Single-Packet DDoS: Inside the TP-240 Amplification Vector

Beginning in mid-February 2022, security researchers and network operators documented a new wave of UDP reflection/amplification DDoS attacks. The traffic originated from UDP port 10074 and targeted broadband access ISPs, financial institutions, logistics companies, and other verticals. The abused devices turned out to be Mitel MiCollab and MiVoice Business Express collaboration systems equipped with TP-240 VoIP processing interface cards — hardware whose primary role is providing Internet-based site-to-site voice connectivity for PBX systems.

Roughly 2,600 of these systems have been misprovisioned, leaving an unauthenticated system test facility exposed to the public Internet. Attackers have leveraged this exposure to turn the PBX VoIP gateways into DDoS reflectors/amplifiers. Mitel has been working with customers to deploy patched software that disables public access to the test facility.

This research is a cooperative effort among Akamai SIRT, Cloudflare, Lumen Black Lotus Labs, NETSCOUT ASERT, TELUS, Team Cymru, and The Shadowserver Foundation.

An Attack Vector With an Unusual Amplification Profile

Observed attacks were primarily packets-per-second (pps) floods, appearing as UDP reflection/amplification traffic sourced from UDP/10074 and directed mainly at destination ports UDP/80 and UDP/443. The largest previously recorded attack of this type reached roughly 53 Mpps and 23 Gbps, with an average packet size of about 60 bytes and a duration of approximately five minutes. The amplified attack packets are not fragmented.

This vector differs from most UDP reflection/amplification methods in a fundamental way: the exposed system test facility can be abused to launch a sustained DDoS attack of up to 14 hours duration from a single spoofed attack initiation packet. This yields a record-setting packet amplification ratio of 4,294,967,296:1. In controlled lab testing, the vector produced more than 400 Mpps of sustained attack traffic.

This single-packet initiation capability effectively precludes network operator traceback of the spoofed initiator traffic, masking the attack generation infrastructure and making origin attribution far more difficult than with other UDP reflection/amplification vectors.

How tp240dvr Is Abused

The abused service, tp240dvr ("TP-240 driver"), runs as a software bridge facilitating interactions with TDM/VoIP PCI interface cards. It listens for commands on UDP/10074 and is not intended for Internet exposure, per the device manufacturer. That exposure is exactly what allows the abuse.

The service exposes an unusual command designed to stress-test clients for debugging and performance testing purposes. Abusing this command causes the service to send the stress-test traffic to attack victims — a high rate of short status update packets that can overwhelm target networks. Attackers can also use specially crafted commands to make the service send larger status packets, significantly increasing the amplification ratio.

In lab testing against isolated virtual TP-240 systems, researchers caused devices to generate massive traffic volumes in response to comparatively small request payloads.

The Numbers Behind a Single Packet

Most reflection/amplification attacks require the attacker to continuously transmit malicious payloads to abusable nodes for the duration of the attack. TP-240 reflection/amplification requires no such continuous transmission. Examination of the tp240dvr binary shows that, by design, an attacker can theoretically cause the service to emit 2,147,483,647 responses to a single malicious command. Each response generates two packets on the wire, for approximately 4,294,967,294 amplified packets directed at the victim.

For each response, the first packet contains a counter that increments with each sent response; its size grows from 36 to 45 bytes as the counter value increases. The second packet carries diagnostic output from the function, which the attacker can influence. By optimizing each initiator packet to maximize the size of the second packet, attackers can produce amplified packets up to 1,184 bytes in length.

The theoretical upper bound is stark:

  • A single abusable node generating 4,294,967,294 packets at 80 kpps would sustain an attack for roughly 14 hours.
  • Counter packets alone would generate roughly 95.5 GB of amplified attack traffic.
  • Maximally padded diagnostic output packets would add another 2.5 TB of traffic.
  • The resulting sustained flood would approach 393 Mb/sec from a single reflector/amplifier.

All of this traffic follows from a single spoofed initiator packet of only 1,119 bytes — producing an amplification ratio of 2,200,288,816:1, triggered by one packet.

Constraints on Attack Scale

The tp240dvr service processes commands with a single thread, meaning it can only handle one command at a time and can only launch an attack against one target at a time. During a 14-hour attack, an abused device cannot be leveraged against any other victim — a somewhat unique characteristic among reflection/amplification vectors.

While this limitation makes the service unavailable to legitimate users during an attack, it also prevents the devices from being shared among multiple attackers simultaneously. Furthermore, the devices run on relatively low-powered hardware in terms of traffic-generation capability. On an Internet where 100 Gbps links and multi-core, multi-threaded servers are commonplace, the fact that these systems cannot individually generate millions of packets per second is a meaningful mitigating factor.

Of the tens of thousands of these devices deployed historically by governments, commercial enterprises, and other organizations worldwide, only a small fraction are configured in an abusable state — and many of those have already been secured or taken offline.

Collateral Impact and What Operators Should Do

For organizations running Internet-exposed Mitel MiCollab or MiVoice Business Express systems, collateral impact may include partial or full interruption of voice communications, plus additional service disruption from transit capacity consumption and state-table exhaustion of NATs and stateful firewalls.

Wholesale filtering of all UDP/10074-sourced traffic is contraindicated, as it may overblock legitimate Internet traffic. However, standard DDoS defense tools can detect, classify, trace, and mitigate TP-240 attacks:

  • Flow telemetry and packet capture can alert operators to active attacks.
  • ACLs, flowspec, D/RTBH, S/RTBH, and intelligent DDoS mitigation systems can be used for mitigation.
  • Network operators should perform reconnaissance to identify abusable TP-240 reflectors on their networks or their customers' networks.
  • Operators of affected Mitel systems should contact the vendor for specific remediation instructions.

Operators should also implement ingress and egress source address validation to prevent attackers from spoofing initiator packets, and ensure all DDoS mitigation measures are tested in a situationally appropriate manner before deployment on production networks.

Mitigation for Device Operators

Operators of Internet-exposed TP-240 systems can prevent abuse by blocking incoming Internet traffic destined for UDP/10074 via ACLs, firewall rules, and standard network access control policies. Mitel has released patched software versions that prevent TP-240-equipped systems from being abused by disabling public exposure of the service; customers should contact the vendor for remediation instructions.

Additional steps include removing affected systems from DMZ networks or Internet data centers, and disabling UDP port-forwarding rules that allow public Internet traffic to reach UDP/10074. Since the amplified traffic is not fragmented, there is no additional attack component of non-initial fragments as seen with some other UDP reflection/amplification vectors.

This scenario is another example of real-world deployments not adhering to vendor guidance. Vendors can prevent such situations by adopting "safe by default" postures on devices before shipping. More broadly, reflection/amplification attacks would be impossible to launch if all network operators implemented ingress and egress source address validation — the ability to spoof a target's IP address is a prerequisite for these attacks. Service providers must implement SAV in their own networks and require downstream customers to do the same.

As with many newer DDoS vectors, TP-240 reflection/amplification has moved from advanced attackers with bespoke infrastructure into the arsenals of "booter/stresser" DDoS-for-hire services, making it available to the broader attacker population. The rapid response to this vector — including the collaboration among the research task force and Mitel's swift creation and dissemination of patched software — demonstrates that cross-industry cooperation is increasingly critical for the continued viability of the global Internet.