QUICsand: Quantifying QUIC Reconnaissance Scans and DoS Flooding Events

TL;DR

This paper presents initial measurements of QUIC protocol background radiation, revealing its susceptibility to resource exhaustion attacks similar to TCP SYN floods, with evidence of active exploitation and multi-vector attack scenarios.

Contribution

First measurement study of QUIC background radiation, highlighting its vulnerability to resource exhaustion attacks and documenting active exploitation in the wild.

Findings

Average of four QUIC floods per hour on the Internet.

Half of the QUIC floods occur alongside other attack types.

Research projects dominate QUIC scanning activity.

Abstract

In this paper, we present first measurements of Internet background radiation originating from the emerging transport protocol QUIC. Our analysis is based on the UCSD network telescope, correlated with active measurements. We find that research projects dominate the QUIC scanning ecosystem but also discover traffic from non-benign sources. We argue that although QUIC has been carefully designed to restrict reflective amplification attacks, the QUIC handshake is prone to resource exhaustion attacks, similar to TCP SYN floods. We confirm this conjecture by showing how this attack vector is already exploited in multi-vector attacks: On average, the Internet is exposed to four QUIC floods per hour and half of these attacks occur concurrently with other common attack types such as TCP/ICMP floods.