Critically Underrated: Studying the Data Distribution Service (DDS) Protocol

Table 1. A list of all DDS implementations analyzed for this research.

Table 2. A summary of our findings across the main DDS implementations and standard specification.

When the security gaps on the network attack surface are exploited, it allows an attacker to perform spoofing, reconnaissance, automated data collection, and denial of service (DoS), affecting the control of an exposed system. Meanwhile, the vulnerabilities we found on the configuration attack surface can be abused to affect the DDS developer or system integrator, potentially compromising the integrity of the software supply chain.

Vulnerabilities in the standard specification

The built-in RTPS discovery protocol is used in peer-to-peer networks to discover the locator of each participant (such as IP address and UDP/TCP port or offset in shared memory). The "chatty" nature of this discovery protocol and the fact that it expects a reply from each contacted participant, paired with easy-to-spoof transport protocols such as the User Datagram Protocol (UDP), make RTPS vulnerable to network reflection and amplification. Confidentiality and authenticity for this data is not protected even with DDS Security, making it possible for an attacker to spoof the information.

Table 3. The network reflection and amplification vulnerability with bandwidth amplification factor (BAF) is calculated as the ratio between outbound and reflected traffic.

Note: Implementations with less than 100% attack duration likely have a timeout mechanism. (*) A full mitigation will require relevant changes in the RTPS specification.

The longest running node was based on Connext DDS (at 139 seconds), which we kept as a reference. Table 3 shows that the BAF is greater than one, implying there are asymmetric network flows although the values are at the order of magnitude lower than modern amplification attacks (note that Memcached can reach 10,000 to 51,000 BAF). However, the network bandwidth in embedded systems is also lower than, for example, what internet nodes can provide.

An attacker can abuse this built-in discovery feature for remote discovery and fingerprinting. We sent RPTS discovery probes to the entire IPv4 space (except for the no-scan subnets) and received answers from 643 hosts (excluding obvious honeypots). Notably, hosts never stopped sending traffic to us, even if we only sent them a single 288-byte packet.

This new network-reflection vulnerability that we found is not the only instance of a specification-level vulnerability. Security researchers from different organizations have been documenting and creating attack scenarios abusing these vulnerabilities as early as 2015.

Conclusion

Proper supply chain management processes allow contextualization, tracking, and monitoring of new vulnerabilities within different downstream software using a specific library such as DDS. In the case of this middleware technology, DDS is just one of the many critical libraries used in embedded applications that's easy to lose track of. Our paper, "A Security Analysis of the Data Distribution Service (DDS) Protocol," includes short- and long-term mitigation best practices and recommendations, as well as a consideration for adopting a shift-left approach.

We also acknowledge the cooperation and engaging response that some vendors like ADLINK have adopted when we approached them with our findings. As we encourage more DDS researchers, users, and implementors to keep on studying and promoting security awareness for the DDS ecosystem, we hope the level of engagement we received can serve as a model for the software industry.

Download our full paper here.