[core] The CoAP protocol is the next big thing for DDoS attacks | ZDNet

[Carsten Bormann <[e-mail]>]

CoAP is making some waves in a not so nice way:

> https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/ <https://www.zdnet.com/article/the-coap-protocol-is-the-next-big-thing-for-ddos-attacks/>

The potential for amplification in a UDP-based protocol of course is not news.  
We wrote about that in the RFC:

https://tools.ietf.org/html/rfc7252#section-11.3

Still, the attention this is getting may be a good occasion to examine how CoAP has been implemented by the platforms that make themselves exploitable as DDoS amplifiers.

(And the amplification issue will be exploited by outlets that claim that it can be used to “remotely control IoT endpoints by leveraging security issues”, as e.g.:
https://futureiot.tech/top-iot-protocols-mqtt-coap-have-major-flaws-warns-trend-micro/
Of course, if it becomes the fashion to make CoAP servers without security available to the Internet at large, this might even be true.)

Grüße, Carsten