October 15, 2014 Akamai Warns of UPnP Devices Used in DDoS Attacks
Akamai Contacts Rob Morton
Media Relations
617-444-3641
rmorton@akamai.com
or Tom Barth
Investor Relations
617-444-7130
tbarth@akamai.com
Four million Universal Plug and Play devices may be vulnerable to use by attackers
Fake requests to UPnP devices can elicit DDoS traffic to a target
Advisory explains need for vendor and community action
CAMBRIDGE, Mass. - October 15, 2014 - Akamai Technologies, Inc. (NASDAQ: AKAM), the leading provider of cloud services for delivering, optimising and securing online content and business applications, today released, through the companys Prolexic Security Engineering & Response Team (PLXsert), a new cybersecurity threat advisory. The advisory alerts the security community, device vendors, Internet service providers and enterprises to the risk of massive distributed denial of service (DDoS) attacks involving Universal Plug and Play (UPnP) devices. The advisory is available for download from Prolexic (now part of Akamai) at www.prolexic.com/ssdp.
PLXsert has observed the use of a new reflection and amplification DDoS attack that deliberately misuses communications protocols that come enabled on millions of home and office devices, including routers, media servers, web cams, smart TVs and printers. The protocols allow devices to discover each other on a network, establish communication and coordinate activities. DDoS attackers have been abusing these protocols on Internet-exposed devices to launch attacks that generate floods of traffic and cause website and network outages at enterprise targets.
Malicious actors are using this new attack vector to perform large-scale DDoS attacks. PLXsert began seeing attacks from UPnP devices in July, and they have become common, said Stuart Scholly, senior vice president and general manager, Security Business Unit, Akamai. The number of UPnP devices that will behave as open reflectors is vast, and many of them are home-based Internet-enabled devices that are difficult to patch. Action from firmware, application and hardware vendors must occur in order to mitigate and manage this threat.
PLXsert found 4.1 million Internet-facing UPnP devices are potentially vulnerable to being employed in this type of reflection DDoS attack - about 38 percent of the 11 million devices in use around the world. PLXsert will share the list of potentially exploitable devices to members of the security community in an effort to collaborate with cleanup and mitigation efforts of this threat.
These attacks are an example of how fluid and dynamic the DDoS crime ecosystem can be, explained Scholly. Malicious actors identify, develop and incorporate new resources and attack vectors into their arsenals. Its predictable that they will develop, refine and monetize these UPnP attack payloads and tools in the near future.
Get the SSDP Reflection Threat Advisory to learn more
PLXsert replicated an attack of this type in a lab environment, demonstrating how attackers produce reflection and amplification DDoS attacks using UPnP-enabled devices. In the advisory, PLXsert shares its analysis and details, including:
How the SSDP protocol and SOAP requests are used in reflection attacks
Two example DDoS tools used to scan for vulnerable devices and launch attacks
Details of an observed attack campaign
Geographical distribution of UPnP devices involved in attacks
Top 10 most common headers in UPnP response payloads
Recommended system hardening and community action
DDoS mitigation
A complimentary copy of the threat advisory is available for download at www.prolexic.com/ssdp.
About Akamai
Akamai is the leading provider of cloud services for delivering, optimising and securing online content and business applications. At the core of the Companys solutions is the Akamai Intelligent Platform , providing extensive reach, coupled with unmatched reliability, security, visibility and expertise. Akamai removes the complexities of connecting the increasingly mobile world, supporting 24/7 consumer demand, and enabling enterprises to securely leverage the cloud. To learn more about how Akamai is accelerating the pace of innovation in a hyperconnected world, please visit www.akamai.com or blogs.akamai.com, and follow @Akamai on Twitter.
Top
Most recent headlines
06/10/2025
France T l visions, France's leading broadcaster, has received the 2025 EBU ...
04/09/2025
Monumental Sports & Entertainment (MSE), in collaboration with Dalet, has been a...
07/08/2025
July 8 2025, 22:30 (PDT) Tata Motors & Dolby Bring Dolby Atmos to Harrier.ev, R...
12/07/2025
As the death toll continues to mount, with at least 120 killed and more than 170 people still missing on July 10 from devastating Texas floods, a number of broa...
12/07/2025
EL SEGUNDO, Calif., and MIAMI -DirecTV and TelevisaUnivision have signed a deal that will make the ad-supported premium subscription tier of ViX, ViX Premium wi...
11/07/2025
PARK CITY, UTAH, July 11, 2025 - The nonprofit Sundance Institute announced today the 11 producers chosen for its annual Producers Labs, returning to Ucross Fou...
11/07/2025
If you've ever wondered what might be playing in Clark Kent's headphones...
11/07/2025
L3Harris Technologies President of Intelligence, Surveillance and Reconnaissance Jason Lambert and General Manager of L3Harris Waco facility Sean Ling held a ce...
11/07/2025
ARLINGTON, Va. WETA, the flagship public media station in the national capital area, has launched WETA+, a new streaming service tailored for the local Washingt...
11/07/2025
The Federal Communications Commission has emerged as one of the central players in the broadcast TV landscape in 2025, with its deregulatory policies sparking h...
11/07/2025
Calrec will introduce usability, customization and system enhancements across its entire range of Argo consoles during IBC2025, Sept. 12-15, at the RAI Amsterda...
11/07/2025
LONDON Encompass Digital Media said it will support live and on-demand viewing of the 2025 FIFA Club World Cup across multiple global regions for sports enterta...
