4 ms·

I still feel like I'm missing something, because it sounds like "If an attacker can rewrite your configuration inside CDN, bad things will happen." I mean, Via

I still feel like I'm missing something, because it sounds like "If an attacker can rewrite your configuration inside CDN, bad things will happen." I mean, Via might be useful as a safety check against mistake, but I'm not getting the security angle.

jessaustin 8y ago
The threat is a DOS against a group of CDNs as a whole. Particular CDN customers are only vulnerable to the extent that they require an affected CDN's services. If the CF link isn't clear, click through to the paper they reference: http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf
- dingaling 8y ago
  But that's all delicately balanced on trusting the Via headers. If you are under attack from someone malicious then that seems unwise. It's like relying on the From: header in an e-mail.
  - AstralStorm 8y ago
    The proper check is in routing tables and/or firewalls.
  - parenthephobia 8y ago
    > If you are under attack If. Much, if not most, server software is written under the implicit assumption that it will not be under attack.
    - deleted 8y ago
      [deleted]
  - jessaustin 8y ago
    If other CDNs are removing your Via header, then other CDNs are the adversary, but now we're in Crazy Town because in that case they are DOSing themselves as much as they are DOSing you. The threat discussed here is from malicious CDN customers.
  - meowface 8y ago
    But these particular Via headers are applied by the CDNs, not by an end user.
  - zaarn 8y ago
    That's not the point here. It's an adversary getting two CDNs to loop eachother and launching an attack that way. If CDN A proxies requests to CDN B and CDN B proxies requests to CDN A then those two will DoS eachother fairly quickly. There is no attacker inbetween to strip the Via, that would be counterproductive to the attack. Email has this too; the Received: header. If you manage to get a loop between two MTAs going they will detect it by seeing themselves in the Received: header list.

jessaustin 8y ago

The threat is a DOS against a group of CDNs as a whole. Particular CDN customers are only vulnerable to the extent that they require an affected CDN's services. If the CF link isn't clear, click through to the paper they reference: http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf http://www.icir.org/vern/papers/cdn-loops.NDSS16.pdf

dingaling 8y ago
But that's all delicately balanced on trusting the Via headers. If you are under attack from someone malicious then that seems unwise. It's like relying on the From: header in an e-mail.
- AstralStorm 8y ago
  The proper check is in routing tables and/or firewalls.
- parenthephobia 8y ago
  > If you are under attack If. Much, if not most, server software is written under the implicit assumption that it will not be under attack.
  - deleted 8y ago
    [deleted]
- jessaustin 8y ago
  If other CDNs are removing your Via header, then other CDNs are the adversary, but now we're in Crazy Town because in that case they are DOSing themselves as much as they are DOSing you. The threat discussed here is from malicious CDN customers.
- meowface 8y ago
  But these particular Via headers are applied by the CDNs, not by an end user.
- zaarn 8y ago
  That's not the point here. It's an adversary getting two CDNs to loop eachother and launching an attack that way. If CDN A proxies requests to CDN B and CDN B proxies requests to CDN A then those two will DoS eachother fairly quickly. There is no attacker inbetween to strip the Via, that would be counterproductive to the attack. Email has this too; the Received: header. If you manage to get a loop between two MTAs going they will detect it by seeing themselves in the Received: header list.