Smurf is a simple attack based on IP spoofing and broadcasts. A single packet (such as an ICMP Echo Request) is sent as a directed broadcast to a subnet on the Internet. All the machines on that subnet respond to this broadcast. By spoofing the source IP address of the packet, all the responses will get sent to the spoofed IP address. Thus, a hacker can often flood a victim with hundreds of responses for every request the hacker sends out.
Who are the primary victims of these attacks on the Internet today?
A.
SPAM filters are the primary victim to smurf attacks
B.
Mail servers are the primary victim to smurf attacks
C.
IDS devices are the primary victim to smurf attacks
D.
IRC servers are the primary victim to smurf attacks
Explanation:
IRC servers are the primary victim to smurf attacks. Script-kiddies run programs that scan the Internet looking for “amplifiers” (i.e. subnets that will respond). They compile lists of these amplifiers and exchange them with their friends. Thus, when a victim is flooded with responses, they will appear to come from all over the Internet. On IRCs, hackers will use bots (automated programs) that connect to IRC servers and collect IP addresses. The bots then send the forged packets to the amplifiers to inundate the victim.