A printer, a switch, or an industrial control system with the SNMP protocol exposed to the Internet may be participating in a DDoS attack without the company even knowing it. This is what data from Enthec’s honeypot network shows—a campaign that doesn’t seek to infiltrate any organization, but instead uses its equipment against third parties.
Since October 22–23, our sensors have been detecting a surge in malicious activity. Attacks on our decoys have risen from about 510,000 to about 825,000 per day—an increase of more than 60%—and the number of unique attacking IP addresses has grown by 40%. Several campaigns coincided in the same week behind this surge. This is the most revealing one.
What have Enthec’s honeypots detected?
A sudden spike in SNMP queries that appear to originate from hundreds of residential connections. This is the hallmark of an ongoing DDoS attack that uses exposed third-party devices as weapons.
One of our lures simulates an exposed piece of industrial equipment that responds to SNMP (Simple Network Management Protocol), the protocol printers, switches, routers, and industrial control systems use to report their status.
Until October 22, that decoy received a few dozen SNMP requests. Since October 23, it has been receiving up to 30,000 every six hours. And almost all of them are of the GetBulk type—the query that forces the device to return as much data as possible.
Who sends those requests?
What’s most striking isn’t the volume, but who is listed as the sender:
- 464 different IP addresses, mostly residential connections from major providers in the United States and Europe.
- Each one “attacks” all the sensors on the network at once, in bursts lasting between twenty minutes and a few hours, and then disappears.
- A large portion of the requests appear to originate from ports 53 or 80, which is not typical behavior for a home computer sending an SNMP query.
A home user doesn’t send tens of thousands of queries to industrial servers worldwide. Those IP addresses aren’t attackers—they’re victims.
What is a DDoS attack?
A DDoS attack—short for Distributed Denial of Service—is a cyberattack that tries to take down a website, server, or connection by flooding it with more traffic or requests than it can handle. It is called “distributed” because that traffic comes from many sources at once, making it difficult to block.
Depending on where they strike, DDoS attacks are typically grouped into three families:
- Volumetric: They flood the victim’s bandwidth. The campaign we’ve detected falls into this category.
- Protocol-based: These attacks exhaust the resources of network equipment such as firewalls or load balancers.
- Application-layer attacks: They mimic legitimate requests to crash a specific website or service.
How does the DDoS attack we’ve detected work?
This is a variant known as reflection and amplification, which we explain in detail in our article on the DrDoS attack. In summary:
- The attacker sends a small request to an exposed device but forges the source address by adding the victim’s address.
- The compromised device, which has no way of knowing this, sends the victim a response that is much larger than the request.
- If this is repeated with thousands of devices at once, the traffic reaching the victim is enough to bring down their connection.
What is the purpose of a DDoS attack?
The immediate goal of a DDoS attack is always the same: to disrupt a service, but the motivations behind it vary widely.
In the case we observed, short bursts targeting home internet connections are the hallmark of DDoS-for-hire services—known as “booters” or “stressers”—which are contracted by the hour to take a specific person offline, such as a rival in an online game.
In the business world, the most common motive is extortion: the attacker takes down a service—or threatens to—to demand payment in exchange for stopping the attack. Hacktivism is also common, with campaigns targeting organizations or companies for political or ideological reasons.
A less obvious but equally dangerous use is distraction. The attack keeps the security team occupied while another intrusion takes place in parallel—the one the attacker really wants.
As INCIBE points out, no organization is too small to be the target of a DDoS attack. And, as this campaign shows, no organization is too small to be part of one either.
Why does this DDoS attack affect your company even though it isn’t the target?
Because the attack traffic originates from their devices and their connection. A device with SNMP exposed to the Internet—whether it’s a printer, a switch, a video surveillance camera, or an industrial control system—is something someone can exploit. And the consequences aren’t limited to the victim:
- The traffic originates from the company’s IP address. Your connection appears in abuse reports, and it could end up on a blacklist, damaging your IP reputation.
- It consumes your own bandwidth, sometimes without anyone linking the slow performance to an attack.
- It reveals internal information: model, firmware version, device name, or network configuration. Attackers can use this data to prepare a subsequent attack against the company itself.
- It’s an indicator of security hygiene: if a device like this is exposed, it’s likely not the only one.
A poorly secured device is no longer just a risk in and of itself; it becomes an unwitting accomplice in attacks against third parties.
What should you check to ensure your devices don’t participate in a DDoS attack?
This type of exposure is rarely the result of a specific oversight. Inventories change, vendors install equipment, and some services are published by default. These are the most effective checks:
- Take inventory of the exposed surface: which devices are responding from the Internet and why. Often, devices appear that no one remembers having exposed outside the perimeter.
- Do not expose SNMP to the Internet: filter UDP port 161 at the perimeter and restrict access to management networks.
- Use SNMPv3 with authentication instead of versions 1 and 2c, especially if you retain default communities such as public.
- Apply anti-spoofing filtering (BCP 38) on your own network to prevent packets with forged source addresses from leaving the network.
- Review other exposed UDP services used for the same purpose (DNS, NTP, SSDP, or Memcached, among others) and include them in the hardening.
What is a honeypot, and why does it allow us to detect these campaigns early?
A honeypot is a decoy that simulates a real system exposed on the Internet without having any legitimate use. Since no one should connect to it, all the traffic it receives is, by definition, suspicious, and that makes it a reliable sensor for detecting malicious activity.
Enthec’s sensor network allows you to see these campaigns as they happen, not weeks later in a report. It’s the difference between reactive cybersecurity and proactive cybersecurity—understanding how attacks are carried out today so you can close the door before anyone uses it.
How to detect exposed devices before the attacker does with Kartos
This type of exposure isn’t visible from within the network; it’s visible from the outside, which is where the attacker is looking. Kartos, Enthec’s platform for managing the external attack surface, continuously identifies the assets and services that an organization has exposed on the Internet—including those that have been overlooked—so they can be shut down before anyone exploits them.
It is part of a continuous threat exposure management (CTEM) approach and was developed in Spain in accordance with European regulations.
Our honeypot network detects these campaigns as they unfold. Kartos lets you check whether your organization is part of the problem. Contact us to see what an attacker sees when looking at your company from the outside.
