QUICsand: Quantifying QUIC Reconnaissance Scans and DoS Flooding Events

Abstract

In this paper, we present first measurements of Internet background radiation originating from the emerging transport protocol QUIC. Our analysis is based on the UCSD network telescope, correlated with active measurements. We find that research projects dominate the QUIC scanning ecosystem but also discover traffic from non-benign sources. We argue that although QUIC has been carefully designed to restrict reflective amplification attacks, the QUIC handshake is prone to resource exhaustion attacks, similar to TCP SYN floods. We confirm this conjecture by showing how this attack vector is already exploited in multi-vector attacks: On average, the Internet is exposed to four QUIC floods per hour and half of these attacks occur concurrently with other common attack types such as TCP/ICMP floods.

arXiv commentProc. of ACM IMC'21, camera-ready

References in corpus (2)

• A First Look at QUIC in the Wild
• Observing the Evolution of QUIC Implementations

Cited by in corpus (7)

• QUIC is not Quick Enough over Fast Internet
• The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments
• On the Interplay between TLS Certificates and QUIC Performance
• QUIC Hunter: Finding QUIC Deployments and Identifying Server Libraries Across the Internet
• SoK: A Data-driven View on Methods to Detect Reflective Amplification DDoS Attacks Using Honeypots
• ReACKed QUICer: Measuring the Performance of Instant Acknowledgments in QUIC Handshakes
• Waiting for QUIC: Passive Measurements to Understand QUIC Deployments