RangeAmp attacks can take down websites and CDN servers

mood · May 25, 2020

RangeAmp attacks can take down websites and CDN servers
Twelve of thirteen CDN providers said they fixed or planned to fix the problem
May 25, 2020
https://www.zdnet.com/article/rangeamp-attacks-can-take-down-websites-and-cdn-servers/

A team of Chinese academics has found a new way to abuse HTTP packets to amplify web traffic and bring down websites and content delivery networks (CDNs).

Named RangeAmp, this new Denial-of-Service (DoS) technique exploits incorrect implementations of the HTTP "Range Requests" attribute.
HTTP Range Requests are part of the HTTP standard and allow clients (usually browsers) to request only a specific portion (range) of a file from a server.
TWO RANGEAMP ATTACKS DISCOVERED
Now, a team of Chinese academics says that attackers can use malformed HTTP Range Requests to amplify how web servers and CDN systems react when having to deal with a range request operation.

The team says two different RangeAmp attacks exist.
Click to expand...

The first is called a RangeAmp Small Byte Range (SBR) attack. In this case [see (a) in the image below], the attacker sends a malformed HTTP range request to the CDN provider, which amplifies the traffic towards the destination server, eventually crashing the targeted site.

The second is called a RangeAmp Overlapping Byte Ranges (OBR) attack. In this case [see b) in the image below], the attacker sends a malformed HTTP range request to a CDN provider, and in the case, the traffic is funneled through other CDN servers, the traffic is amplified inside the CDN networks, crashing CDN servers and rendering both the CDNs and many other destination sites inaccessible.
Click to expand...

The research team found that attackers could use a RangeAmp SBR attack to inflate traffic from 724 to 43,330 times the original traffic.
RangeAmp OBR attacks were a little harder to carry out, as the six vulnerable CDNs needed to be in specific (master-surrogate) configurations, [...]
Click to expand...

Research paper: "CDN Backfired: Amplification Attacks Based on HTTP Range Requests"
(PDF): https://www.liubaojun.org/uploads/1/1/8/3/118316462/dsn_2020.pdf

Log in or Sign up

RangeAmp attacks can take down websites and CDN servers

mood Updates Team

Log in or Sign up

RangeAmp attacks can take down websites and CDN servers

mood Updates Team

Useful Searches