# "PHMGMT" Powerhouse Management, Inc - VyprVPN and Outfox

## Port: **20811**

## Proto: **UDP**

## Data Amplification factor: **~40x**

## Packet Amplification factor: **1-50x**

## Effective Amplification Average: **366x**

## Reflector count: **~1,520** (Feb 2021)

---

### Patching has been [rolled out by Powerhouse](https://www.vyprvpn.com/blog/vyprvpns-response-to-article-on-server-bug)

Updated scan result 2021-02-25 yields **no reflectors left active**! Well done.

---

Powerhouse Management products - either Outfox (a latency reduction VPN service) or VyprVPN (a general vpn service) are exposing an interesting port - port 20811 which provides a massive data and packet amplification factor when probed with any single byte request.

Not only does this mean Powerhouse servers can be used as a DDoS amplification source, but reveals all servers around the world that are running such potential VPN services - which removes the privacy factor somewhat.

In testing, Powerhouse Management ISP owned servers were not present on Shodan at all, however responded to our probes with varying degrees of amplification. All response IP's had the hostname of `"undefined.hostname.localhost"`

* Packet amplification = **1 : 1-50**
  * Very unstable, sometimes no response at all (not a rate limit)
  * Average was 9 packets across 100 test IPs
* Data amplification average = **~40x**
* Multi-packet average effective amplification = **366x**
  * *NTP vibes anyone?*

### Example Requests / Responses

* Request: **1 data bytes**

  * ASCII: `[NULLBYTE]`

  * `> ~# echo -ne '\x00'|nc -u 128.90.242.100 20811 -w2|xxd -p`

* Response: **One packet Avg 1030 bytes (multi-packet)**

  * ASCII character space:

