5 ms·

> In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream d

by js2 3y ago

> In a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client. I'm surprised this wasn't foreseen when HTTP/2 was designed. Amplification attacks were already well known from other protocols. I'm similarly similarly surprised it took this long for this attack to surface, but maybe HTTP/2 wasn't widely enough deployed to be a worthwhile target till recently?

tptacek 3y ago
It's not really an amplification attack. It's just drastically more efficiently using TCP connections.
- js2 3y ago
  You're right. I hadn't had my coffee yet and the asymmetric cost reminded me of amplification attacks. I'm still surprised this attack wasn't foreseen though. It just doesn't seem all that clever or original.
- callalex 3y ago
  Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? Or do you only consider it an amplification attack if it is exploiting layer 3? I tried looking it up and couldn’t find an authoritative answer. Can you recommend a resource that you like for this subject?
  - rasz 3y ago
    No, this is Resource exhaustion attacks https://en.wikipedia.org/wiki/Resource_exhaustion_attack https://en.wikipedia.org/wiki/Resource_exhaustion_attack And its not the first HTTP2 rodeo https://www.akamai.com/blog/security/http2-vulnerabilities https://www.akamai.com/blog/security/http2-vulnerabilities One of the 2019 vulns https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 even sounds extremely similar to current attack.
  - Sohcahtoa82 3y ago
    > I tried looking it up and couldn’t find an authoritative answer. I mean, who do you consider authoritative? Googling "amplification attack" will give you plenty of descriptions from tons of sources. Take your pick. Though most will talk about DNS amplication attacks because that's the simplest example.
  - viraptor 3y ago
    Amplification attack usually means the first victim produces more traffic than was sent to it and can direct it at the second victim.
  - mike_d 3y ago
    > Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? That is technically any HTTP request that requires processing to satisfy. For example if I find a page on your site that executes an expensive database query. Amplification attacks are generally defined as packets that can be sent with a spoofed source address that result in a larger number of packets being returned to the spoofed victim.
kristopolous 3y ago
> I'm similarly similarly surprised it took this long for this attack to surface As with most things like this, probably many hundreds of unimportant people saw it and tried it out. Trying to do it on Google, with a serious effort, that's the wacky part.
- sangnoir 3y ago
  > Trying to do it on Google, with a serious effort, that's the wacky part If I were the FBI, I'd be looking at people with recently bought Google puts expiring soon. I can't imagine anyone taking a swing at Google infra "for the lulz". Also in contention: nation-states doing a practice run.
  - seanhunter 3y ago
    Google options with near expiries have 100s of thousands of contracts of open interest[1]. Unless you found the person some other way (and then could prove that they had also gone long a short-dated put to try to profit) there's literally no way you find anything interesting by doing that. [1] Add up the "Open int" numbers here https://www.nasdaq.com/market-activity/stocks/goog/option-chain https://www.nasdaq.com/market-activity/stocks/goog/option-ch...
  - lazide 3y ago
    Google infra is attacked with large scale DDoS type attacks literally multiple times a day. They’re usually a nothingburger.
  - mike_d 3y ago
    Google is rarely the target of intentional attacks. Their cloud customers are the intended victims.
  - kristopolous 3y ago
    That's because you don't think like a 16 year old This is exactly the kind of things that a smart kid who's still just a foolish highschool student would do. I wouldn't be surprised if this attack already exists in the wild, it's not hard to write Also the subsequent attacks were less effective, that's exactly what some kid would be doing. You don't even need an expansive botnot. A rich kid whose parents are in neighborhoods with residential fiber with a bunch of friends could probably coordinate it through a discord server Most of us really don't interact with teenagers regularly so we forget they're out there (they also tend to dislike adults so they make themselves especially invisible around us). When it comes to things like this, that's my first assumption until further evidence. Merely teenaged graffiti for the digital age.
gnfargbl 3y ago
I was surprised too, but if you look at the timelines then RST_STREAM seems to have been present in early versions of SPDY, and SPDY seems mostly to have been designed around 2009. Attacks like Slowloris were coming out at about the same time, but they weren't well-known. On the other hand, SYN cookies were introduced in 1996, so there's definitely some historic precedent for attacks in the (victim pays Y, attacker pays X, X<<Y) class.
- c0l0 3y ago
  If you are working on the successor protocol of HTTP/1.1, and are not aware of Slowloris the moment it hits and every serious httpd implementation out there gets patched to mitigate it, I'd argue you are in the wrong line of work.
  - junon 3y ago
    While I agree in principle, slow loris is a very different attack than this one.

