Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

blog.cloudflare.com

Post reply on HN
Print view View original

81–90 of 112 posts

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#81

Post by lightedman »

hueving wrote: post #52

More casualties from BCP 38 failures. This article mentions it but then dilutes the importance of it by suggesting SSDP is a problem. If IP spoofing did not work on the Internet, none of these UDP reflection attacks would work. A scheme to strong arm the adoption of BCP 38 is key to stopping these attacks from growing. IoT has shown us that expecting device updates to disable these UDP protocols is a lost battle.

"A scheme to strong arm the adoption of BCP 38 is key to stopping these attacks from growing. IoT has shown us that expecting device updates to disable these UDP protocols is a lost battle."

Easily done: "Follow some standards and RFCs or get put on a global blacklist of companies to not do business with."

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#83

Post by xxdesmus »

dsl wrote: post #15

It is unfortunate that CloudFlare shared enough PoC code to weaponize this. Edit: for the downvoters, this isn't just my opinion, please read https://en.wikipedia.org/wiki/Responsible_disclosure

You’re being down-voted because this is already well known, and has been used for years.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#84

Post by krallja »

samstave wrote: post #34
hellbanner wrote: post #6

Earlier quoted context omitted.

You're a little late - the Mirai botnet (Larget botnet at the time it became widely known) is exactly that. https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...

Ive always wondered if "anna senpai" is a play on "ono sendai" -- the infamous Cyberpunk EvilCorp deck... I personally feel that it is. (maybe tis was already obvious to others - I just havent talked about it out oud to anyone prior...)

I think the pseudonym "Anna senpai" is in reference to the Japanese media trope of schoolchildren falling in love with their senpai.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#85

Post by DSMan195276 »

dicknuckle wrote: post #79
DSMan195276 wrote: post #67

Earlier quoted context omitted.

You're half right. In most cases, programs have the OS pick their source port, but that's for the computer initiating the communication. So for example, in the communication he gave the 50950 was likely picked by the OS (by selecting a currently open port) and 1900 is the destination port. When the remote computer responds (his printer), they don't then pick a new random source port, they just swap the source/dest fr…

When the OS picks a random port, it's from a pool of Ephemeral ports. Which can vary from OS to OS. My assumption is that printer responding with a different source port breaks the communication over NAT. Is it a possibility that this is intended?

Well I mean, you're correct it would break the communication over NAT, but it breaks the communication over the local network at well. You might still receive that packet to your NIC, but unless you know beforehand it will send using that source port and thus tell the OS (by setting up a socket or etc. to collect that packet) then the packet will never be routed to your application. So I don't really feel like this could be intended because it just makes stuff not work.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#86

Post by samstave »

krallja wrote: post #84
samstave wrote: post #34

Earlier quoted context omitted.

Ive always wondered if "anna senpai" is a play on "ono sendai" -- the infamous Cyberpunk EvilCorp deck... I personally feel that it is. (maybe tis was already obvious to others - I just havent talked about it out oud to anyone prior...)

I think the pseudonym "Anna senpai" is in reference to the Japanese media trope of schoolchildren falling in love with their senpai.

Wipes hands with oily rag, looking at motor...>

Well,now... there's my problem right there... Jus' don' know much 'bout them japanese now doncha.

rocks back and forth with thumbs on the straps of my filthy coveralls, spits...>

Yep yep yep is what I always say...

heads back into dilapidated datacenter behind squeaky screen door only holding on by one hinge>

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#87

Post by dicknuckle »

gbrown_ wrote: post #59

More on the SSDP servers Since we probed the vulnerable SSDP servers, here are the most common Server header values we received: 104833 Linux/2.4.22-1.2115.nptl UPnP/1.0 miniupnpd/1.0 77329 System/1.0 UPnP/1.0 IGD/1.0 66639 TBS/R2 UPnP/1.0 MiniUPnPd/1.2 12863 Ubuntu/7.10 UPnP/1.0 miniupnpd/1.0 11544 ASUSTeK UPnP/1.0 MiniUPnPd/1.4 What an earth is internet facing and running 2.4 Linux kernels?

DD-WRT installed by wannabe linux nerds and forgotten about. "Yea I installed DD-WRT 6 years ago because it's better" Nevermind the vulnerabilities that are patched over the years.

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#88

Post by ryanlol »

falsedan wrote: post #61
gbrown_ wrote: post #59

More on the SSDP servers Since we probed the vulnerable SSDP servers, here are the most common Server header values we received: 104833 Linux/2.4.22-1.2115.nptl UPnP/1.0 miniupnpd/1.0 77329 System/1.0 UPnP/1.0 IGD/1.0 66639 TBS/R2 UPnP/1.0 MiniUPnPd/1.2 12863 Ubuntu/7.10 UPnP/1.0 miniupnpd/1.0 11544 ASUSTeK UPnP/1.0 MiniUPnPd/1.4 What an earth is internet facing and running 2.4 Linux kernels?

CEP (home routers)

CPE surely?

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#89

Post by zAy0LfpBZLC8mAC »

rsync wrote: post #75
zAy0LfpBZLC8mAC wrote: post #66

Earlier quoted context omitted.

> Now, let's say I hook up a printer to a switch in that configuration. Is it smart enough to not respond to UPnP coming from globally routable addresses? WTF? How would it not be utterly idiotic to not respond to UPnP requests from globally routable addresses? Why should it be impossible to print from some machine, just because it has a globally routable address?

"Why should it be impossible to print from some machine, just because it has a globally routable address?" Because it's an Internet . Sure, it's uncommon behavior and not what most people want, but let's not completely give up on the notion of being a peer on the network . The printer serves up (printing) just like a web server serves up web pages. You should be able to run a web server and participate as a peer, glo…

Well, your argument makes perfect sense ... just not as a reply to my rhetorical question ;-)

Re: Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS

#90

Post by dingo_bat »

DSMan195276 wrote: post #85
dicknuckle wrote: post #79

Earlier quoted context omitted.

When the OS picks a random port, it's from a pool of Ephemeral ports. Which can vary from OS to OS. My assumption is that printer responding with a different source port breaks the communication over NAT. Is it a possibility that this is intended?

Well I mean, you're correct it would break the communication over NAT, but it breaks the communication over the local network at well. You might still receive that packet to your NIC, but unless you know beforehand it will send using that source port and thus tell the OS (by setting up a socket or etc. to collect that packet) then the packet will never be routed to your application. So I don't really feel like this c…

> So I don't really feel like this could be intended because it just makes stuff not work.

Sounds exactly like UPnP to me!

Post reply on HN