HTTP Time Bandit
Talkat AppSec California 2014 · on Monday, 2014-01-27· at 14:45· Track 2, Annenberg Community Beach House, East Pacific Coast Highway·
summary
A crawler measures per-URL transfer speed, normalizes results, and selects low-speed low-variance endpoints to hammer; the supplied tool emits XML, draws a link graph, and repeats requests until resource exhaustion occurs (lab: an i7 server hits ~90–98% CPU with only seven parallel clients or ten repeated requests). Defenses discussed include load balancers and HAProxy split static vs dynamic policies, Apache modules like mod_security/mod_qos and throttling modules rate-limit per IP or per page, and published one-file C++ source for the tester.
AI-written summary · about
chapters (9)
- 0:00Intro
- 3:04Classic Application Layer DOS/DDOS
- 8:57The Proposed Method Method of detection of the critical resource • Spider over the web site and collect transfer times for each resource • Calculate the average speed and distribution of transfers Identify the resources that have slower average transfer times
- 11:03Using Statistics to Normalize the Data
- 18:37Attack Like Stage of Testing Measurement of service degradation while doing a hard test for narrowing down the choice of links
- 24:14Commercial Protection Services . Few players using limiters for
- 26:38Playing with Apache Configs Baseline, no protection • 1 client running 10x parallel requests of the most expensive resource • 3% CPU on the client machine Server: i7, 4 core, 8 gb • 98% CPU utilization on the server
- 28:15mod_qos Implements control mechanisms to provide different priority to requests and control server access based on available resources 7
- 30:40Conflicts with Slow* Attack Protection Slow* attack mitigation is an addition • mod_evasive could not protect from these There is no conflict (good news)
related talks
43mHTTP Time Bandit
34mPerformance Tools
29mSite Availability is for Everybody
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
47mPractical Performance Analysis
43mWeb Acceleration Mechanics
31mFifty Shades of Caching and How LLMs Paint It Blαck
12mWhere Do Your Web Performance Metrics Come From? – Matt Zeunert