CoAP: 2,188,380 answers for a protocol designed to be spoken to by anything

CoAP, also known as the Constrained Application Protocol, is a standardised protocol for devices such as sensors, meters, and building controllers. It is designed for devices that cannot handle TLS handshakes or verbose headers. CoAP uses UDP port 5683 and does not require a connection handshake or a banner, distinguishing it from port-only queries.

The protocol uses multicast capability, allowing a single request to a group to be answered by every device in it. However, CoAP has no built-in authentication, relying on optional security measures like OSCORE and DTLS. The discovery resource, defined as /.well-known/core, is used for device enumeration and can reveal the full interface list of a device without requiring any credentials.

This makes it a potential security risk as it allows an arbitrary source to access the full interface list of a device. The 2,188,380 figure represents the number of devices that answered a CoAP protocol probe, indicating that a large number of constrained devices are reachable at the network layer by something other than their intended client.

To mitigate this risk, query your own address space for devices using CoAP and check their /.well-known/core resources to understand what the device exposes. If the device only speaks plain CoAP on a routable network, it lacks confidentiality for its commands. Finally, identify the vendor and firmware from the CoAP response options and look for vendor guidance on OSCORE support and disabling multicast responses.