12 ms·
Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
- IE6 9y agoSo only slightly faster than GNU yes
- everdayimhustln 9y agoPervasive IoT device deployment without in-the-wild security considerations and rapid updates is likely to add to DDoS bot farms.
- hellbanner 9y agoYou're a little late - the Mirai botnet (Larget botnet at the time it became widely known) is exactly that. https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/#more-37412 https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-m...
- sillysaurus3 9y agoThat story - Wow! Did anything ever happen to the author? Previous discussions: https://news.ycombinator.com/item?id=13435742 https://news.ycombinator.com/item?id=13435742 https://news.ycombinator.com/item?id=13428824 https://news.ycombinator.com/item?id=13428824 Supposed Reddit comment from the author: https://www.reddit.com/r/AskReddit/comments/5nqq3c/serious_people_whove_written_malicious_code/dce7rh9/ https://www.reddit.com/r/AskReddit/comments/5nqq3c/serious_p...
- hellbanner 9y agoTheir last post is Jul 17, but there's signature and even if there was, how would we ever know.
- samstave 9y agoIve always wondered if "anna senpai" is a play on "ono sendai" -- the infamous Cyberpunk EvilCorp deck... I personally feel that it is. (maybe tis was already obvious to others - I just havent talked about it out oud to anyone prior...)
- krallja 9y agoI think the pseudonym "Anna senpai" is in reference to the Japanese media trope of schoolchildren falling in love with their senpai.
- samstave 9y ago<Wipes hands with oily rag, looking at motor...> Well,now... there's my problem right there... Jus' don' know much 'bout them japanese now doncha. <rocks back and forth with thumbs on the straps of my filthy coveralls, spits...> Yep yep yep is what I always say... <heads back into dilapidated datacenter behind squeaky screen door only holding on by one hinge>
- hellbanner 9y agoThey said in an interview -- it's a .txt file linked somewhere on the krebs site, that AS is a villian in an anime
- jMyles 9y agoSo? Every single thread of this nature has a similar comment, and I really want to know (ie, I want to hear this fully fleshed out because I think your concerns are valid and worth exploring): is this demonstrative of a new (or in some way more valid) notion of the word "hacker" in "hacker news?" My sense of that word, and of the culture that underlying it, is that a critical part of its critique is that obscurity, specifically in its implications for security (and thus, perhaps civility and peace and justice), is subject to deprecation in the information age, precisely in favor of styles of disclosure like this: where the pudding for the tasting is provided as the proof. Have I missed something very important?
- minitech 9y agoWhat? If there’s a question there, could you ask it in a straightforward manner, please?
- jMyles 9y agoOK, I'll try. :-) Are there good reasons to believe that obscurity (ie, keeping secret the means and methods of attack) is likely to be a viable defense in favor of civility and justice in the age to come?
- voltagex_ 9y agoIt will be years and years until those vulnerable miniupnpd versions are updated. Most are in embedded devices which will never see another update. I'm glad to see miniupnp is still in active development: https://github.com/miniupnp/miniupnp https://github.com/miniupnp/miniupnp but I can't work out if it's set to be vulnerable by default.
- Kikawala 9y agoVulnerable by default? If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
- jacquesm 9y agoOne of the documented use cases for UPnP is IGD which expressly allows UPnP devices to configure fire wall rules and to set up NAT to map ports to the outside world. So a UPnP device that wishes to expose itself to the outside world is able to do so and this is by design, not by accident. Whether you agree with that or not is another matter.
- MichaelGG 9y agoThat doesn't mean the upnp listener needs to listen on the WAN interface.
- CountSessine 9y agoAgreed - but can there ever be any legitimate use case for an home router to speak IGD over its WAN interface? IGD is typically meant to allow your Xbox on your LAN to set up forwarding rules.
- duskwuff 9y agoNone. Exposing miniupnpd on a public interface is always a misconfiguration. I'm disappointed that the application even allows it -- it has to know which one is public to set up IP forwarding rules, so it has no excuse.
- bsder 9y agoWhy is IP spoofing STILL an issue? Why?
- betaby 9y ago1) Hardware. ALL routers performance degrades. Sometimes up to unsuitability. 2) Software. No commonly agreed way to maintain route and route6 object. No federation for them 3) Administrative. Lack of network hygiene. Keyword: BCP38 Relevant document https://tools.ietf.org/pdf/bcp38.pdf https://tools.ietf.org/pdf/bcp38.pdf
- jopsen 9y agoWouldn't it be enough to check the source IP against the ip/mask at ISP pairing sites... I suspect it might reduce out-of-network traffic a bit too.. Or ISPs could check source IPs at edge routers maybe?
