HTTP/2 "Rapid Reset" DDoS Attack Disclosed By Google, Cloudflare & AWS

[phoronix]

Phoronix: HTTP/2 "Rapid Reset" DDoS Attack Disclosed By Google, Cloudflare & AWS

Google, Cloudflare and AWS today disclosed a new zero-day vulnerability called the HTTP/2 Rapid Reset attack. This attack that is being seen in the real-world relies on a weakness in the HTTP2 protocol for carrying out "hyper volumetric" Distributed Denial of Service attacks...

https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack

[cynic]

nice!

being a protocol bug, I suppose it affects all implementations, right?

[S.Pam]

nice!

being a protocol bug, I suppose it affects all implementations, right?

Or implement rate limit on the webserver?

[cynic]

Or implement rate limit on the webserver?

yes, that's what I said: you have to implement rate limit (or any other protecion measure) on all "webservers", whatever "webserver" means.

basically everything that is able to respond to http2 requests.
just to name a few that I work with daily, nginx, httpd, caddy or the standard library http server in go.

I think there are countless cases to fix.

[bug77]

yes, that's what I said: you have to implement rate limit (or any other protecion measure) on all "webservers", whatever "webserver" means.

basically everything that is able to respond to http2 requests.
just to name a few that I work with daily, nginx, httpd, caddy or the standard library http server in go.

I think there are countless cases to fix.

On the other hand, besides dev environments and stress test setups, where do you run your servers without a rate limit?

[cynic]

On the other hand, besides dev environments and stress test setups, where do you run your servers without a rate limit?

ask cloudfare, apparently I'm not alone

in any case, I don't think that rate limiting is a solution for this attack (haven't read the nitty gritty details yet), or it won't be an issue.

[Mathias]

in any case, I don't think that rate limiting is a solution for this attack (haven't read the nitty gritty details yet), or it won't be an issue.

I mean, the reset allows to have more open requests then otherwise allowed. So in a form, this circumvents a previous rate limit. So some new rate limiting should help. The question is, can this be done in an efficient way?

[V1tol]

Who would have expected that Google's abomination failed

[gggeek]

Nginx has put out a statement where they mention that it is already possible and in fact not too hard to prevent resource exhaustion from this kind of attack via config settings. Also, they plan to release a patch tomorrow to improve its resilience. It does not look like end of the world :-)

[MorrisS.]

Is http2 about to be deprecated?