Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

blog.cloudflare.com

Post reply on HN
Print view View original

41–50 of 112 posts

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#41

Post by sebcat »

upofadown wrote: post #21

>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.

You don't have to have a router. The apartment building where I live have fiber, with twisted pair to each apartment. DHCP leases from the apartment gives you an external IP. It's possible to hook up a switch and get DHCP leases for multiple devices. I assume there's an upper limit, I've only tried it with two devices.

Now, let's say I hook up a printer to a switch in that configuration. Is it smart enough to not respond to UPnP coming from globally routable addresses?

This is why ingress filtering is important.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#42

Post by laumars »

upofadown wrote: post #21

>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.

The same way people run p2p clients like BitTorrent from home, or the nerdier people run home servers with SSH, RDP or HTTP(S) exposed: they just use the port forwarding features available on every single consumer router. Sometimes software / hardware will automatically assign a port forward via uPnP[0] (this is what many P2P clients will do), sometimes it's done manually[1][2][3][4]. The only difference here is the datagram, but routers have adaptive stateful firewalls (else services like FTP would fail despite being TCP) so they can handle the stateless nature of UDP just fine.

[0] https://img.raymond.cc/blog/wp-content/uploads/2014/08/utorr...

[1] https://bt.i.lithium.com/t5/image/serverpage/image-id/27802i...

[2] https://assets.virginmedia.com/help/assets/images/Port-Forwa...

[3] https://i.ytimg.com/vi/VvzFHHDvU8E/maxresdefault.jpg

[4] https://advancedhomeserver.files.wordpress.com/2013/11/pf01a...

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#43

Post by laumars »

dom0 wrote: post #28
upofadown wrote: post #21

>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

While your point is true in the broader sense, it is worth noting that these were IPv4 addresses.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#44

Post by [deleted] »

dom0 wrote: post #28
upofadown wrote: post #21

>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

[deleted]

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#45

Post by jwilk »

dsl wrote: post #15

It is unfortunate that CloudFlare shared enough PoC code to weaponize this. Edit: for the downvoters, this isn't just my opinion, please read https://en.wikipedia.org/wiki/Responsible_disclosure

From the HN guidelines:

Please resist commenting about being downvoted. It never does any good, and it makes boring reading.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#47

Post by croon »

oh_sigh wrote: post #35
dom0 wrote: post #28

Earlier quoted context omitted.

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

Of course you can NAT with ipv6. There is a private address space in ipv6(fc00::/7) like there is in ipv4(192.168.0.0/16,...)

I don't think the issue was if you can, but if anyone would when they don't have to for lack of address space.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#48

Post by halloij »

NKCSS wrote: post #23
bsder wrote: post #10

Why is IP spoofing STILL an issue? Why?

Because UDP is fire and forget, you don't have to be able to respond to packets you send; this is why you can't do the same with TCP packages. To impose fixes upstream, you'd have to do DPI on all data; which is not allowed under some laws (i.e. net neutrality).

Why would your ISP allow you to send packets with a source address it hasn't allocated to YOU? That kind of check/enforcement is pretty cheap and simple.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#49

Post by saurik »

> Internet service providers should never allow IP spoofing to be performed on their network. IP spoofing is the true root cause of the issue. See the infamous BCP38.

I don't see how it is at all reasonable to shift blame from a protocol that assumes the world can be trusted to the untraceable goal of "every single network in the entire world should only generate trusted data: then the problem would be solved".

> Internet providers should internally collect netflow protocol samples. The netflow is needed to identify the true source of the attack. With netflow it's trivial to answer questions like: "Which of my customers sent 6.4Mpps of traffic to port 1900?". Due to privacy concerns we recommend collecting netflow samples with largest possible sampling value: 1 in 64k packets. This will be sufficient to track DDoS attacks while preserving decent privacy of single customer connections.

OMFG. Do you want deanonymization attacks? Because this is how you get deanonymization attacks :/. The right form of solution here is not to encourage ISPs to log even more of our traffic (a practice I wish were illegal), but to try to kill off UPNP through every form of leverage possible (even if it breaks things).

I'd say this is "so disappointing", but I guess I shouldn't expect much from the company that tried its damndest to argue that nothing of importance was leaked from Cloudbleed even when you could still recover Grindr requests complete with IP addresses that they had managed to leak well after they tried to claim that data had been scrubbed :/.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#50

Post by hueving »

saurik wrote: post #49

> Internet service providers should never allow IP spoofing to be performed on their network. IP spoofing is the true root cause of the issue. See the infamous BCP38. I don't see how it is at all reasonable to shift blame from a protocol that assumes the world can be trusted to the untraceable goal of "every single network in the entire world should only generate trusted data: then the problem would be solved". > Int…

IP spoofing is the problem. Even if you completely ban UDP protocols, it still allows for anonymous unamplified attacks.

Attacking every single protocol that dares to respond to a query is a pretty stupid approach IMO. Look how well it's worked so far.

Additionally, unless we switch DNS to TCP only, root and authoritative name servers are always going to provide and amplification factor and there are still more than enough of them for devastating attacks.

Agree with you about monitoring, but that wouldn't be necessary if we got serious about enforcing and blacklisting ISPs that drop the ball on BCP 38.

Post reply on HN