3 ms·
After all the TCP and UDP specific attacks (SYN Floods and Reflection-Amplification), I am really curious which QUIC-specific DoS attacks will be created by som
by theskyo 5y ago
After all the TCP and UDP specific attacks (SYN Floods and Reflection-Amplification), I am really curious which QUIC-specific DoS attacks will be created by some talented hackers.
At least the security considerations of the QUIC RFC are ~18 pages long, so this might take some time.
- tialaramex 5y agoA core intent is that you should not be able to cause a QUIC peer to spew vast quantities of stuff to somebody it hasn't authenticated, so that it can't be used for a large amplification attack. If you emit even very small malformed packets perhaps from a forged address, a QUIC peer is still more or less obliged† to tell you there's a problem, and so if the malformed packet's origin address was forged, the real owner of that address gets an unexpected QUIC message saying there's a problem, and it might respond in kind - it's important this doesn't end up like two half-deaf retirees both shouting "What?!" at each other forever because one of them thought the other said something. † What WireGuard does here is just ignore everything that doesn't authenticate. This makes diagnostics tricky. Why doesn't it work? No idea. Maybe try again?