What is a Teardrop Attack? Protection and Preventive Measures

The Teardrop Attack belongs to the family of DoS (Denial of service) attacks and aims at causing a system crash by putting excess load.

TCP/IP fragmentation codes are the main targets of a Teardrop Attack. Its working methodology involves overlapping the fragmented packets of the host machine. The host machine does try to reconstruct the packets in a proper order but usually fails to cause a permanent system crash. In addition to this massive payload is sent to the host device making its condition even worse.

Targeted Device

The Teardrop attack mainly targets old age computer systems but is also capable of harming SMB enabled Windows 7 and Vista versions. The loopholes were first identified way back in 2009.

On the other hand, Windows 2000 and XP have not shown any signs of vulnerability. It mainly consists of SMB enabled machines powered with TCP ports 139 and 445 on the firewall.

Security experts recommend that users should guard their devices against DoS attacks by patching all the security voids. If not the 139 and 445 ports should be disabled to strengthen the security walls of your device.

The Working Methodology of TearDrop Attack

Here is how the Teardrop attacks work

A large amount of data is broken into smaller pieces before it is sent across the internet.
A specific number is assigned to each fragment and on reaching the receiving end the fragments are rearranged to reconstruct the original message.
The target machine uses the information packed in the fragments offset fields to rearrange them in a required sequence.
Here the Teardrop attacks intervene and disrupt the fragments offset field making it hard for the machine to reassemble the fragments.
A huge number of buggy packets gets accumulated on the victim’s device causing the machine to crash.

Thankfully, the current device networks are highly advanced and can easily detect damaged fragmented packets. Once a discrepant packet is identified it can easily be excluded to prevent the Teardrop Attack.

Preventing the Teardrop Attack

Here are a few simple methods that will help you prevent being a victim of a Teardrop attack.

Cache plays a great role in preventing Teardrop Attack, it provides status content that is required for the normal running of a device and thus helps in mitigating the risks attached to the attack.
An efficient firewall network can also serve as a great protection method. It filters junk and infected data and keeps it away from your network spectrum.
In addition to this, you can also use a secure proxy to inspect the incoming packets. This will avoid any bug-laden data from entering your device.

Adrian