3 ms·
>Layer 7 (“400 Bad Request”) attacks toward our public-facing websites I really wonder what that is supposed to mean, Linode has mentioned it multiple times bu
by ryanlol 11y ago
>Layer 7 (“400 Bad Request”) attacks toward our public-facing websites
I really wonder what that is supposed to mean, Linode has mentioned it multiple times but not elaborated on what sort of an attack this is.
I personally haven't ever head of a "400 bad request"-attack.
Edit: Yeah, I know what Layer 7 floods are :), but I'm pretty sure "400 bad request" floods are something Linode came up with, so that could use some elaboration by them.
- spdustin 11y agoPerhaps they're saying: an attack on OSI Layer 7 (web apps themselves) that result in users receiving HTTP 400 status codes in response to their requests. OSI Layer 7 would actually refer to all "applications", but the mention of "400 Bad Request" implies specifically web applications were affected.
- fweespeech 11y agohttps://www.trustwave.com/Resources/SpiderLabs-Blog/(Updated)-ModSecurity-Advanced-Topic-of-the-Week--Mitigating-Slow-HTTP-DoS-Attacks/ https://www.trustwave.com/Resources/SpiderLabs-Blog/(Updated... My guess is strategies like this but it isn't clear. [e.g. Requests designed to slow/increase the processing per-request to create a log jam at the web application level ]
- sandstrom 11y agoI think it's just another name for Layer 7 DDOS. I.e. crafted HTML-requests, designed to be 'expensive' to compute/process.
- guelo 11y agoRight, it seems pretty clear to me.
- ryanlol 11y agoThere's a lot of different types of Layer 7 attacks, what sort of a payload is a "400 bad request"?
- guelo 11y agoAny HTTP request that causes the webserver to respond with HTTP status 400?
- ryanlol 11y agoBut that's not descriptive at all.
- guelo 11y agoTo me what it means is that the attacker figured out some custom call to the application that is probably expensive for the app to deal with and can easily cause a denial of service.
- ryanlol 11y agoIt'd be pretty rare for the application to return error 400, generally that's something that the server would be spitting out when it fails to parse the HTTP request.
- guelo 11y agoThat could suggest random urls. But it could be anything really depending on the app. I'm coming around to your pov that it is not descriptive. Something about the layer 7 flood was causing the app to respond with 400s and that's what Linode started calling it. But it doesn't help us understand anything about it.
- ryanlol 11y agoIt wouldn't suggest a flood of random urls, error 400 is generally a response from the webserver when it receives a request it can't understand (e.g not HTTP). A request like that would never hit the web application as the server wouldn't know what to do with it. see: echo ":P"|nc linode.com 80 <html> <head><title>400 Bad Request</title></head> <body bgcolor="white"> <center><h1>400 Bad Request</h1></center> <hr><center>nginx</center> </body> </html>