CoAP
CoAP (Constrained Application Protocol, RFC 7252) is a lightweight, RESTful protocol built for low-power IoT and sensor devices, modeled on HTTP's GET/PUT/POST methods but running over UDP for a much smaller footprint than a full HTTP/TCP stack. It supports an optional encrypted and authenticated mode, DTLS, but ships and is frequently deployed without it enabled. Because CoAP runs over UDP and a small request to its resource-discovery endpoint can trigger a disproportionately large response, an exposed CoAP service is attractive for DDoS amplification attacks -- an attacker spoofs a victim's IP as the source and lets the amplified responses flood that victim, a pattern researchers have documented at scale since 2019, with hundreds of thousands of exposed devices found in internet-wide scans. The device itself can also be at risk, independent of its use in an attack on someone else.
By AdminKit team, Netbase JSC · Updated