Your Load Balancer is Your New Perimeter: Attacks & Defenses at Scale
summary
Four practical bypasses show how origin IPs leak and let attackers bypass CDNs: a certificate transparency leak reveals subdomains that resolve to load balancer IPs, port scans expose services like Redis and HAProxy with no auth, error code differences let attackers map admin APIs, and unproxied DNS records (graycloud) allow direct DoS. Defenses are network isolation plus mTLS validation and origin headers, rebind services and require authentication, normalize errors to generic 404s, proxy all DNS or use private VPCs, and apply layered rate limits and token-weighted quotas.
AI-written summary · about
chapters (13)
- 0:00Introduction to load balancer security
- 3:16Attack 1: Certificate transparency leaks
- 8:44Defending against origin IP exposure
- 10:37Attack 2: Port scanning exposed services
- 13:46Hardening misconfigured services
- 15:12Attack 3: Error-based endpoint enumeration
- 17:39Normalizing error responses
- 19:04Attack 4: Graycloud DNS misconfigurations
- 21:55Defending with private DNS or IP restrictions
- 24:47Rate limiting across infrastructure layers
- 25:49AI agents and evolving attack surfaces
- 28:21Monday morning security checklist
- 29:28Key takeaways and governance
related talks
20mEnd-Users Get Maneuvered: Empirical Analysis of Redirection Hijacking in Content Delivery Networks
33mHow to implement DDoS protection in GCP
40mCloud Foundry Through the Eyes of a Hacker
51mProtect your internet-facing web applications hosted on AWS
04mLoad balancing through the years
19mNames and Security
29mUsing the Internet as Your Load-Balancer
52mNot all attacks are malicious: DDoS from outside and within