Denial of Service with a Fistful of Packets: Exploiting Algorithmic Complexity Vulnerabilities
summary
Demonstrates three exploit classes and practical POCs: PDF “napalm” using FlateDecode followed by repeated ASCIIHexDecode to produce a small (≈5KB) file that drives CPU to 100% for minutes while freeing memory between stages, VNC servers vulnerable to many concurrent TCP connections that grow log lines quadratically and trigger EMFILE-induced infinite logging (ulimit ≈1024) leading to multi‑GB log files and unauthenticated DoS, zxcvbn worst‑case passwords (1,000 chars) taking ~22 minutes to evaluate. Tools and fixes include AC Sploit, ReDoS detector, input limits and hard resource caps.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 1:00What are algorithmic complexity vulnerabilities
- 8:44Decompression bombs
- 13:49ASCII hex decode
- 16:28Demo
- 18:34Impact
- 20:29Unauthenticated Vulnerability
- 23:31Demonstration
- 25:21Bonus vulnerability
- 28:42Impacts
- 30:30Password Strength Estimation Tool
- 37:57Impact on Enterprise Software
- 39:36Demo of Attack
- 41:44What You Can Do
- 43:07Common Themes
- 43:48Tools
- 45:00Audience
- 46:29Outro
related talks
47mLive Hacking: Breaking into Your Web App
42m"Vulnerabilities from a grave. Forever dead or maybe alive..."
51mThe Anatomy of an Exploit
45mHTTP Desync Attacks: Smashing Into The Cell Next Door
45mThe Code Behind The Vulnerability
13mEvading and crashing anti-malware solutions via data collection overloading during...
13mX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in
01h 06mHow hacking works