Research on New Vectors of UDP-Based DDoS Amplification Attacks of IoT
summary
Honeypot logs and internet-wide scans show specific UDP services (WS‑Discovery, CoAP, Ubiquiti, OpenVPN, ADDP/DHDiscover) produce huge amplification when abused: measured BAF 443 for WS‑Discovery (Nest lists MTP at 556.9), short probes (3–21 bytes) trigger responses hundreds to thousands of bytes, and daily honeypots capture tens of millions exposed and millions of probe requests. Enterprise telemetry finds IoT causes rose to 22% of DDoS in 2020 (from 12% in 2019) and reflection sources to 14% (from 5%); mitigation needs protocol-aware rules, source verification, and cloud DDoS filtering.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:04IoTbased DDoS attack
- 4:47UDPbased DDoS attacks
- 12:56Why UDPbased DDoS attacks
- 16:35Threat Intelligence Center
- 27:10IoT Ecosystem
- 29:45What should you do
- 33:22Resources
related talks
23mThe Role of IoT and 5G Devices in DDoS Attacks
52mInvestigating DDOS - Architecture Actors and Attribution
45mAnatomy of a DDoS
30mWeaponising IoT
37mAnatomy of a DDoS
47mThe Secret Life of Enterprise Botnets
41mAre DDoS attacks a threat to the decentralised internet?
01h 00mIoT Lockdown - Battling Bot Net Builders