1

I’m aware of several attack method names, such as fork bombs or csrf, but how do you define an attack that consists of making a single request to fill the whole server ram with a single process? That is, making the server spend its time managing swap and nothing else.

I know this is dos, but I want the precise name (for example fork bomb is a dos method). Anyway, I’m sure it is a common vector and I need specific documentation to it in order to convince someone letting a process filling the server ram with normal use isn’t an intended functionality. (If I have a name then finding something like a wikipedia article will be easy)

I couldn’t find anything similar anywhere.

Update

The case is about sending millions commands in a single git push over a zlib enabled ssh channel. (commands are queued in ram and start to be processed when all of them were received)

2 Answers 2

4

The very generic name for such an attack is a Denial of Service (DoS).

I guess more specifically it would be a RAM exhaustion attack vector. The best fit would probably be Uncontrolled Resource Consumption ('Resource Exhaustion').

Even more specifically it could be a flood attack:

Defining feature of floods is that the DoS effect only lasts while the flood is active, although some systems may keep allocated memory forever or crash when memory/CPU get depleted.

The article mentions flooding the server with requests, however depending on the system one such request may be enough to eventually fill RAM.

Without knowing exactly how the memory is being exhausted, it is difficult to come up with a more specific name for this.

5
  • I forgot to add the attack is performed by the decompression of an an ssh stream. The result of the decompressed stream is entirely buffered in ram before being written to disk. Commented Nov 21, 2015 at 13:21
  • Decompression bomb? Commented Nov 21, 2015 at 13:22
  • As it happens in ram and this is server side, I would think to something more specific. Commented Nov 21, 2015 at 13:22
  • A RAM based decompression bomb? I don't think you are going to get anything more specific than that. Not every attack vector can be described by a concise label - if you're writing something up then come up for a name for it yourself and fully describe how it works. Should it become common enough, the name will catch on on its own. Commented Nov 21, 2015 at 13:25
  • The fact is, git push are very vulnerable to this. Commented Nov 21, 2015 at 13:28
0

I would call it a memory exhaustion attack, although this name might not be specific enough for the case that this is caused by only a single process. It is part of the denial of service attacks (usually application level DOS) and a typical example for this kind of attack can be decompression bombs.

1
  • Yeah, I forgot to add the attack is performed by the decompression of an an ssh stream. The result of the decompressed stream is entirely buffered in ram before being written to disk. Commented Nov 21, 2015 at 13:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .