# Security of IoT Application Layer Protocols: Challenges and Findings
## 5 Service Discovery Protocols
### Ssdp  
Simple Service Discovery Protocol (SSDP) is an open protocol widely used presently for service discovery and advertisement in residential or small business networks (UPnP Forum). The protocol--included in the Universal Plug-and-Play (UPnP) architecture--makes it possible to transparently plug-and-play devices without the need for any manual configuration.  
Concerning security, similarly to mDNS, the SSDP protocol is very weak because it does not provide any built-in mechanism. Therefore, various security risks affect SSDP-enabled devices. These risks generally exploit service discovery features and its multicast nature. A major threat affecting SSDP nodes is represented by _amplification/reflection Distributed Denial of Service attacks_ aimed at making devices unresponsive and services unavailable. These attacks exploit the characteristics of the UDP and SSDP protocols as well as device misconfiguration. More precisely, an attacker could create an M-SEARCH message with the spoofed IP address of the node under attack (see Figure 2). This message will be sent to a set of vulnerable SSDP devices that in turn will flood the node target of the attack with response messages with a high amplification potential.  
A more sophisticated variant of amplification/reflection attacks takes advantage of the abnormal behavior of devices that use ephemeral random source ports for sending their response messages instead of the standard port number 1900, thus making the detection of the attack more difficult.  
Another security threat affecting SSDP-enabled nodes is represented by _passive attacks_ performed by _eavesdropping_ the multicast messages exchanged as plaintext over the network. This threat might grant the access to sensitive information without any alert, thus leading to serious consequences for privacy and confidentiality.  
SSDP-enabled nodes are also exposed to the following security issues:  
Figure 2: Example of SSDP amplification/reflection DDoS attack toward a server.  
* _Poisoning attacks_ where attackers advertise fake services using NOTIFY request messages. These services are frequently exploited for further attacks towards unaware nodes;
* _Device reconfiguration_ where attackers exploit vulnerabilities of misconfigured devices to gain access to internal network resources or use the devices to conduct further malicious activities.  
The analysis of the CVEs has shown that numerous vulnerabilities affect products and services based on SSDP. More precisely, 81 vulnerabilities have been detected in the past six years. A common vulnerability is represented by buffer overflow that allows attackers to remotely execute arbitrary code or crash an SSDP node (e.g., CVE-2019-14323, CVE-2019-14363). Other relevant security issues are related to the rules and functions associated with device configuration. In particular, it has been shown that weak authentication and authorization mechanisms allow remote attackers to change device configuration or reboot/shutdown devices (e.g., CVE-2014-5406, CVE-2015-4051).  
In the literature, SSDP security challenges have been explored by [PERSON] et al. [72] who analyze the Belkin WeMo home automation ecosystem with the objective of discovering its vulnerabilities. In particular, the paper demonstrates that it is possible to remote control these devices by leveraging the sensitive information being exchanged. Similarly, [PERSON] et al. [73] quantify the DDoS attack capability of consumer IoT devices and show that devices even behind gateways can be exposed to this type of attacks.