What are the features of CoAP protocol?
CoAP has the following main features:
- Constrained web protocol fulfilling M2M requirements.
- UDP binding with optional reliability supporting unicast and multicast requests.
- Asynchronous message exchanges.
- Low header overhead and parsing complexity.
- URI and Content-type support.
- Simple proxy and caching capabilities.
What type of protocol is CoAP?
COAP uses UDP as the underlying network protocol. COAP is basically a client-server IoT protocol where the client makes a request and the server sends back a response as it happens in HTTP.
How is the CoAP protocol susceptible to DDoS attacks?
But just like any other UDP-based protocol, CoAP is inherently susceptible to IP address spoofing and packet amplification, the two major factors that enable the amplification of a DDoS attack. An attacker can send a small UDP packet to a CoAP client (an IoT device), and the client would respond with a much larger packet.
How does CoAP attack work in the wild?
As with any reflection/amplification attack, attackers begin by scanning for abusable addresses, then launch a flood of packets spoofed with the source address of their target. Using our honeypot collection, ASERT has been tracking low-levels of scanning, but only recently have observed a series of attacks utilizing CoAP.
What’s the average amplification factor for CoAP attacks?
Scanning activity has remained relatively constant, but January 2019 saw an increase in the number of DDoS attacks utilizing CoAP. The average amplification factor for CoAP is 34, in the midrange for UDP protocols commonly abused for reflection/amplification.
Are there security features in the CoAP protocol?
The people who designed CoAP added security features to prevent these types of issues, but as Cloudflare pointed out in a blog post last year, if device makers implement these CoAP security features, the CoAP protocol isn’t so light anymore, negating all the benefits of a lightweight protocol.