One key aspect of a DOS or DDOS seems to be to leverage the required computational power on the attackers side to maximize the impact on the target side. This wiki article lists many examples of such attacks.

So imagine a .Net website with a page that for whatever reason crashes on a standard GET-request. Resident .Net expert Jon Skeet went into the performance of .Net exceptions for a bit. His take away seems to be that during regular operation the performance impact is not worth bothering about, as the number of exceptions should be fairly small.

But what if this alway-crashing website was to be flooded with requests that would trigger exceptions on the server-side? Could that be a feasible attack that would need to be taken into account when testing a website for vulnerabilities?

  • anything that takes time is a vector. while exceptions are fast, they might be logged heavily enough that it crashes your log db, which could cause the LB to stall which could cause the server to become useless. – dandavis Feb 5 '18 at 23:01

Exceptions are very fast. Even if they do full traceback and making nice HTML out of it.

If you hit an exception because you supplied illegal argument, there may be not even single sql query made which would make it faster than regular request.

My websites always log exceptions into database, but that database is not part of live system, so slowing it down doesn't affect the performance of the whole system but only monitoring part of it.


This is indeed one of the cases where the same tools used by the "defenders" can also be used by the "attackers". There is a book which was unique for its time, in that it was the first to document the ways in which cryptography could be used not just as a defensive, but also an offensive (Malicious Cryptography: Exposing Cryptovirology, FWIW).

However, I put to you that you're missing the most significant bottleneck, which is to be measured using the same profilers that the software developers would use. Determine the most significant bottleneck using profilers, and use that; don't automatically assume that you'll find that bottleneck in exception-laden code.

The computational issue with exceptions is that there are classes of optimisations it can disable, but we focus too much on that. The real issue, and one that we don't discuss often enough, is that exceptions are like goto, but in three dimensions (spanning not just one function, but multiple levels of function calls, to potentially create "spaghetti code"); when used inappropriately (which is easy to do, as in the case of goto), they can turn maintenance into a serious headache! Thus, the most significant bottleneck of exceptions is much more likely measured in human hours, rather than CPU microseconds...

Hence, from a security perspective, and at a level much higher than the machine level... at a personal level, you could certainly use exceptions as a form of denial of service. DEFCON 23 presented a similar idea in a presentation entitled Repsych: Psychological Warfare in Reverse Engineering. The goal, however, is not to bring down a system but to convince prying eyes to surrender and walk away. It's an interpersonal denial of service. You could use this idea of yours with moderate success, to torment antivirus analysts for example.

Otherwise, I think you should focus on using your profiler to determine the most significant bottleneck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.