300K Internet Hosts at Risk for 'Devastating' Loop DoS Attack

Researchers at CISPA discovered "loop DoS," a novel application-layer denial-of-service technique that pairs UDP-based services so they repeatedly reply to each other indefinitely, producing large volumes of traffic that can exhaust bandwidth or compute resources. The report details four attack scenarios (targeting single servers, backbone networks, congesting specific links, and self-amplifying loops), identifies affected legacy and common UDP services (DNS, NTP, TFTP, Daytime, Chargen, Echo, QOTD), notes the attack can be initiated by a single spoofing-capable host and may affect hundreds of thousands of hosts, and recommends mitigations including patching vulnerable services, restricting UDP, using TCP with authentication, and limiting host-to-host communication.