11/07/2025
Two-thirds of broadcast engineers reaped the benefits of a pay raise within the last year....
11/07/2025
CARY, N.C. SmallHD has launched the Quantum 27, a new 26.5-inch Quantum-Dot OLED monitor designed to deliver postproduction image quality in a compact, set-frie...
11/07/2025
The Federal Communications Commission's Enforcement Bureau and Tegna have entered into a consent decree that will settle an investigation into the accidenta...
11/07/2025
WASHINGTON Following news in early July that Paramount had settled President Donald Trump's lawsuit, Sens. Edward J. Markey (D-Mass.) and Ben Ray Luj n (D-N...
11/07/2025
Model/Actriz Performs Lead Single Cinderella on The Late Show with Stephen Colbe...
11/07/2025
Behind the Mic: Amazon Prime Preps for First Season of NBA Action; MSG Networks ...
11/07/2025
SVG New Sponsor Spotlight: Suite Studios' Craig Hering on Adapting to Client...
11/07/2025
2025 SVG Content Management Forum Breaks Down AI's Impact, Continued Transit...
11/07/2025
A Journey HOME: University of Nebraska's HuskerVision Goes IP Leaders from the HuskerVision and Lawo share their IP learnings By SVG Staff
Friday, July 1...
11/07/2025
CMSI, Remote Picture Labs, Ace ESPN's Cloud-Based Editing Efforts for Wimble...
11/07/2025
Netflix Enters the Live-Boxing-Production Ring for Round 2 With Historic Taylor-...
11/07/2025
Back to All News
Too Hot to Handle: Italy Is Coming on July 18 Only on Netflix
Entertainment
11 July 2025
GlobalItaly
Link copied to clipboard
July 11, 20...
11/07/2025
Back to All News
Netflix Will Release Death Inc. Seasons 1, 2 and 3
Entertainment
11 July 2025
GlobalSpain
Link copied to clipboard
Season 1
Season 2
Se...
11/07/2025
AI and Multimedia Authenticity Standards Collaboration launches two papers to guide the future of AI integration, today at the AI for Good Global Summit
The...
11/07/2025
Ceramics - the humble mix of earth, fire and artistry - have been part of a global conversation for millennia.
From Tang Dynasty trade routes to Renaissance pa...
10/07/2025
The current holder of the prestigious Thomson Foundation Young Journalist of the Year Award has been forced to stop reporting over fears for her safety in Afgha...
10/07/2025
Spotify is turning up the volume on Australian music with a multipronged initiative designed to highlight the dominance of Australian artists on the global stag...
10/07/2025
This is not a drill: Oasis is back on the road-marking its first live performanc...
10/07/2025
The music industry depends on fresh ideas, bold voices, and emerging talent. Yet across the U.K., too many young musicians lack the space to develop their craft...
10/07/2025
NEW YORK - July 10, 2025 - Nielsen, the global leader in audience measurement, data and analytics, today announced that it appointed Richard Pacheco as head of ...
10/07/2025
Local newscasts don't exist in a vacuum. News directors and station management constantly evaluate what's working, what isn't and perhaps most impor...
10/07/2025
Lawo has announced that Stuttgart Media University (Hochschule der Medien, HdM) has comprehensively modernized its central recording studio after selecting an I...
10/07/2025
The Society of Motion Picture and Television Engineers (SMPTE) has opened early-bird registration for the Media Technology Summit, which will take place in a ne...
10/07/2025
NASHVILLE, Tenn. TNDV Television has launched Aspiration 35, a new version of its 40-foot Aspiration truck reimagined for cinematic multicamera productions....
10/07/2025
BURBANK, Calif. Key Code Education, a provider of instructor-led postproduction training, is growing its curriculum with new programs for beginner and intermedi...
10/07/2025
HACKENSACK, N.J. Actus Digital will demonstrate how broadcasters can transform compliance monitoring from a necessary expense into a strategic revenue driver at...
10/07/2025
The Federal Register has published a summary of the Federal Communications Commission's Public Notice seeking comments on its ownership rules that lists a d...
10/07/2025
Back to All News
Netflix Presents the Official Trailer for SuperestarPlay Video
Play Video
Entertainment
10 July 2025
GlobalSpain
Link copied to clipboard...
10/07/2025
In the race to understand our planet's changing climate, speed and accuracy are everything. But today's most widely used climate simulators often strugg...
10/07/2025
As one of the world's largest emerging markets, Indonesia is making strides toward its Golden 2045 Vision - an initiative tapping digital technologies and...
10/07/2025
10 Jul 2025
VEON and Cohen Circle Secure Investor Commitments for Kyivstar Listing Kyiv, New York, Dubai, and Philadelphia - July 10, 2025 - VEON Ltd. (Nasdaq:...
10/07/2025
5G for all? What the DFL's use of Easy5G and RefCam could mean for events in...
10/07/2025
Save the Date: PGA TOUR Studios Welcomes SVG Remote Production Summit on Oct 14-...
10/07/2025
Cloud on the Road: How Remote-Production-Service Providers Are Adapting to a New...
10/07/2025
Seattle Kraken's Ryan Schaber on the NHL Team Taking Live Game Productions I...
10/07/2025
FOX Sports Reboots Small Control Room in Los Angeles as Hub for Vertical-First P...
10/07/2025
SVG Sit-Down: MSE's Zach Leonsis, ViewLift's Rick Allen Go Deep on Joint...
October 15, 2014 Akamai Warns of UPnP Devices Used in DDoS Attacks 
