Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
blog.cloudflare.com
Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
1–10 of 112 posts
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#2Pervasive IoT device deployment without in-the-wild security considerations and rapid updates is likely to add to DDoS bot farms.
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#3It will be years and years until those vulnerable miniupnpd versions are updated. Most are in embedded devices which will never see another update.
I'm glad to see miniupnp is still in active development: https://github.com/miniupnp/miniupnp but I can't work out if it's set to be vulnerable by default.
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#4It will be years and years until those vulnerable miniupnpd versions are updated. Most are in embedded devices which will never see another update. I'm glad to see miniupnp is still in active development: https://github.com/miniupnp/miniupnp but I can't work out if it's set to be vulnerable by default.
Vulnerable by default?
If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#5It will be years and years until those vulnerable miniupnpd versions are updated. Most are in embedded devices which will never see another update. I'm glad to see miniupnp is still in active development: https://github.com/miniupnp/miniupnp but I can't work out if it's set to be vulnerable by default.
Vulnerable by default? If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
One of the documented use cases for UPnP is IGD which expressly allows UPnP devices to configure fire wall rules and to set up NAT to map ports to the outside world. So a UPnP device that wishes to expose itself to the outside world is able to do so and this is by design, not by accident. Whether you agree with that or not is another matter.
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#6Pervasive IoT device deployment without in-the-wild security considerations and rapid updates is likely to add to DDoS bot farms.
You're a little late - the Mirai botnet (Larget botnet at the time it became widely known) is exactly that.
https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#7Earlier quoted context omitted.
Vulnerable by default? If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
One of the documented use cases for UPnP is IGD which expressly allows UPnP devices to configure fire wall rules and to set up NAT to map ports to the outside world. So a UPnP device that wishes to expose itself to the outside world is able to do so and this is by design, not by accident. Whether you agree with that or not is another matter.
That doesn't mean the upnp listener needs to listen on the WAN interface.
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#8Pervasive IoT device deployment without in-the-wild security considerations and rapid updates is likely to add to DDoS bot farms.
You're a little late - the Mirai botnet (Larget botnet at the time it became widely known) is exactly that. https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...
That story - Wow! Did anything ever happen to the author?
Previous discussions:
https://news.ycombinator.com/item?id=13435742
https://news.ycombinator.com/item?id=13428824
Supposed Reddit comment from the author: https://www.reddit.com/r/AskReddit/comments/5nqq3c/serious_p...
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#9It will be years and years until those vulnerable miniupnpd versions are updated. Most are in embedded devices which will never see another update. I'm glad to see miniupnp is still in active development: https://github.com/miniupnp/miniupnp but I can't work out if it's set to be vulnerable by default.
Vulnerable by default? If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
What about not replying to unicast responses? Or rate limiting by default?
Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
#10Why is IP spoofing STILL an issue? Why?