Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am new to the IT Security field and am essentially a developer as opposed to a networking person hence the question may be a dumb one

I am writing a REST service exposed to the internet which accepts files to be uploaded to the server, and the size could be up to 5 MB. We have restrictions on the server side to not accept content greater than 5 MB, but this happens after the fact - meaning after the content has been uploaded and we are already reading it. Which raises a few security related questions on DDOSing of our service:

  1. What happens if a bot net starts uploading 100MB files from 100 machines at the same time. This would mean that our network pipes are clogged handling 10GB of data while slowing down our real customers? How do we even detect such an attack where the number of servers are so less. Can we configure our IT infrastructure to block requests by payload size based on the service being accessed (we have multiple services hosted in our IT infrastructures)?
  2. Can you turn back requests from your IT infrastructure whose content length goes beyond a certain limit?
  3. In general, for a server which accepts POST/PUT requests, how do you protect from an attack which just uploads files on the POST request, even though the server is not meant to accept file uploads?
share|improve this question
    
I think the question if off-topic here. It's a very simple math formula how many clients can upload data to you at the same time, so the question is how to write code (or configure your servers) such that the system throttles clients when there is too much data. I think this question is more fit for StackOverflow (if you want to solve it with code) or Serverfault (if you want to solve it with configuration). –  Luc Jul 28 '13 at 16:12
1  
The question was not how much data we can accept at the same time. The question was how do you detect such an attack, and how do you protect from such malintentioned uploads. The problem with solving it with code is that then the data has already consumed your bandwidth, which is what I wanted to avoid. –  coderSam Jul 28 '13 at 17:16
1  
You're right. This is a threat to your web service. What to do about it? Wish there was an easy answer. There are strategies. This question is general enough that you should look at google for 'how to prevent a ddos attack' and read up. No specific answer available. –  Jonathan Jul 28 '13 at 18:18
2  
@coderSam Couldn't you just read up to 5MB and if you receive another packet then it returns an error? Then again they could just send a bunch of small files.. so you still lose. –  Griffin Nowak Jul 28 '13 at 20:30
    
@coderSam Ah okay, then I misunderstood! That sounds like it's at least on-topic here. –  Luc Jul 28 '13 at 21:54
show 1 more comment

1 Answer

but this happens after the fact

Really? What webserver are you using (you forgot to tell us). Apache, nginx, lighttpd all have options to limit the size of a request (the request is dropped if the client supplies a size greater than the limit in the header or the limit of data is received by the server).

If you want to validate the size before uploading it then you'd have to implement a non-sandboxed java applet.

This would mean that our network pipes are clogged handling 10GB of data

No - not if you implement QOS based traffic management. This can be tricky to do on the operating system (again you forgot to tell us what this is) - if you are using Apache then have a look at mod_qos or mod_bw

How do we even detect such an attack

Active monitoring + automated responses - If you're using some flavour of Unix, then ensure your webserver is confiugred to cap the post size and LOG MESSAGES on violation, then set up fail2ban to process those messages.

Can you turn back requests

Yes - see above. The only caveat is that someone trying to kill your servers may tell fibs in the content-length header (which is optional anyway).

share|improve this answer
    
Sorry for the delayed response. We are using apache http server, mule running on RHEL. Problem with content length is that, as you said, it can be forged. Validating the content length before upload is not possible as its a REST service exposed for anybody to call from the internet. Hence we would need something which can check incoming packets, link them together and as soon as its above 5MB, reject it. Is that possible? With deep packet inspection? –  coderSam Aug 6 '13 at 5:34
    
About QOS based traffic management, are you talking about mod-qos? Any specific guidance, reference you could give? –  coderSam Aug 6 '13 at 5:40
    
mod_qos is one solution (IIRC it supports minimum bandwidth guarantee). If you've got enough traffic, simply disabling the window scaling may be a viable solution. I've avoided using tc / tcng - I don't find it very intuitive - but it's available without installing any additional software. –  symcbean Aug 6 '13 at 8:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.