CDN Tsunami: Exploiting HTTP/3-HTTP/1.1 Conversion for DoS Attacks
This paper introduces a novel Denial-of-Service attack vector against Content Delivery Networks that exploits the traffic disparity between HTTP/3 and HTTP/1.1 protocols to amplify bandwidth and connection loads, identifying over 42,000 vulnerable subdomains and prompting mitigations from major CDN vendors.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine the internet as a massive, bustling city where websites are popular shops and users are shoppers. To keep things running smoothly, the city employs a fleet of super-fast delivery trucks called Content Delivery Networks, or CDNs. These trucks don't just drive to the shop; they park right outside the customer's house, holding copies of the most popular items so shoppers don't have to wait for a long trip to the main warehouse. This system is the backbone of how we browse the web today.
Recently, the city introduced a new, high-speed delivery protocol called HTTP/3. Think of this as a new type of truck that can carry many different packages at once in a single, streamlined container, making delivery incredibly efficient. However, not every shop in the city has upgraded their loading dock yet; many still only know how to handle the old, slower style of delivery (HTTP/1.1). This creates a strange situation where the delivery truck is super-fast on the highway but has to stop and unpack everything into a slow, bulky format the moment it reaches the shop's door. The big question researchers are asking is: Can a clever trickster exploit this "unpacking" process to cause chaos? If someone sends a tiny, efficient package to the truck, could it force the truck to unpack a massive, heavy load at the shop, overwhelming the shop's ability to serve real customers?
This paper, titled "CDN Tsunami," explores exactly that scenario. The researchers discovered that this mismatch between the new, efficient delivery trucks and the old, slow loading docks can be weaponized to launch a Denial-of-Service (DoS) attack. They found that an attacker doesn't need a massive army of computers to crash a website; they can use a single, small computer to trick the CDN into doing all the heavy lifting. The paper details two specific ways this happens. First, the "Bandwidth Amplification" (HBA) attack: an attacker sends a tiny, compressed request using the new HTTP/3 format. The CDN, acting as a translator, has to decompress this tiny request into a huge, uncompressed HTTP/1.1 request to send to the website. It's like sending a single postcard to a translator who then prints out a 500-page book to deliver to the shop, clogging the shop's delivery lane with paper. Second, the "Connection Amplification" (HCA) attack: an attacker starts a connection and then slowly trickles data to the CDN, forcing the CDN to keep the door to the shop open for a very long time. Since the new trucks can carry many streams at once, the attacker can force the CDN to open hundreds of these slow, lingering doors, filling up the shop's limited number of entryways so no real customers can get in.
The researchers tested these ideas against six major CDN providers in the real world. They found that all six were vulnerable to the "postcard-to-book" bandwidth attack, and five of them were vulnerable to the "slow door" connection attack. To see how big the problem really is, they built a tool to scan the top 1 million most popular websites on the internet. They discovered that while 151,685 of these sites are hosted on vulnerable CDNs, a staggering 42,330 of them have the new HTTP/3 system turned on, making them potential targets for these attacks. The authors emphasize that this isn't just a theoretical glitch; they demonstrated that an attacker could exhaust a website's bandwidth or connection limits with very little effort on their own part.
Crucially, the paper rules out the idea that these attacks require the victim to have special settings or large files; the only requirement is that the website is hosted on a CDN that supports HTTP/3 for customers but still uses HTTP/1.1 for the connection to the actual server. This is a common setup because many websites haven't fully upgraded yet. The researchers also argue against the notion that these attacks are too expensive or difficult to pull off. They showed that registering for a CDN service often requires nothing more than an email address, and the attack itself uses very little bandwidth from the attacker's side—less than 500Kbps for the bandwidth attack—making it cheap and easy to execute.
Following their discovery, the authors responsibly reported their findings to the CDN companies. Two of the vendors, Baidu and Tencent, acknowledged the vulnerabilities, awarded the researchers bug bounties, and have already deployed fixes. The proposed solutions involve limiting how big the "unpacked" requests can get and ensuring the CDN doesn't open a door to the shop until it has received the entire request, rather than just the first few words. The paper concludes that while the internet is getting faster with HTTP/3, this transition period has created a new, hidden weakness that needs to be patched to keep the digital city safe from these "tsunamis" of traffic.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.