Mastering Web Security: Insights and Strategies to Prevent DoS Attacks

Original Post: Not all attacks are equal: understanding and preventing DoS in web applications

The article, cross-posted on jacobian.org, discusses Denial-of-Service (DoS) attacks, focusing on their various types, risks, and mitigation strategies. The author, with contributions from r2c team members, reflects on their time at Heroku, dealing with security incidents. DoS attacks overwhelm servers with traffic, impacting service availability and customer trust, unlike other attacks like data breaches or remote code execution.

Types of DoS Attacks:

1. Normal DoS Attacks: Single machine causes downtime, e.g., zip bombs.
2. Distributed DoS (DDoS) Attacks: Multiple machines (botnets) flood the target, available for purchase online.

Evaluating DoS Risks:
There’s industry disagreement on handling DoS vulnerabilities. Some see DDoS protection as largely infeasible without network-level support like Cloudflare, whereas others emphasize the importance of uptime, citing examples of attacks demanding ransoms, like the Garmin incident.

Framework for Risk Assessment:
The article introduces the concept of "attacker leverage" — how much impact an attacker can achieve with minimal effort.

Risk Classes and Mitigations:

1. High-Leverage DoS Vulnerabilities:

   • Causes significant resource exhaustion with minimal attack effort.
   • Examples include disk space exhaustion, bandwidth overload, CPU spikes, and concurrency limits.
   • Mitigation: Eliminate high-risk vulnerabilities.

2. Medium-Leverage DoS Risks:

   • Inherent areas of slower operation in apps, e.g., complex reports, database writes.
   • Requires more effort for attackers to exploit.
   • Mitigation: Rate limiting to prevent excessive resource use.
3. Low-Leverage DoS Risks:
   • True DDoS attacks using extensive resources.
   • Mitigation: Network-level security measures (e.g., Cloudflare), preparation, and understanding of networking layers.

Recommendations:

• Use rate limiting to manage request frequency.
• Scan applications for vulnerabilities using tools like Semgrep, especially for easily exploited issues like ReDoS (Regular Expression DoS).

Conclusion:
DoS vulnerabilities vary in severity. High-leverage vulnerabilities need immediate attention, whereas others can be considered acceptable risks. The author suggests using amplification as a metric for evaluating and prioritizing DoS vulnerabilities to avoid unnecessary debates and ensure focused mitigation efforts.

Go here to read the Original Post