Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.me.uk is one of the many independent Mastodon servers you can use to participate in the fediverse.
Open, user-supported, corporation-free social media for the UK.

Administered by:

Server stats:

499
active users

mastodon.me.uk: AboutProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.6

Adrian McEwen

Hmm. Spent a chunk of today working out that a client's CoAP server was being used as an amplification service as part of a DDoS network 😞

The server wasn't (AFAICT) compromised, just being used to turn ~60 byte attack packets into ~540 byte attack packets, as well as presumably spreading out the attacking traffic's route through the Internet.

ietf.org/archive/id/draft-matt goes into more depth, if anyone wants further background.

www.ietf.orgAmplification Attacks Using the Constrained Application Protocol (CoAP) Protecting Internet of Things (IoT) devices against attacks is not enough. IoT deployments need to make sure that they are not used for Distributed Denial-of-Service (DDoS) attacks. DDoS attacks are typically done with compromised devices or with amplification attacks using a spoofed source address. This document gives examples of different theoretical amplification attacks using the Constrained Application Protocol (CoAP). The goal with this document is to raise awareness and to motivate generic and protocol-specific recommendations on the usage of CoAP. Some of the discussed attacks can be mitigated by not using NoSec or by using the Echo option.
#CoAP#security#DDoS
Jul 02, 2024, 01:49 PM·Public·Web
1boost·2favorites
Public
chrysn

@amcewen We're still curious about attack scenarios that interact with this draft. Was this a Simple Amplification Attack or was anything more fancy involved? Would the system also have been flagged as a DDoS amplification vector if it had adhered to the RFC9175 2.4 item 3 numbers and sent (depending on what your 60/540 bytes include) 136 bytes plus UDP/IP headers?

Public
Adrian McEwen

@chrysn Ah, thanks for getting in touch! Wasn't sure who/where to report this more widely.

It was a simple attack, and the 60/546 includes the IP packet and ethernet frame. It was a repeated GET request for '/', plus a 5 byte random trailer in the UDP payload.

I've got a wireshark dump of a bunch of traffic, if that's useful?

I'll have a read of RFC9175 now.

Public
Adrian McEwen

@chrysn now I've read RFC9175 (got sidelined the other day, and we'd mitigated the attack by then) it would have been flagged as DDoS amplification.

I've also raised it with Thingsboard, to hopefully get it plugged/improved upstream.

ExploreLive feeds
About