    ```
    aA\a8\83RL\a4\02\c3}\1d \98\b4\f0 E\c4\86\95\e2\9e\d7\d7\a9\11\a6\00\99\fa-P\de\a9\ee\e6\f6\c8\de^\df4s\06\d9\10\d0\b3i \adi\91Z\88\a4\b8\f5d\ba\9a\eeb!q\a0t\c0\e1z\12\d7\be\01\7f\89XL\a0\f3R\8d4\cf\00\d5\87\0f\c4\ff\e1\tC\ac@\ee\f4\15\e6Rv\a7\85\cbbb\b4$\a3\bc\c6\16Vs%g\92l\1b\ef#\c1\82Z\bd\be\d4\81\ae\b4\cd\06X\c0\81/T\bf\8b\8c\01x\81f9fl-\de\f0T\1d\d9\fa"G\e5\cej\82\1f\b1\82\17\17\f0\ea\0b\15\f6\01MR\95e\f43\c1\e3,\c0\047dX\dd\99\8b\88\e0\b2\ea$~\96\85\e9k\86\90b\11"\bf\b7X|T\19\d54\ae\1a\f9K\90\94\c6 2\1e\f2m\da\db\ea\00Q\92\c9\06V6cX\91\93\b4\e1\e9?(\f3%\87\1dcFs\7f\bc\18\01\e9\e0;5\b3Hb9_\95\c9\d2\bd\ae\e5\e4SEI/\bb\f3\0c\t\c0}\af\ac\c9J\c5\bdNU\f5\f8\ac\bb\87\d4\a9\c6*\f5!\e2U\bb=\c7\aaa.\b9\9c\a4fT\d2\b9\c6\a5\ba\8c\c1]\1f\t%\n\c6\d1\a1\aeh-\d7\da\dd\f4\d5\bc\cf"\ea=4.OQ\b6\91\c7#J\14\a982W}\01\ca'Z4\df\ce"X\cf\98\f4\b2/\c8i\b58sY$r\c8\8d\d7\92\b7-j\d8*|\a4XB\fbV\03-\d8\f04\9a+\b8\bc\d1\ed\e0\86L\8fA\03\aa\d0\84+\d1sP\dc\d7p=*\cb,a\d0-\7f\1cm%\0f\f3<\fe\ec.\rv.\16\f6\n\r[\aa\17d\f2\f8p[\f0h\a2\9f\d4R=\fe\8b\01<H_\8e{=\f1\ff\f6$@'{$2\0eK\1e%\8a64&\ea\t)\88\b0W+\ab\ca\d1G\03\dc\06\e0\03k\19\c2\0b]\a7\00'b"\abv\d1|\b0\ac\cds\13\a6\8eV\c4p\a3\d7\d0\fa\bc\d1\06\een\fd-H\da\d5k\a4Rw\fb\81\c3|R}\da\d0\1at\82O\80\f1hE}\f8\08\ce\18W\aa\d2m\94R\b7\ddv\cem\ffF\e6\a8\8a\b3~]b\82F\f8\c9!\d0\d7i\dc\d51\c5\c3,\ffK\9f\aa\cah[i\8dh,4\fe\e6z\1c3\c62\f9!\9f\06\a5\8a\ae\bf\c8\c3\e5\b9\12\1fM\c0\b4&\1f*\9d\a5Y\a5\d7\af\ba|\d6\8fA\\8\83\f0\95g\d9"\84R\da\f9\d9\9f\e8\96\b73\7fp\ee\0e_+0HeKO\19\afK=\df\94\cd\0b6\r\b02\1da\95m\b9[w\cb=(\r9\9a\dbp\c42\a1$Z\db\14\0c\89\e1f+\bb9(\e8yQB>\d0\cclfs5:Y|\ba\02\a4!\b6\ab\1a\bf\f5IK\c2\e9\06]\ec?\ad\05\af\84\e9O\93\f1\c5\b2]\16p4Z\cc9\a5B\c3N\bab\02cF\eaHD\f7\cf\d7?\c0\02.\92\8c|0\de^\af\06_h\b7o\c7\f5O'\9f\80Z\87N\d1\10\90\1a\18\0f% \8f\1d\c5:\89\85>h\17-S\d3\8c7\9dR\9a\b8LLg\a3\f8\d4\87\16\dd\00\8e\88\a4\a1iX\93c\b7\c7\18\cc\87\df\a6\e73\ef\c4\a2\c2\a0\0fG\d1\1c\d7H\d8\8c\cbH\a2<\c4kp\f3\ed\b0\11\9c\0f;\dc\7f\bcu\16]\eaD|Q\0f\b8\t\81\08).vOw\c8\dd\9f\a3\bb4/\aep\81\cfI\04\a4\e2S\83}*\fe\83\80\11\b3@\8e\e7\e2(\c6b\95p\1e\8d\dd\c1W\df4S\9c\ab\02\d5\b3\8fg\c8\0c\ee\ebp\99\e7\98\af\e1x}\8d=\e3\e9\e7\81\94\8a\1e\11S\f9\fe'\d2d\rY\b7j6M\ce#,\b3\0f\b0\t\19ZL\b7X\b5\12\c6\ea5]\b0\02\adU\dd\a02\a0\c5\94\aa/\e8\0e/p\e2>\efE\ccO:\c4a\a9\ee\cfC\d4\b0\aeTc-\84YDl\e2w\c9\e0w\b9\1c^\93(\1b\db\f5\0f\a4\ea\af\89t-ADL\a67\95SS\0f\b4\99&\b7{\ba\ce\\L\f4\85\c4\1c\fb[\1c\93\e8\19qv8\a2\8b\n\bd\163X\cb\00/\bc\ee8\8bv\b2\14\ed\b3:5\f8\1e\84M\a6C\85k\19\ec\d04,Q\e5\15Ct\1c\0b;\d5\01(\deR\a3\fa\ef5B\a9\a3tJ\b6\b3\87sQ\83\16\92\e9\da [)\1b0R\t\ad^y\e2\bd\e5R\bbx\b9;\1e\10\n\fd*zQ\df\e9\d8\c7\19\14\ac\c1\9f4\fcnq\19\98\e7[~\d1(i\d1\9c&kN\f2\c5k5\cf0Vl\85\c5j\t\dd\03(\11\04\nG\bf\82\a2\8b\88\c1#\ff88\cbp\ce>#\ce\c2\b4\0e\87\c8\9b\13{\82g(*\14\ca\ffl0\cb\d1x\b8(\dd\d3\90\ee\ad\e5\f9\04\16
    ```

  * Raw bytes (example only because data is random - probably encrypted): 

    ```
     
    ```

### Documentation

* Powerhouse Management Brands list: <https://www.phmgmt.com/#full-width-organism-3601>
* AS21926 Same Address as Powerhouse: <https://ipinfo.io/AS21926>
* AS22363 Powerhouse Inc and "Unus, Inc": <https://ipinfo.io/AS22363>

### Mitigations

* Attempt to get in contact with powerhouse to patch this intended or unintentional port leak.
* Block ranges associated with Powerhouse AS if under attack by this method, 128.90.0.0/16 is the most egregious reflector range.
* Block srcport 20811 as it is not assigned with IANA.
