Traffic flood

Description
Traffic Flood is a type of DoS attack targeting web servers, the attack explores the way that TCP connection is managed. The attack consists in a generation of a lot of well crafted TCP requisitions with the objective to stop the Web Server or causing a performance decrease.

The attack explores the characteristic of the HTTP protocol, opening many connections at the same time to attend a single requisition. This special feature of the http protocol, which consists in to open a TCP connection for every html object and close it, could be used to make two different kinds of exploitation. The Connect attack is done during the establishment of the connection, and the Closing attack is done during the connection closing.

Severity
High

Likelihood of exploitation
Very High

Connect attack
This type of attack consists in establishing a big number of fake TCP connections with an incomplete HTTP request until the web server is overwhelmed of connections and stops responding.

The aim of the incomplete HTTP request is to keep the web server, with the TCP connection in Established state, waiting for the completion of the request, as shown in figure1. Depending on the implementation of the web server the connection stays in this state until there is a timeout of the TCP connection or of the web server. This way it’s possible to establish a great number of new connections before the first ones begin to timeout moreover the generation rate of new connections grows faster than the expiring one.

https://www.owasp.org/images/b/b4/Trafficatual.jpg

The attack could also affect firewall that implements a proxy like access control as Checkpoint FW1.

Closing Attack
The Closing Attack is done during the ending steps of a TCP connection exploring how some web servers deal with the finalization of the TCP connection especially with the FIN_WAIT_1 state. The attack as explained by Stanislav Shalunov: “ comes in two flavors: mbufs exhaustion and process saturation.

When doing mbufs exhaustion, one wants the user-level process on the other end to write the data without blocking and close the descriptor. Kernel will have to deal with all the data, and the user-level process will be free, so that more requests can be sent this way and eventually consume all the mbufs or all physical memory, if mbufs are allocated dynamically.

When doing process saturation, one wants user-level process to block while trying to write data. The architecture of many HTTP servers will allow serving only a number of connections at a time. When this number of connections is reached the server will stop responding to legitimate users. If the server doesn't put a bound on the number of connections,resources will still be tied up and eventually the machine comes to a crawling halt.

External References

 * http://shlang.com/netkill/netkill.html

Related Threats
Category:Logical Attacks

Related Attacks

 * Denial of Service

Related Vulnerabilities
Category:General Logic Error Vulnerability

Related Countermeasures
Category:Denial of Service Attack