- ktta 9y agoIncase of huge DoS attacks they do something similar. But with DDoS attacks the spoofed packets are coming from so many different locations that it is hard to identify them, and often it is just stuff like compromised toasters.
- buschtoens 9y ago> compromised toasters. Only on HN. Haha.
- hueving 9y agoBCP 38 on ingress at edges is trivial performance-wise (a few ACL entries in TCAM). It's just that there is no incentive to stop lazy ISPs from allowing everything since that's easier.
- betaby 9y agoIt's not few. It's a very common mistake. Say I have 20 10G ports on line card. Mid size ISP has from hundreds to thousands routes. Thus we will end up with tens of hundreds ACLs per line card. That affects performance, dramatically. Say on older yet supported Cisco 7600 you can apply about 10k entries per port, ~ 100k totaling per card. That's limit, after that performance degrades. Another question what to do on peer-peer links, like say NTT<->Centrylink? Both on them have interconnects across the globe ad sending each other hundreds of thousands prefixes on 100G ports. That's the challenge as well. Hardware is not there, it's coming slowly but not yet there. Most of the big players DO one or another form of ingress filtering on some ports. Valid point is that smaller players are arrogant ob the issue and dump all all the garbage to the upstream.
- dsl 9y agoIt is unfortunate that CloudFlare shared enough PoC code to weaponize this. Edit: for the downvoters, this isn't just my opinion, please read https://en.wikipedia.org/wiki/Responsible_disclosure https://en.wikipedia.org/wiki/Responsible_disclosure
- detaro 9y agoThis is so trivial that it really doesn't matter - it's just sending a completely normal SSDP request, code for which you could find in any implementation of the protocol.
- jwilk 9y agoFrom the HN guidelines: Please resist commenting about being downvoted. It never does any good, and it makes boring reading.
- majke 9y agoThis SSDP problem is known for years.
- xxdesmus 9y agoYou’re being down-voted because this is already well known, and has been used for years.
- upofadown 9y ago>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.
- detaro 9y agoThe printer is just an example - if you look at the tables with the collected data, the vast majority of devices they found are home routers.
- TrickyRick 9y agoConsider a printer (Or even an external disk) connected via USB to the router. A lot of home routers support sharing said printer over the network and some of those routers probably answer to UPnP requests on the WAN port as well.
- dom0 9y agoIPv6 (now you really need a real, properly configured firewall instead of NATting and praying)
- oh_sigh 9y agoOf course you can NAT with ipv6. There is a private address space in ipv6(fc00::/7) like there is in ipv4(192.168.0.0/16,...)
- thomasdereyck 9y agoShameless plug: When I read about SSDP a little while ago I was curious to see if I'd encounter it on many networks. As I was also trying to learn Swift/Apple development, I've written two (non-free) little apps for macOS/iOS to monitor SSDP messages: https://itunes.apple.com/us/app/ssdp-monitor/id1191370425?mt=12 https://itunes.apple.com/us/app/ssdp-monitor/id1191370425?mt... https://itunes.apple.com/be/app/ssdp-monitor/id1197048167?mt=8&ign-mpt=uo%3D4 https://itunes.apple.com/be/app/ssdp-monitor/id1197048167?mt... Ever since creating it and just checking on some networks, I'm surprised of how many devices are actually using it. I probably saw this in Wireshark before as well, but probably overlooked it because you're never really looking for it. I wonder if many other such protocols are often used but easily missed...
- majke 9y agoAuthor here. Allow me to extend the post a bit. It turns out that about 2.4% of the IPs that respond to SSDP queries, do so from a weird port number! For example: IP 192.168.1.75.50950 > 239.255.255.250.1900: UDP, length 95 IP 192.168.1.71.1026 > 192.168.1.75.50950: UDP, length 249 The first packet is SSDP M-SEARCH query. The second is a response from my printer. Notice - the source port for the response is not 1900 (but the dst port is okay). I'm not sure what the spec has to say about it, but it's pretty weird. What's worse - these responses won't be matched against "sport=1900" DDoS mitigation firewall rule. I'm not sure what is the moral here. But if you ever see some UDP packets from a weird port, to a weird port - maybe it's this SSDP case.
- floatboth 9y agoIsn't that normal UDP behavior? Source port on responses can always be anything?
- ra1n85 9y agoNot really - DNS, DHCP, NTP, etc, all respond from the source port the service is bound to.
