A WS-Discovery flood attack is a DDoS reflection attack that uses the WS-Discovery protocol to significantly amplify the strength of the attack. Attackers launch WS-Discovery floods to overwhelm servers, websites, networks, or other machines with traffic, to the point where they slow down or crash. Amplification techniques like those used in WS-Discovery floods enable attackers to generate massive attacks with little effort and few resources.
Key takeaways
-
It is a DDoS reflection attack.
-
Attackers spoof their target's IP address and send requests to internet-connected, WSD-enabled devices (like IP cameras or DVRs), causing those devices to continuously bounce their responses directly to the victim.
-
It features massive amplification.
-
The attack is highly destructive because the responses sent to the victim are 75 to 150 times larger (and sometimes up to 500 times larger) than the attacker's initial request, easily overwhelming the target's network.
-
It exploits a local protocol exposed to the internet.
-
WS-Discovery was designed for local network device discovery, but because manufacturers and users expose these devices to the public internet using stateless UDP, they become easily exploitable for IP spoofing.
-
Mitigation requires port blocking and cloud defenses.
-
Because these attacks use random high ports and unique payloads, they are hard to detect; defending against them requires blocking UDP port 3702 on firewalls and utilizing cloud-based DDoS mitigation services.
What is the meaning of the term DDoS attack?
A distributed denial-of-service (DDoS) attack is a cyberattack in which hackers take control of thousands or millions of malware-infected machines, like computers or IoT devices, and direct them to send traffic and requests to a target or victim — usually a server. In trying to respond to or make sense of the massive amount of requests, the targeted server becomes overwhelmed, and slows down or crashes. As a result, a DDoS attack can shut down websites, networks, and organizations for a period of time.
What is a DDoS reflection attack?
In a reflection attack, attackers spoof destination IP addresses, using the IP address of the intended victim or targeted server when querying another server by sending packet requests. When the queried system responds to the packet request, responses go to the victim’s machines rather than to the attackers. This technique enables DDoS traffic to be “reflected” through other machines, rather than sending traffic directly to a target.
To amplify their efforts, attackers seek to reflect traffic off of machines that deliver a much larger response than the initial request. In these amplification attacks, attackers can use a relatively small number of initial packets and expend few resources to generate massive amounts of traffic that contains large amounts of data, overwhelming the targeted machines more quickly and easily.
What is WS-Discovery?
Web Services Dynamic Discovery (WS-Discovery or WSD) is a multicast communications protocol designed for device discovery on local networks. WS-Discovery uses the User Datagram Protocol (UDP), one of the core transport protocols for internet communications, but can also leverage the Transmission Control Protocol (TCP). WSD-enabled devices — like IP cameras, DVRs, speakers, etc. — emit beacons to facilitate discovery and connections between devices. For example, a DVR may use the WSD protocol to discover nearby IP cameras it can communicate with. While it is not a broadly known protocol, WS-Discovery has been adopted by ONVIF, an organization that promotes standardized interfaces to increase the interoperability of network products. As a result, the WSD protocol is now included in hundreds of thousands of products worldwide.
The WSD protocol was initially intended to be limited to local area networks (LANs). As manufacturers produced hardware incorporating the WSD service and users deployed the hardware across the internet, attackers found a new attack vector for DDoS reflection.
How does a WS-Discovery flood work?
A WS-Discovery reflection DDoS attack exploits a vulnerability in the UDP/TCP protocol. Because UDP is a stateless protocol, it is easy for attackers to spoof or forge an IP address when sending requests to other devices. This allows attackers to direct massive amounts of traffic from WS-Discovery devices to the target of their DDoS attacks. Although TCP is a connection- or stateful-oriented protocol, it can still be leveraged as part of IP spoofing and WSD attacks.
What makes a WS-Discovery flood attack so potent is that the WSD response is so much larger than the initial request. Small initial packets sent to a WS-Discovery device may generate responses that are 75–150 times larger. Several attacks have even exhibited amplification rates of 300 and 500 times. This is significantly larger than other UDP protocol attacks that tend to have an average amplification factor of 10.
WS-Discovery flood DDoS attacks are also difficult to identify. The protocol responds with random high ports and unique data payloads that make it difficult to recognize and mitigate the attack. Also, due to the size of the amplification and reflection, by the time the attack targets origin systems or services, your uplinks to the internet are already saturated, and you lose the ability to detect and mitigate.
Why customers choose Akamai
Akamai is the cybersecurity and cloud computing company that powers and protects business online. Our market-leading security solutions, superior threat intelligence, and global operations team provide defense in depth to safeguard enterprise data and applications everywhere. Akamai’s full-stack cloud computing solutions deliver performance and affordability on the world’s most distributed platform. Global enterprises trust Akamai to provide the industry-leading reliability, scale, and expertise they need to grow their business with confidence.
