3 ms·

Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? Or do you only consider it

Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? Or do you only consider it an amplification attack if it is exploiting layer 3? I tried looking it up and couldn’t find an authoritative answer. Can you recommend a resource that you like for this subject?

rasz 3y ago
No, this is Resource exhaustion attacks https://en.wikipedia.org/wiki/Resource_exhaustion_attack https://en.wikipedia.org/wiki/Resource_exhaustion_attack And its not the first HTTP2 rodeo https://www.akamai.com/blog/security/http2-vulnerabilities https://www.akamai.com/blog/security/http2-vulnerabilities One of the 2019 vulns https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 even sounds extremely similar to current attack.
Sohcahtoa82 3y ago
> I tried looking it up and couldn’t find an authoritative answer. I mean, who do you consider authoritative? Googling "amplification attack" will give you plenty of descriptions from tons of sources. Take your pick. Though most will talk about DNS amplication attacks because that's the simplest example.
viraptor 3y ago
Amplification attack usually means the first victim produces more traffic than was sent to it and can direct it at the second victim.
mike_d 3y ago
> Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? That is technically any HTTP request that requires processing to satisfy. For example if I find a page on your site that executes an expensive database query. Amplification attacks are generally defined as packets that can be sent with a spoofed source address that result in a larger number of packets being returned to the spoofed victim.

rasz 3y ago

No, this is Resource exhaustion attacks https://en.wikipedia.org/wiki/Resource_exhaustion_attack https://en.wikipedia.org/wiki/Resource_exhaustion_attack And its not the first HTTP2 rodeo https://www.akamai.com/blog/security/http2-vulnerabilities https://www.akamai.com/blog/security/http2-vulnerabilities One of the 2019 vulns https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 even sounds extremely similar to current attack.

Sohcahtoa82 3y ago

> I tried looking it up and couldn’t find an authoritative answer. I mean, who do you consider authoritative? Googling "amplification attack" will give you plenty of descriptions from tons of sources. Take your pick. Though most will talk about DNS amplication attacks because that's the simplest example.

viraptor 3y ago

Amplification attack usually means the first victim produces more traffic than was sent to it and can direct it at the second victim.

mike_d 3y ago

> Isn’t any kind of attack where a little bit of effort from the attacker causes a lot of work for the victim an amplification attack? That is technically any HTTP request that requires processing to satisfy. For example if I find a page on your site that executes an expensive database query. Amplification attacks are generally defined as packets that can be sent with a spoofed source address that result in a larger number of packets being returned to the spoofed victim.