QUICsand: Quantifying QUIC Reconnaissance Scans and DoS Flooding Events
This work addresses security vulnerabilities in the emerging QUIC protocol for network operators and researchers, though it is incremental as it builds on known TCP SYN flood concepts.
The paper tackled the problem of measuring and analyzing Internet background radiation from the QUIC transport protocol, finding that research projects dominate QUIC scanning but non-benign sources exist, and it confirmed that QUIC is prone to resource exhaustion attacks with an average of four QUIC floods per hour on the Internet.
In this paper, we present first measurements of Internet background radiation originating from the emerging transport protocol QUIC. Our analysis is based on the UCSD network telescope, correlated with active measurements. We find that research projects dominate the QUIC scanning ecosystem but also discover traffic from non-benign sources. We argue that although QUIC has been carefully designed to restrict reflective amplification attacks, the QUIC handshake is prone to resource exhaustion attacks, similar to TCP SYN floods. We confirm this conjecture by showing how this attack vector is already exploited in multi-vector attacks: On average, the Internet is exposed to four QUIC floods per hour and half of these attacks occur concurrently with other common attack types such as TCP/ICMP floods.