1

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That is, making the server spend its time managing swap and nothing else.

I know this is dos, but I want the precise name (for example fork bomb is a dos method). Anyway, I’m sure it is a common vector and I need specific documentation to it in order to convince someone letting a process filling the server ram with normal use isn’t an intended functionality. (If I have a name then finding something like a wikipedia article will be easy)

I couldn’t find anything similar anywhere.

Update

The case is about sending millions commands in a single git push over a zlib enabled ssh channel. (commands are queued in ram and start to be processed when all of them were received)

2 Answers 2

4

The very generic name for such an attack is a Denial of Service (DoS).

I guess more specifically it would be a RAM exhaustion attack vector. The best fit would probably be Uncontrolled Resource Consumption ('Resource Exhaustion').

Even more specifically it could be a flood attack:

Defining feature of floods is that the DoS effect only lasts while the flood is active, although some systems may keep allocated memory forever or crash when memory/CPU get depleted.

The article mentions flooding the server with requests, however depending on the system one such request may be enough to eventually fill RAM.

Without knowing exactly how the memory is being exhausted, it is difficult to come up with a more specific name for this.

7
  • I updated the question. Nov 21, 2015 at 13:13
  • Answer updated. Nov 21, 2015 at 13:19
  • I forgot to add the attack is performed by the decompression of an an ssh stream. The result of the decompressed stream is entirely buffered in ram before being written to disk. Nov 21, 2015 at 13:21
  • Decompression bomb? Nov 21, 2015 at 13:22
  • As it happens in ram and this is server side, I would think to something more specific. Nov 21, 2015 at 13:22
0

I would call it a memory exhaustion attack, although this name might not be specific enough for the case that this is caused by only a single process. It is part of the denial of service attacks (usually application level DOS) and a typical example for this kind of attack can be decompression bombs.

1
  • Yeah, I forgot to add the attack is performed by the decompression of an an ssh stream. The result of the decompressed stream is entirely buffered in ram before being written to disk. Nov 21, 2015 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .