HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
blog.cloudflare.com
HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
1–10 of 82 posts
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#2tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1).
> When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is read (HEADERS and DATA frames) it is dispatched to an upstream service. When RST_STREAM frames are read, the local state for the request is torn down and the upstream is notified that the request has been canceled. Rinse and repeat until the entire buffer is consumed. However this logic can be abused: when a malicious client started sending an enormous chain of requests and resets at the start of a connection, our servers would eagerly read them all and create stress on the upstream servers to the point of being unable to process any new incoming request.
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#3Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#4A number of people have expressed concerns about making the relatively simple protocol more and more complicated in the name of performance. This looks like it's going to be their "Ha, told you so!" moment.
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#5tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1). > When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is rea…
how on earth did nobody anticipate this kind of attack when designing the protocol? it's very obvious it can be abused like this
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#6tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1). > When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is rea…
how on earth did nobody anticipate this kind of attack when designing the protocol? it's very obvious it can be abused like this
Hindsight is 20/20
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#7A number of people have expressed concerns about making the relatively simple protocol more and more complicated in the name of performance. This looks like it's going to be their "Ha, told you so!" moment.
It reminds me of Meltdown/Spectre: you have a pipe, and instructions need to flow through it in a single file line. Let's increase performance by allowing things to be sent/processed out-of-order!
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#8I'm curious to learn more. How how much work is it to establish a stream and close it? It feels like something that could be done very quickly, but it also involves setting up some state (stream buffers) that could be a problem too.
Re: HTTP/2 zero-day vulnerability results in record-breaking DDoS attacks
#9tl;dr HTTP/2 allows clients to DDoS backends much more effectively by using the multiple-stream feature of HTTP/2 to amplify their attack directly inside the reverse proxy (which typically translates HTTP/2 to HTTP/1). > When Cloudflare's reverse proxies process incoming HTTP/2 client traffic, they copy the data from the connection’s socket into a buffer and process that buffered data in order. As each request is rea…
how on earth did nobody anticipate this kind of attack when designing the protocol? it's very obvious it can be abused like this
It took 8 years for somebody to discover this. It can't have been that obvious.