Protocol found in webcams and DVRs is fueling a new round of big DDoSes

'Hackers have found a new way to amplify the crippling effects of denial-of-service techniques by abusing an improperly implemented tool found in almost 1 million network-connected cameras, DVRs, and other Internet-of-things devices. The technique abuses WS-Discovery, a protocol that a wide array of network devices use to automatically connect to one another. Often abbreviated as WSD, the protocol lets devices send user datagram protocol packets that describe the device capabilities and requirements over port 3702. Devices that receive the probes can respond with replies that can be tens to hundreds of times bigger. WSD has shipped with Windows since Vista and is one of the ways the operating system automatically finds network-based printers.' -- source: https://arstechnica.com/information-technology/2019/09/in-the-wild-ddoses-ar... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 http://www.cms.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/

On Thu, 19 Sep 2019 11:34:19 +1200, Peter Reutemann wrote:
'... the protocol lets devices send user datagram protocol packets that describe the device capabilities and requirements over port 3702. Devices that receive the probes can respond with replies that can be tens to hundreds of times bigger.'
General pitfall with UDP, that a packet can claim to come from any source address, and so the reply can be directed anywhere. Such protocols need to be carefully constrained. I think in this case they should only be responding to requests coming from the LAN, not from anywhere on the entire Internet.
participants (2)
-
Lawrence D'Oliveiro
-
Peter Reutemann