A team of Chinese academics has managed to find a new way to hack HTTP packets, which increases web traffic and "brings down" websites and CDNs (Content Delivery Networks), through RangeAmp attacks.
The new Denial-of-Service technique, RangeAmp , exploits HTTP " Range Request " execution errors .
HTTP Range Requests are part of the HTTP standard and allow clients (usually browsers) to request only a specific portion of a file from a server . This feature was created to pause and restart traffic in controlled (pause-resume activities) or uncontrolled (network congestion, disconnections) situations.
Academics argue that attackers can use flawed HTTP Range Requests to enhance the reactions of servers and CDN systems when faced with a range request operation.
According to the team of Chinese researchers, there are two different attacks . One is called RangeAmp Small Byte Range (SBR) and the other is RangeAmp Overlapping Byte Ranges (OBR).
RangeAmp Small Byte Range
In this case, the attacker sends a malformed HTTP Range Request to the CDN provider, resulting in increased traffic to the destination server, ultimately “crashing” the targeted site.
RangeAmp Overlapping Byte Ranges
Similarly here, the attacker sends the faulty HTTP Range Request and if the traffic is routed through other CDN servers, it increases (the traffic) in the CDN networks, resulting in a "crash" of the CDN servers and an inability to access the CDN servers and the destination sites.
After testing 13 CDN providers, it was found that all were vulnerable to the attack, while 6 of them were also vulnerable to a variant of it (OBR). Of course, between the two, the attack that is considered more dangerous is OBR, as when the conditions are right, it can inflate a network's traffic to an excessive extent and "bring down" thousands of sites at once.
The academics revealed that they have been reaching out to affected CDN providers for months, disclosing details of the RangeAmp attacks. The providers’ response, along with technical details, is available in the research team’s paper, titled: “CDN Backfired: Amplification Attacks Based on HTTP Range Requests.”
