Cloudflare has confirmed that it is actively detecting and mitigating traffic associated with the Model Context Protocol (MCP), a new protocol identified as being used in large-scale distributed denial-of-service (DDoS) attacks. The company's security systems are designed to identify and neutralize these attacks, which leverage a novel method of amplification.
The MCP protocol is utilized by an attacker-controlled botnet to generate significant traffic volumes. This botnet consists of numerous compromised servers, which Cloudflare refers to as "bots." These bots are responsible for sending the malicious MCP requests that target victim servers.
The attacks exploit vulnerabilities within the HTTP/2 protocol, specifically CVE-2023-44487, also known as the "Rapid Reset" vulnerability. This vulnerability allows attackers to rapidly reset HTTP/2 streams, overwhelming servers with connection requests and leading to service disruption. Cloudflare's mitigation efforts focus on identifying and blocking these rapid reset attempts and the associated MCP traffic.
Cloudflare's security infrastructure, including its global network and advanced threat detection systems, plays a crucial role in defending against these attacks. The company's approach involves analyzing traffic patterns, identifying the unique characteristics of MCP requests, and implementing countermeasures to filter out malicious traffic before it reaches customer origins. This includes leveraging its Cloudflare One platform, which integrates various security services to provide comprehensive protection.
The emergence of MCP highlights the evolving landscape of DDoS attacks, with attackers continuously developing new protocols and techniques to bypass existing defenses. Cloudflare's ongoing research and development efforts are focused on staying ahead of these threats, ensuring the resilience of its network and the security of its customers' online services. The company emphasizes the importance of a multi-layered security strategy to combat sophisticated attacks like those utilizing MCP.
