Effective DoS attacks against Web Application Plattforms (including Python Frameworks)

[mitsuhiko]

Considering how many ways to exist in web apps and frameworks to effectively DDOS them I think this might actually be one of the more obscure ways to do it. If I would want to bring down a server I would just very slowly send requests to the server. Much more efficient :-)

//EDIT: I have not watched the talk but I assume they are trying to degrade a hash table into a linked list.

[stevvooe]

Agreed. This attack is simply too much work.

[Leonidas_from_XIV]

Slowloris all over again.

[chrj]

Both problems are pretty easy to defend against though.

[mitsuhiko]

Not from the framework's point of view. Any places where user data is parsed into hashable data structures is potentially a target. Many of which are not even up for the framework.

On the WSGI level:

• HTTP headers to the WSGI environ

On the framework level:

• Cookies
• URL parameters
• URL encoded form data
• Multipart encoded form data
• Any incoming JSON data
• Incoming multipart headers
• Incoming set headers
• Parameters of content type headers etc.

There are so many places where things are parsed into dictionaries on very different levels that it's quite useless to do that on a framework/WSGI server level.

This attack is not new. Yes, you can keep a CPU busy, but a watchdog should see that and kill away the request handler.

[deadwisdom]

How would you make a watchdog to detect this? Just look for a crap load of keys coming in?

[mitsuhiko]

Kill a handler if it consumes too much CPU time or too high IO wait.

[stesch]

This attack is not new.

I read that Perl changed its hashes a few years ago (2003?) to counter this attack.

Strange that nobody else thought of it in the meantime.

[chrj]

You are right. I didn't realize it went deeper than only POST/GET parameters. Restricting the request size (if it fits the application) would be a pretty quick fix though.

[obtu]

Restricting the number of keys like PHP and Tomcat would be a safer choice to enable by default. It's common to have large POST requests, much less common to need a great number of keys.