Thursday, July 18, 2024

Hackers Use Old UPnP Protocol Exploit to Launch Heavy Bandwidth DDoS Attacks

Attackers could use the UPnP protocol exploit to bypass the DDoS mitigation solutions and to perform a heavy DDoS amplification attack. Imperva published a proof of concept (PoC) and the mitigations to be carried out for DDoS amplification attacks.

UPnP(Universal Plug and Play) works over UDP port 1900 that enabled by default on many IoT devices and it is always recommended to disabling UPnP due to a number of security concern over years. Business can estimate the cost and Probability of a DDoS Attack with DDoS downtime cost calculator.

During the attack, researchers noticed the packet was from unexpected source rather than UDP/1900 and after working with a number of possibilities they reproduced the attack by creating a PoC for a UPnP-integrated attack method that obfuscates the source details of the amplification payload.

Attackers can locate an open UPnP router with SSDP(Simple Service Discovery Protocol) through shodan scans, according to researchers the wide scan for “rootDesc.xml” yielded 1.3 million results. Which mean’s all the devices are not vulnerable, but attackers can locate the vulnerable routers easily.

Then in the next step attackers try accessing the XML file “rootDesc.xml” and modify the port forwarding rules to mask the source port of DDoS attack to be from random ports.

UPnP protocol exploit

The PoC provided by Imperva shows attackers can use the UPnP devices to obfuscate the data from the source port of amplification payloads and it is not limited with DNS amplification also with SDP, DNS, and NTP attacks.

Researchers said, “With source IP and port information no longer serving as reliable filtering factors, the most likely answer is to perform deep packet inspection (DPI) to identify amplification payloads.”

Github Hits with a record-breaking DDoS attack, the Memcached amplification attack peaked up to 1.35Tbps via 126.9 million packets per second.

Business can find and implement the best DDoS attack protection tools to away from cybercriminals and keep safe and secure your organizations.


Latest articles

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...

Cybercriminals Exploit Attack on Donald Trump for Crypto Scams

Researchers at Bitdefender Labs remain ever-vigilant, informing users about the latest scams and internet...

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

HTTP Request Smuggling is a flaw in web security that is derived from variations...

Volcano Demon Group Attacking Organizations With LukaLocker Ransomware

The Volcano Demon group has been discovered spreading a new ransomware called LukaLocker, which...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles