Thursday, April 17, 2025
HomeDDOSHackers Use Old UPnP Protocol Exploit to Launch Heavy Bandwidth DDoS Attacks

Hackers Use Old UPnP Protocol Exploit to Launch Heavy Bandwidth DDoS Attacks

Published on

SIEM as a Service

Follow Us on Google News

Attackers could use the UPnP protocol exploit to bypass the DDoS mitigation solutions and to perform a heavy DDoS amplification attack. Imperva published a proof of concept (PoC) and the mitigations to be carried out for DDoS amplification attacks.

UPnP(Universal Plug and Play) works over UDP port 1900 that enabled by default on many IoT devices and it is always recommended to disabling UPnP due to a number of security concern over years. Business can estimate the cost and Probability of a DDoS Attack with DDoS downtime cost calculator.

During the attack, researchers noticed the packet was from unexpected source rather than UDP/1900 and after working with a number of possibilities they reproduced the attack by creating a PoC for a UPnP-integrated attack method that obfuscates the source details of the amplification payload.

- Advertisement - Google News

Attackers can locate an open UPnP router with SSDP(Simple Service Discovery Protocol) through shodan scans, according to researchers the wide scan for “rootDesc.xml” yielded 1.3 million results. Which mean’s all the devices are not vulnerable, but attackers can locate the vulnerable routers easily.

Then in the next step attackers try accessing the XML file “rootDesc.xml” and modify the port forwarding rules to mask the source port of DDoS attack to be from random ports.

UPnP protocol exploit

The PoC provided by Imperva shows attackers can use the UPnP devices to obfuscate the data from the source port of amplification payloads and it is not limited with DNS amplification also with SDP, DNS, and NTP attacks.

Researchers said, “With source IP and port information no longer serving as reliable filtering factors, the most likely answer is to perform deep packet inspection (DPI) to identify amplification payloads.”

Github Hits with a record-breaking DDoS attack, the Memcached amplification attack peaked up to 1.35Tbps via 126.9 million packets per second.

Business can find and implement the best DDoS attack protection tools to away from cybercriminals and keep safe and secure your organizations.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Ransomware Attacks Surge 126%, Targeting Consumer Goods and Services Sector

The cybersecurity landscape witnessed a dramatic escalation in ransomware attacks, marking a concerning trend...

CrazyHunter Hacker Group Exploits Open-Source GitHub Tools to Target Organizations

A relatively new ransomware outfit known as CrazyHunter has emerged as a significant threat,...

Threat Actors Leverage Cascading Shadows Attack Chain to Evade Detection and Hinder Analysis

A sophisticated multi-layered phishing campaign was uncovered, employing a complex attack chain known as...

Microsoft Vulnerabilities Reach Record High with Over 1,300 Reported in 2024

The 12th Edition of the Microsoft Vulnerabilities Report has revealed a significant surge in...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

New ‘Waiting Thread Hijacking’ Malware Technique Evades Modern Security Measures

Security researchers have unveiled a new malware process injection technique dubbed "Waiting Thread Hijacking"...

EU’s GDPR Article 7 Poses New Challenges for Businesses To Secure AI-Generated Image Data

As businesses worldwide embrace digital transformation, the European Union’s General Data Protection Regulation (GDPR),...

DoJ Launches Critical National Security Program to Protect Americans’ Sensitive Data

The U.S. Department of Justice has launched a landmark initiative to block foreign adversaries—including...