What is an SSDP amplification attack?
SSDP (Simple Service Discovery Protocol) is part of UPnP and lets devices on a network discover each other. An SSDP amplification attack abuses UPnP devices exposed to the internet (home routers, cameras, printers): the attacker sends discovery requests with the victim's spoofed IP and the devices reply with much larger packets, flooding the target.
Why are IoT devices the problem?
Millions of home devices have UPnP enabled and reachable from the internet due to insecure default settings. Each acts as a reflector and amplifier, with typical amplification factors around 30x, turning a small botnet into a sizable volumetric attack.
How to protect yourself?
Disable UPnP/SSDP on routers and devices that don't need it, block UDP port 1900 at the perimeter, and never expose discovery services to the internet. On the target side, edge anti-DDoS mitigation that filters the reflected traffic.
