Justo el otro día, un grupo de científicos chinos descubrió una vulnerabilidad que permite ataques DDoS con amplificación. ¡Los autores lograron llevar a cabo un ataque con un factor de 43,000! Un nuevo ataque no solo puede agotar los recursos del canal saliente del servidor web de destino, sino también los canales de los nodos CDN. Vulnerables fueron los 13 de los 13 mayores proveedores probados de CDN, incluidos Akamai, Fastly y Cloudflare. Bajo el corte, considere el mecanismo de ataque y las medidas propuestas por los autores.

, , Range-based Amplification ttack RangeAmp. CDN range request HTTP, - . — . , , Akamai ~15-30% - . RFC range request , CDN . .

13 CDN : Akamai, Alibaba Cloud, Azure, CDN77, CDNsun, Cloudflare, CloudFront, Fastly, G-Core Labs, Huawei Cloud, KeyCDN, StackPath Tencent Cloud.

- Linux c 2.4GHz CPU, 16G DDR 1000 Mbps .

- Apache/2.4.18 . CDN .

Range request

range request -. . , .

, Range. , . , . , Accept-Ranges "bytes".

range CDN - Range. :

1. Laziness () — .
2. Deletion () — .
3. Expansion () — , .

CDN 2 3. , , , , .

, ? RFC7233 , range . , 4 13 CDN .

, — . .. , ! .

Deletion Expansion CDN , , CDN . . Range, CDN - . Small Byte Range Attack SBR RangeAmp. DDoS-, . , , , "" CDN, .., CDN .

, . 25 MB Akamai 43000!

13 CDN : Akamai, Alibaba Cloud, Azure, CDN77, CDNsun, Cloudflare, CloudFront, Fastly, G-Core Labs, Huawei Cloud, KeyCDN, StackPath Tencent Cloud.

CDN

, . CDN, CDN , Frontend CDN FCDN. CDN, -, Backend CDN (. ).

, :

1. FCDN Laziness Range " ".
2. BCDN , Range .

, n , BCDN n * ( ). , . TCP Receive Window, .

, , . .. Range.

, RFC , , 4 : CloudFlare, CDN77, CDNsun, StackPath. 1KB (, n — ):

?

, . - (SBR RangeAmp), — CDN (OBR RangeAmp) HTTP/1.1, HTTP/2.

CDN RFC.

CDN :

• , , RFC7233 .
• Range Laziness , Expansion, .

Source:
CDN Backfired: Amplification Attacks Based on HTTP Range Requests, Weizhong Li, Kaiwen Shen, Run Guo, Baojun Liu, Jia Zhang, Haixin Duan, Shuang Hao, Xiarun Chen, Yao Wan.

.

P.S.

CloudFlare , , , .

"They thought that the SBR attack relies on constantly triggering a cache-miss and a customer can add a page rule to ignore query strings. But this does not solve the problem fundamentally. The malicious customers and some normal customers will not follow this suggestion. Unfortunately, they won’t implement our mitigation solutions because Cloudflare does not want to cache partial responses of certain resources."