The AI Agent Prevention Society

One of the obstacles to AI agents becoming all powerful is the technology infrastructure that actively seeks to obstruct agents.

This technology has various names, one being WAF, or web application firewall.  

The purpose of a WAF is to stop web applications from common attacks. 

Recall the OWASP Top Ten Risks? Some of the motivation behind these protections are good - for example, guarding against bot-driven DDoS attacks.

There are various vendors and products in this space; such as Imperva WAF, Cloudflare, Akamai Site Defender, AWS WAF, Azure Web Application Firewall and Google Cloud Armor.

These solutions are all effective at detecting and blocking agents, headless browsers, scrapers, credential stuffing bots (where leaked usernames and passwords are used across numerous websites to exploit potential duplication) and automated (even if legitimate) login attempts.

Action taken could range from limiting requests based on IP, presenting CAPTCHA challenges and blocking certain geographies.  However, these actions may prevent legitimate bots from using required services, or performing agentic actions on behalf of legitimate users.

SSDP (Simple Service Discovery Protocol)

You may have encountered SSDP (Simple Service Discovery Protocol) in the context of the Services tab in Task Manager in the form of SSDPSRV (SSDP Discovery Service). 

It is a HTTPU (HTTP UDP) text based protocol i.e. relies on UDP underneath.

The SSDP protocol can discover Plug and Play devices, with uPnP (Universal Plug and Play).

The SSDP protocol has been found to be used in DDoS attacks also known as SSDP Reflection Attack with Amplification.

Vulnerabilities also arise from widespread proliferation of certain open source libraries e.g. pupnp.

TCP for Windows Hackers (And a bit of TCP History)

A TCP connection is half-open when the station at one end of the connection has crashed or otherwise removed the socket without informing the other end.
An embryonic connection is a TCP connection which is in the process of being established.

In UDP you can just start sending packets, whereas in TCP, you need to establish a connection before you send packets. Establishing a connection in TCP is done via a three-way handshake: client sends SYN, server sends SYN-ACK, then client sends ACK back to the server. At this point, client and server both have an acknowledgement of the connection.

Another difference between TCP and UDP is retransmission of lost packets.

The big names in packet network protocols are "Father of the Internet" Vint Cerf and Bob Kahn (PhD Princeton). In 1974 they published an IEEE paper: "A Protocol for Packet Network Interconnection". A central part of this protocol was the Transmission Control Program, later to evoive into TCP.

Need to understand TCP connections well to understand DOS and DDOS attacks.