Lightning Talk Proposal: A New Twist In SSDP DDoS Attacks

Network operators are familiar with defending against reflection / amplification DDoS attacks. Arbor Networks has uncovered a new twist that abuses SSDP to bypass …

Network operators are familiar with defending against reflection / amplification DDoS attacks. Arbor Networks has uncovered a new twist that abuses SSDP to bypass naive port filtering, raising the bar for defenders. Evidence shows attackers are aware of this behavior and have this technique waiting in their tool chest. Digging into the root cause show a surprising number of CPE devices are rife for abuse. This talk will show the specifics of this attack, how we determined the cause, and the challenges it brings to protecting networks.