- DSMan195276 9y agoYou're half right. In most cases, programs have the OS pick their source port, but that's for the computer initiating the communication. So for example, in the communication he gave the 50950 was likely picked by the OS (by selecting a currently open port) and 1900 is the destination port. When the remote computer responds (his printer), they don't then pick a new random source port, they just swap the source/dest from the previous message. If they didn't keep it the same then the OS wouldn't always be able to know packets are part of which connections, because you can multiple connections open with the same computer at the same time to the same dest port, and the only differentiation would be the source port.
- zAy0LfpBZLC8mAC 9y ago> If they didn't keep it the same then the OS wouldn't always be able to know packets are part of which connections UDP does not have connections. > and the only differentiation would be the source port. ... or some request/session/flow id in the application layer protocol. Some UDP protocols use UDP in this way, some don't, UDP itself doesn't care.
- saurik 9y ago> Internet service providers should never allow IP spoofing to be performed on their network. IP spoofing is the true root cause of the issue. See the infamous BCP38. I don't see how it is at all reasonable to shift blame from a protocol that assumes the world can be trusted to the untraceable goal of "every single network in the entire world should only generate trusted data: then the problem would be solved". > Internet providers should internally collect netflow protocol samples. The netflow is needed to identify the true source of the attack. With netflow it's trivial to answer questions like: "Which of my customers sent 6.4Mpps of traffic to port 1900?". Due to privacy concerns we recommend collecting netflow samples with largest possible sampling value: 1 in 64k packets. This will be sufficient to track DDoS attacks while preserving decent privacy of single customer connections. OMFG. Do you want deanonymization attacks? Because this is how you get deanonymization attacks :/. The right form of solution here is not to encourage ISPs to log even more of our traffic (a practice I wish were illegal), but to try to kill off UPNP through every form of leverage possible (even if it breaks things). I'd say this is "so disappointing", but I guess I shouldn't expect much from the company that tried its damndest to argue that nothing of importance was leaked from Cloudbleed even when you could still recover Grindr requests complete with IP addresses that they had managed to leak well after they tried to claim that data had been scrubbed :/.
- hueving 9y agoIP spoofing is the problem. Even if you completely ban UDP protocols, it still allows for anonymous unamplified attacks. Attacking every single protocol that dares to respond to a query is a pretty stupid approach IMO. Look how well it's worked so far. Additionally, unless we switch DNS to TCP only, root and authoritative name servers are always going to provide and amplification factor and there are still more than enough of them for devastating attacks. Agree with you about monitoring, but that wouldn't be necessary if we got serious about enforcing and blacklisting ISPs that drop the ball on BCP 38.
- yrro 9y agoWho are these ISPs? I would love to see a treemap apportioning blame to the worst offenders...
- hueving 9y agoMore casualties from BCP 38 failures. This article mentions it but then dilutes the importance of it by suggesting SSDP is a problem. If IP spoofing did not work on the Internet, none of these UDP reflection attacks would work. A scheme to strong arm the adoption of BCP 38 is key to stopping these attacks from growing. IoT has shown us that expecting device updates to disable these UDP protocols is a lost battle.
- lightedman 9y ago"A scheme to strong arm the adoption of BCP 38 is key to stopping these attacks from growing. IoT has shown us that expecting device updates to disable these UDP protocols is a lost battle." Easily done: "Follow some standards and RFCs or get put on a global blacklist of companies to not do business with."
- gbrown_ 9y agoMore on the SSDP servers Since we probed the vulnerable SSDP servers, here are the most common Server header values we received: 104833 Linux/2.4.22-1.2115.nptl UPnP/1.0 miniupnpd/1.0 77329 System/1.0 UPnP/1.0 IGD/1.0 66639 TBS/R2 UPnP/1.0 MiniUPnPd/1.2 12863 Ubuntu/7.10 UPnP/1.0 miniupnpd/1.0 11544 ASUSTeK UPnP/1.0 MiniUPnPd/1.4 What an earth is internet facing and running 2.4 Linux kernels?
- falsedan 9y agoCEP (home routers)
- firebird84 9y ago2.4? That takes me back to my misspent college years. When I should have been out in bars in partying, I was at home babysitting my 2.4 gentoo builds...
- dicknuckle 9y agoDD-WRT installed by wannabe linux nerds and forgotten about. "Yea I installed DD-WRT 6 years ago because it's better" Nevermind the vulnerabilities that are patched over the years.
- walterkobayashi 9y agoIs it possible that SSDP Protocol can be run on a non-standard port (10000 - 65535) ?
- dingo_bat 9y agoYou would have to hack the upnp device's firmware, afaict.
- ratinacage 9y agoI find it fascinating that the packets per second chart resembles an RC circuit's step response. I wonder if there is a good electrical circuit analogy for packets, packet size, and bandwidth.