SYN-ACK Reflection Attacks: When Traffic Looks Legitimate and Is Still an Attack
SYN-ACK Reflection Attacks: When Traffic Looks Legitimate and Is Still an Attack
In recent months, more and more Polish ISPs have been facing the same situation: a phone call or e-mail threatening a DDoS attack if the company does not pay a ransom. What distinguishes this wave from classic extortion is the type of attack being threatened, and which actually follows when the operator does not give in to the pressure. It is SYN-ACK reflection, an attack that is difficult to stop with standard filtering methods.
How this attack works
The mechanism relies on infrastructure that does not verify the source addresses of outgoing traffic (no BCP38 implemented on the attacker's side, or at the operator where the attacker has a server).
The attacker sends SYN packets en masse to legitimate, public servers, such as popular portals, cloud services or any hosts responding to TCP connections, replacing the source address with the victim's IP address. The servers that received these packets respond according to the TCP specification with a SYN-ACK packet. Because the source address was spoofed, the responses go not to the attacker but directly to the victim.
The result: the victim is flooded with thousands of SYN-ACK packets per second coming from IP addresses that are themselves entirely legitimate and well known. No IP reputation database will flag them as a threat.
SYN-ACK attack
Why classic anti-DDoS mechanisms fail here
The standard approach to mitigating volumetric attacks rests on two mechanisms: FlowSpec, that is, precise filtering rules generated from traffic characteristics (port, protocol, packet length), and RTBH (Remotely Triggered Black Hole), that is, blocking all traffic to the attacked IP address.
Both mechanisms work very well for typical attacks: UDP flood, amplification, IP fragmentation. The problem arises when attack traffic does not differ structurally from legitimate traffic. Stateless systems, including solutions based solely on NetFlow/sFlow sampling, analyze a packet in isolation from the connection context. A single SYN-ACK packet from the address of a known, public server does not look suspicious, until you check whether it was actually preceded by a SYN request sent earlier from the operator's network.
This requires stateful inspection: tracking SYN/SYN-ACK pairs in real time, and not just classifying individual packets based on headers. Most anti-DDoS systems currently available on the market, especially those based on traffic sampling and static rules, do not have such a layer. That explains why attacks of this type are increasingly chosen as an extortion tool. Attackers know that the operator's standard protection will not cope with it.
The scale of the problem is growing
SYN-ACK reflection attacks are not new in theory: they have been described for years as one of the variants of reflection/amplification. What is new is the scale and systematic nature with which they are being used against Polish telecommunications operators in ransom attempts. This shifts the burden of responsibility onto the providers of protection systems: the classic FlowSpec plus RTBH pair is no longer enough as a complete answer to the real threats the Polish ISP market faces today.
SYN-ACK support
Our approach
At LiveShield we track cases of this kind on an ongoing basis, because we work directly with operators who have encountered them, not as an abstract scenario from an industry report, but as a real incident at a specific customer. We are a team operating in Poland, so when a new attack pattern appears aimed specifically at Polish operators, we have direct contact with the reports and can react faster than providers of large, global anti-DDoS platforms, for whom the local specifics of this market segment are less important.
We are developing our detection and mitigation mechanisms toward covering precisely such cases: attacks that the classic FlowSpec/RTBH pair has difficulty recognizing because the traffic comes from legitimate sources. This is a natural direction of development for the system, resulting directly from what our customers are dealing with.
If your company has encountered an extortion attempt based on the threat of a DDoS attack, or you are already dealing with such an attack, we invite you to get in touch. We will gladly discuss the available support options: office@liveshield.net
