SLP DoS Amplification: Someone Is Having Fun

The talk looks at the Service Location Protocol (SLP), a UDP service on port 427 that was never designed to face the internet. Pedro Umbelino describes how tens of thousands of exposed SLP devices were found in early February, spanning hypervisors, printers, RAID controllers and management boards across many sectors and regions. A coordinated disclosure with vendors followed, and the number of exposed instances has since dropped, though many remain online.

The core concern is reflective amplification. A small spoofed request can trigger a much larger reply aimed at a victim, and SLP is currently the strongest amplifier of this kind among available options. The attack has two stages: an attacker first primes vulnerable servers by filling their caches, then spoofs the victim's address so the primed servers flood it. Without internet-scale traffic visibility, the researchers re-scanned known reflectors and read their memory to see whether any were being primed.

That monitoring surfaced steady activity. Around 300 servers were primed in May, activity continued through September, and by October more than 5,000 reflectors had been primed, apparently with a custom tool rather than the public open-source one. No large attacks had been reported at the time. The practical takeaway is that tracking reflector priming can act as an early-warning signal, and the speaker briefly noted other possible abuses of primed servers, such as transient data storage and command-and-control.