3 ms·
If I happened to find a 0day RCE, what stops me from being mean and using the sites I compromise to DDoS the update servers?
by ryanlol 10y ago
If I happened to find a 0day RCE, what stops me from being mean and using the sites I compromise to DDoS the update servers?
- CiPHPerCoder 10y agoNothing, to be truthful. Nothing stops you from being mean and using a pre-existing botnet to DDoS the update servers, either. Let's say you manage to pop the WordPress update server and turn every WordPress website on the Internet into a DoS bot. That's 25% of websites, and most likely a large cross-section of all available servers. There are very few networks that could possibly shoulder that traffic, and I certainly don't have the budget for it right now.
- ryanlol 10y agoThis is relatively easy to account for though, if updates are properly authenticated it shouldn't be much of a problem to host them in multiple locations. DDoSing s3 and competition can be excessively difficult and not every update needs to be served from there.