A new cybersecurity threat has emerged, targeting a wide array of hosts via a Denial-of-Service (DoS) attack, known as the Loop DoS attack. It specifically exploits application-layer protocols relying on the User Datagram Protocol (UDP). Security experts from CISPA Helmholtz-Center have raised the alarm that potentially hundreds of thousands of hosts are vulnerable.
The Loop DoS attack functions by linking two servers through UDP—a protocol that inherently does not authenticate IP addresses—causing them to enter into a continuous communication loop. This vulnerability is a direct result of UDP’s connectionless design, which makes it inherently susceptible to IP spoofing attacks.
Attackers initiate this reflected DoS attack by sending forged UDP packets containing a victim’s IP address. The servers, unable to verify the authenticity of the IP address, respond to the victim instead of the actual source of the threat, thereby creating a self-sustaining loop that generates massive traffic loads. This can lead to service interruptions and network outages.
This threat extends to implementations of UDP in various protocols, including Domain Name System (DNS), Network Time Protocol (NTP), Trivial File Transfer Protocol (TFTP), among others. Such an attack not only disrupts the targeted services but also has the potential to impact broader network systems.
A simple but critical point is that if two application servers are running an exposed version of the protocol, an attacker can instigate this loop. By spoofing one server’s address, the communication begins, and the servers start bouncing error messages between themselves. This loop continues indefinitely, draining resources and causing service unavailability.
The researcher, Yepeng Pan and Christian Rossow, at CISPA have discovered that as many as 300,000 hosts are at risk of being manipulated to execute Loop DoS attacks. Notably, there’s a concerning list of affected vendors, including technology giants like Broadcom, Cisco, Honeywell, Microsoft, MikroTik, and Zyxel.
While there have been no instances of these attacks in active use, the simplicity with which they can be carried out and the wide range of vulnerable products underscore the severity of the threat. The research serves as a cautionary note for organizations to bolster their network defenses against such potential exploits.
About Purple Shield Security
Purple Shield Security stands out from the crowd of cyber security firms. Picture us as the guardians of your digital space, always on the lookout to protect your business from the newest cyber dangers. Our team isn’t just made up of experts who care for your data and systems; they’re passionate about giving you a sense of security. We’ve got a variety of services to help keep you safe, including Managed Cyber Security, Cyber Security Consulting, Risk Analysis, Defense Services, Incident Response, and even a virtual Chief Information Security Officer (vCISO).
Don’t put off making your business safer. Contact us now to see how Purple Shield Security can upgrade your cyber defenses.