All Node.js servers are vulnerable to DoS • Hacker News Board

Re: All Node.js servers are vulnerable to DoS

#11

Post by dangrossman » Tue, Jan 03, 2012, 3:09 PM UTC

stwe wrote: post #4

bradleymeck wrote: post #2

So are all string based dictionaries?

Yes, if they are implemented via hash tables and do not randomize their hash generation somehow. The talk at 28c3 specifically mentions PHP, Java, ASP.net, Python. Ruby is fine, but other variants of Ruby are apparently also vulnerable.

PHP already fixed this in the 5.3.9 and 5.4RC branches.

Re: All Node.js servers are vulnerable to DoS

#12

Post by jrockway » Tue, Jan 03, 2012, 3:19 PM UTC

stwe wrote: post #4

bradleymeck wrote: post #2

So are all string based dictionaries?

Yes, if they are implemented via hash tables and do not randomize their hash generation somehow. The talk at 28c3 specifically mentions PHP, Java, ASP.net, Python. Ruby is fine, but other variants of Ruby are apparently also vulnerable.

Worth noting that this has been "fixed" in Perl since 5.8.1, released over 8 years ago.

http://perldoc.perl.org/perlsec.html#Algorithmic-Complexity-...

Re: All Node.js servers are vulnerable to DoS

#13

Post by voodootikigod » Tue, Jan 03, 2012, 3:52 PM UTC

This might provide a little more explanation than the title and comment thread do: http://www.ocert.org/advisories/ocert-2011-003.html It is a big issue, but it isn't just node.js.

Re: All Node.js servers are vulnerable to DoS

#14

Post by dextorious » Tue, Jan 03, 2012, 4:08 PM UTC

wavephorm wrote: post #10

Anything measured can be improved.

That's the spirit of those "penis enlargement" ads.

To be pedantic, there are hardcore limits on stuff, that we can not improve upon. We cannot sort a list of n items in less than O(n) for example.

Re: All Node.js servers are vulnerable to DoS

#15

Post by pork » Tue, Jan 03, 2012, 4:16 PM UTC

dextorious wrote: post #14

wavephorm wrote: post #10

Anything measured can be improved.

That's the spirit of those "penis enlargement" ads. To be pedantic, there are hardcore limits on stuff, that we can not improve upon. We cannot sort a list of n items in less than O(n) for example.

O(n) only applies to non-comparison based sorts; for comparison based sorts that might be used on "items" the lower bound is indeed O(n.log n)

Re: All Node.js servers are vulnerable to DoS

#16

Post by FooBarWidget » Tue, Jan 03, 2012, 4:21 PM UTC

astrodust wrote: post #8

stwe wrote: post #4

Earlier quoted context omitted.

Yes, if they are implemented via hash tables and do not randomize their hash generation somehow. The talk at 28c3 specifically mentions PHP, Java, ASP.net, Python. Ruby is fine, but other variants of Ruby are apparently also vulnerable.

Ruby 1.9 is fine, 1.8 has problems.

1.8 is also fixed.

Re: All Node.js servers are vulnerable to DoS

#17

Post by masklinn » Tue, Jan 03, 2012, 4:33 PM UTC

dos1 wrote: post #3

Didn't I see this same thing about PHP the other day? http://news.ycombinator.com/item?id=3403360 http://nikic.github.com/2011/12/28/Supercolliding-a-PHP-arra...

> Didn't I see this same thing about PHP the other day?

This affect all languages using hashtables with non-randomized hash functions to store POST arguments, it's been discussed on Python's mailing list for instance. It's also been noted on the Erlang list, but all erlang frameworks apparently use proplists for POST mappings, so none of them is affected.

Re: All Node.js servers are vulnerable to DoS

#18

Post by tmcdonald » Tue, Jan 03, 2012, 4:37 PM UTC

masklinn wrote: post #17

dos1 wrote: post #3

Didn't I see this same thing about PHP the other day? http://news.ycombinator.com/item?id=3403360 http://nikic.github.com/2011/12/28/Supercolliding-a-PHP-arra...

> Didn't I see this same thing about PHP the other day? This affect all languages using hashtables with non-randomized hash functions to store POST arguments, it's been discussed on Python's mailing list for instance. It's also been noted on the Erlang list, but all erlang frameworks apparently use proplists for POST mappings, so none of them is affected.

I believe that the critical ASP.NET framework update that Microsoft pushed just before the new year was to fix this issue as well, amongst a few others.

http://technet.microsoft.com/en-us/security/bulletin/ms11-10...

Re: All Node.js servers are vulnerable to DoS

#19

Post by ThaddeusQuay2 » Tue, Jan 03, 2012, 4:40 PM UTC

Not necessarily specific to node.js, but in general, instead of a standard webserver, use netcat, on multiple obscure ports, where each instance of netcat acts once and is discarded.

http://en.wikipedia.org/wiki/Netcat

Re: All Node.js servers are vulnerable to DoS

#20

Post by 198d » Tue, Jan 03, 2012, 5:40 PM UTC

It's like everyone figured out how hashes work just a couple of days ago. What happened to spark all of this conversation? I also keep hearing that this problem is solved with randomized hashing functions, but my best guess is that this doesn't eliminate collisions. It just then becomes roughly impossible to generate a set of keys that would cause enough collisions to actually be a problem. Hooray for data structures.