Saved in:
| Main Authors: | , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2409.00712 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866917766134497280 |
|---|---|
| author | Lin, Ziyu Lin, Zhiwei Liu, Ximeng Ying, Zuobing Chen, Cheng |
| author_facet | Lin, Ziyu Lin, Zhiwei Liu, Ximeng Ying, Zuobing Chen, Cheng |
| contents | Content Delivery Networks (CDNs) are designed to enhance network performance and protect against web attack traffic for their hosting websites. And the HTTP compression request mechanism primarily aims to reduce unnecessary network transfers. However, we find that the specification failed to consider the security risks introduced when CDNs meet compression requests. In this paper, we present a novel HTTP amplification attack, CDN Compression Format Convert (CDN-Convet) Attacks. It allows attackers to massively exhaust not only the outgoing bandwidth of the origin servers deployed behind CDNs but also the bandwidth of CDN surrogate nodes. We examined the CDN-Convet attacks on 11 popular CDNs to evaluate the feasibility and real-world impacts. Our experimental results show that all these CDNs are affected by the CDN-Convet attacks. We have also disclosed our findings to affected CDN providers and have received constructive feedback. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2409_00712 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Unveiling the Bandwidth Nightmare: CDN Compression Format Conversion Attacks Lin, Ziyu Lin, Zhiwei Liu, Ximeng Ying, Zuobing Chen, Cheng Cryptography and Security Content Delivery Networks (CDNs) are designed to enhance network performance and protect against web attack traffic for their hosting websites. And the HTTP compression request mechanism primarily aims to reduce unnecessary network transfers. However, we find that the specification failed to consider the security risks introduced when CDNs meet compression requests. In this paper, we present a novel HTTP amplification attack, CDN Compression Format Convert (CDN-Convet) Attacks. It allows attackers to massively exhaust not only the outgoing bandwidth of the origin servers deployed behind CDNs but also the bandwidth of CDN surrogate nodes. We examined the CDN-Convet attacks on 11 popular CDNs to evaluate the feasibility and real-world impacts. Our experimental results show that all these CDNs are affected by the CDN-Convet attacks. We have also disclosed our findings to affected CDN providers and have received constructive feedback. |
| title | Unveiling the Bandwidth Nightmare: CDN Compression Format Conversion Attacks |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2409.00712 |