by js2 3y ago

tptacek 3y ago

It's not really an amplification attack. It's just drastically more efficiently using TCP connections.

js2 3y ago
You're right. I hadn't had my coffee yet and the asymmetric cost reminded me of amplification attacks. I'm still surprised this attack wasn't foreseen though. It just doesn't seem all that clever or original.
callalex 3y ago
Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? Or do you only consider it an amplification attack if it is exploiting layer 3? I tried looking it up and couldn’t find an authoritative answer. Can you recommend a resource that you like for this subject?
- rasz 3y ago
  No, this is Resource exhaustion attacks https://en.wikipedia.org/wiki/Resource_exhaustion_attack https://en.wikipedia.org/wiki/Resource_exhaustion_attack And its not the first HTTP2 rodeo https://www.akamai.com/blog/security/http2-vulnerabilities https://www.akamai.com/blog/security/http2-vulnerabilities One of the 2019 vulns https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 even sounds extremely similar to current attack.
- Sohcahtoa82 3y ago
  > I tried looking it up and couldn’t find an authoritative answer. I mean, who do you consider authoritative? Googling "amplification attack" will give you plenty of descriptions from tons of sources. Take your pick. Though most will talk about DNS amplication attacks because that's the simplest example.
- viraptor 3y ago
  Amplification attack usually means the first victim produces more traffic than was sent to it and can direct it at the second victim.
- mike_d 3y ago
  > Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? That is technically any HTTP request that requires processing to satisfy. For example if I find a page on your site that executes an expensive database query. Amplification attacks are generally defined as packets that can be sent with a spoofed source address that result in a larger number of packets being returned to the spoofed victim.

kristopolous 3y ago

> I'm similarly similarly surprised it took this long for this attack to surface As with most things like this, probably many hundreds of unimportant people saw it and tried it out. Trying to do it on Google, with a serious effort, that's the wacky part.

sangnoir 3y ago
> Trying to do it on Google, with a serious effort, that's the wacky part If I were the FBI, I'd be looking at people with recently bought Google puts expiring soon. I can't imagine anyone taking a swing at Google infra "for the lulz". Also in contention: nation-states doing a practice run.
- seanhunter 3y ago
  Google options with near expiries have 100s of thousands of contracts of open interest[1]. Unless you found the person some other way (and then could prove that they had also gone long a short-dated put to try to profit) there's literally no way you find anything interesting by doing that. [1] Add up the "Open int" numbers here https://www.nasdaq.com/market-activity/stocks/goog/option-chain https://www.nasdaq.com/market-activity/stocks/goog/option-ch...
- lazide 3y ago
  Google infra is attacked with large scale DDoS type attacks literally multiple times a day. They’re usually a nothingburger.
- mike_d 3y ago
  Google is rarely the target of intentional attacks. Their cloud customers are the intended victims.
- kristopolous 3y ago
  That's because you don't think like a 16 year old This is exactly the kind of things that a smart kid who's still just a foolish highschool student would do. I wouldn't be surprised if this attack already exists in the wild, it's not hard to write Also the subsequent attacks were less effective, that's exactly what some kid would be doing. You don't even need an expansive botnot. A rich kid whose parents are in neighborhoods with residential fiber with a bunch of friends could probably coordinate it through a discord server Most of us really don't interact with teenagers regularly so we forget they're out there (they also tend to dislike adults so they make themselves especially invisible around us). When it comes to things like this, that's my first assumption until further evidence. Merely teenaged graffiti for the digital age.

gnfargbl 3y ago

I was surprised too, but if you look at the timelines then RST_STREAM seems to have been present in early versions of SPDY, and SPDY seems mostly to have been designed around 2009. Attacks like Slowloris were coming out at about the same time, but they weren't well-known. On the other hand, SYN cookies were introduced in 1996, so there's definitely some historic precedent for attacks in the (victim pays Y, attacker pays X, X<<Y) class.

c0l0 3y ago
If you are working on the successor protocol of HTTP/1.1, and are not aware of Slowloris the moment it hits and every serious httpd implementation out there gets patched to mitigate it, I'd argue you are in the wrong line of work.
- junon 3y ago
  While I agree in principle, slow loris is a very different attack than this one.