Skip to main content

Asymmetric denial of service

Need​

The need is to implement measures to mitigate and prevent asymmetric denial of service attacks.

Context​

  • Usage of Ruby 2.7 for developing Ruby applications
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class ApplicationController < ActionController::Base
  def index
    data = params[:data]
    # This is the vulnerable part of the code where the user input is directly used in a loop
    # without any limit check or sanitization.
    data.each do |d|
      # Expensive operation that consumes a lot of resources
      sleep(1)
    end
    render json: { status: 'success' }
  end
end

The above code is a simple Ruby on Rails controller with an index action. The vulnerability lies in the fact that it directly uses user input from the params[:data] to operate a loop. There is no limit check or sanitization on this user input.

A malicious user can send an enormous amount of data in the params[:data] which would result in the loop running for a very long time because of the sleep(1) operation inside it. This operation is just a placeholder for any expensive operation that could consume a lot of resources.

This could easily lead to a Denial of Service (DoS) attack, where the server would be rendered unresponsive due to the enormous amount of resources consumed by processing this single malicious request.

In case of an amplification attack, if the response is based on the input data, a single request could produce multiple responses, thereby overwhelming the server.

This code is vulnerable to an Asymmetric Denial of Service attack.

Steps​

  • Implement input validation and sanitization to ensure that only valid and expected data is processed.
  • Set a limit on the number of iterations in the loop to prevent excessive resource consumption.
  • Consider implementing rate limiting or throttling mechanisms to prevent amplification attacks.
  • Optimize the expensive operation to reduce resource consumption, if possible.
  • Monitor server performance and implement appropriate monitoring and alerting mechanisms to detect and mitigate potential denial of service attacks.

Compliant code​

class ApplicationController < ActionController::Base
  MAX_ITERATIONS = 100 # Set a limit on the number of iterations

  def index
    data = params[:data]

    # Input validation and sanitization
    if data.is_a?(Array) && data.size <= MAX_ITERATIONS
      data.each do |d|
        # Expensive operation that consumes a lot of resources
        # Optimized to reduce resource consumption
        sleep(0.1) # Reduced sleep time
      end
      render json: { status: 'success' }
    else
      render json: { status: 'error', message: 'Invalid input or too many requests' }, status: 400
    end
  end
end

The updated code includes several measures to mitigate the risk of an asymmetric denial of service attack.

Firstly, we have added a constant MAX_ITERATIONS to set a limit on the number of iterations that the loop can perform. This prevents the loop from running indefinitely and consuming excessive resources if a large array is passed in the data parameter.

Secondly, we have added input validation and sanitization to ensure that the data parameter is an array and that its size does not exceed the maximum number of iterations. If the input is invalid or too large, the server responds with an error message and a 400 status code, without performing any resource-intensive operations.

Thirdly, we have optimized the expensive operation inside the loop by reducing the sleep time from 1 second to 0.1 seconds. This reduces the amount of resources consumed by each iteration of the loop.

These measures help to prevent both amplification attacks, where a single request produces multiple responses, and attacks where a single malicious request consumes an enormous amount of resources. They also help to ensure that the server remains responsive even when handling large or malicious requests.

For further protection, consider implementing rate limiting or throttling mechanisms to limit the number of requests that a single client can make within a certain period of time. Also, monitor server performance and implement appropriate monitoring and alerting mechanisms to detect and mitigate potential denial of service attacks.

References​

Last updated on