WSD - Web Services Discovery via IP Multicast, UUNP - Univeral Plug and Play UPNP and SSDP - Simple Services Discovery Protocol are different names of the closely similar technology that allows connected home devices like Amazon Echo, Smart Light, Smart Thermostat, IP Camera and Smart TV to be identified by the home Wifi router with little to zero configuration. It is kinda like the Robot.TXT for Google crawler but for home local network.
If we send an UDP package to Port 1900 of 239.255.255.250, it returns the IP and services of smart TVs and if we send to port 3702, then it returns IP and services of the IP camera. So what is 239.255.255.250, a hidden botnet or a router feature ?
Even with the UPnP DISABLE inside the router setting, I will still be able to find the IP camera within the Wifi network by sending an XML package to 239.255.255.250:3702 and listen for UDP replies.
References
-
Universal Plug and Play - Universal Plug and Play (UPnP) is a set of protocols and technologies that allows devices to automatically discover and connect to each other.
-
Simple Service Discover Protocol - A Simple Service Discovery Protocol (SSDP) attack is a reflection-based distributed denial-of-service (DDoS) attack that exploits Universal Plug and Play (UPnP) networking protocols in order to send an amplified amount of traffic to a targeted victim, overwhelming the target’s infrastructure and taking their web resource offline
-
Administratively Scoped IP Multicast - The "administratively scoped IPv4 multicast space to be the range 239.0.0.0 to 239.255.255.255
