News for hackers. Stuff that matters.

A comment on Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS. Parent comment

Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by Kikawala on Wednesday June 28, 2017 @10:59PM (#14660444)
Vulnerable by default?

If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.

[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by jacquesm on Wednesday June 28, 2017 @11:09PM (#14660477)
One of the documented use cases for UPnP is IGD which expressly allows UPnP devices to configure fire wall rules and to set up NAT to map ports to the outside world. So a UPnP device that wishes to expose itself to the outside world is able to do so and this is by design, not by accident. Whether you agree with that or not is another matter.
[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by MichaelGG on Wednesday June 28, 2017 @11:36PM (#14660573)
That doesn't mean the upnp listener needs to listen on the WAN interface.
[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by CountSessine on Thursday June 29, 2017 @02:23AM (#14661181)
Agreed - but can there ever be any legitimate use case for an home router to speak IGD over its WAN interface? IGD is typically meant to allow your Xbox on your LAN to set up forwarding rules.
[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by duskwuff on Thursday June 29, 2017 @03:28AM (#14661432)
None. Exposing miniupnpd on a public interface is always a misconfiguration. I'm disappointed that the application even allows it -- it has to know which one is public to set up IP forwarding rules, so it has no excuse.
[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by okwap on Thursday June 29, 2017 @03:10AM (#14661370)
TR-064 is based on UPnP/SSDP, for example.
[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by voltagex_ on Wednesday June 28, 2017 @11:52PM (#14660632)
What about not replying to unicast responses? Or rate limiting by default?
[ Parent | on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS by azinman2 on Thursday June 29, 2017 @12:08AM (#14660691)
When is it ever ok for UPnP to work across the internet? That’s not what it’s meant for.
[ Parent | on HN ]