "Noise Storms" since January 2020, characterized by spoofed traffic and a "LOVE" ASCII string, targeting specific ISPs and emphasizing the need for advanced cybersecurity strategies.
3 commentsRelated
The Rise of Packet Rate Attacks: When Core Routers Turn Evil
Packet rate attacks, a new trend in DDoS attacks, overload networking devices near the target. OVHcloud faced attacks exceeding 100 Mpps, some from MikroTik Routers, prompting enhanced protection measures.
Threat Actor Abuses Cloudflare Tunnels to Deliver Rats
Proofpoint reported increased cybercriminal activity using Cloudflare Tunnels to deliver malware, particularly remote access trojans. Campaigns involve phishing emails and exploit temporary tunnels, necessitating adaptive cybersecurity defenses.
Hackers breach ISP to poison software updates with malware
A Chinese hacking group, StormBamboo, breached an ISP to inject malware into software updates, exploiting insecure mechanisms. They redirected requests to install malware on victims' devices, including a malicious Chrome extension.
Bringing insights into TCP resets and timeouts to Cloudflare Radar
Cloudflare launched a dashboard and API for real-time insights into TCP connection resets and timeouts, revealing that 20% of connections face issues, potentially indicating malicious activity or network errors.
Mysterious "LOVE" packet storms flood the internet since 2020
GreyNoise has been monitoring "Noise Storms" since January 2020, characterized by spoofed traffic and a "LOVE" ASCII string, targeting specific ISPs and emphasizing the need for advanced cybersecurity strategies.