31

Ok, so I'm using AWS and with a serverless architecture, it's very practical since AWS Lambda will run functions as microsservices and I don't have to deal with servers.

Not only that, but it's also auto-scalable, and they charge in this 'pay-as-you-go' format. Everything seems good, but...

Well, thinking in terms of security and possible attacks, I can imagine one type of attack where it's not necessarily a DDoS, but an attacker would just repetitively request data from my servers from multiple clients spread throughout a month (so it won't trigger API rate limits), so that my costs will increase drastically (because of pay-as-you-go + auto scaling) and essentially leaving me with a $10.000 bill at the end of the month.

I understand the term "cost attack" probably doesn't exist yet, but it can become more common as services move to serverless environments (AWS, Google Cloud, Azure, etc.)

Ideas on how to deal with it or prevent it?

  • 5
    I think cost attack is a very good term. Is there a way to distinguish valid and cost attack use? I'd assume it could be very hard. – Tero Lahtinen Apr 14 '18 at 18:31
  • 9
    This is not just an issue with server-less architectures, but is an attack model that has existed since the early days of the Internet. The oldest attacks I can think of are when attackers would maliciously drive up bandwidth-bills by repeatedly downloading very large files. – Xander Apr 14 '18 at 19:23
  • 1
    I believe the correct term for this is DoW as opposed to the common DoS. The W stands for wallet. – Sandy Chapman Apr 15 '18 at 3:13
  • "AWS allows you to set budgets (so your services would shut down instead of getting a $10k bill at the end of the month)," - there's no built-in budget feature of Amazon which results in shutting down services. One can program it manually though. – Grzegorz Oledzki Apr 15 '18 at 12:25
31

AWS allows you to set budgets, and alarms based on your current rate of spending. Those would be useful to control your spending. In theory, you could also set billing-based automation to start scaling down services to avoid a $10k bill at the end of the month.

AWS Budgets Tutorial

If your spending alarms go off, then you'd take a look and see why your costs are abnormal this month and determine what needs to be done to mitigate the attack. At that time, your actions will depend on what's driving your costs up.

It may be difficult to differentiate whether the costs are legitimate use or an attack. Following standard threat modelling practices will help you to identify parts of your application susceptible to this type of attack. In particular, try to limit the ability of unauthenticated users to access parts of the application that are resource intensive.

  • 4
    "try to limit the ability of unauthenticated users to access parts of the application that are resource intensive" - I like this. Do you know if unauthenticated calls that are denied by the API gateway count as traffic usage? – raphadko Apr 14 '18 at 19:14
  • I'm not that familiar with the specific service. That advice is more of a general security principle that helps to prevent any kind of Denial of Service attack. A cost attack is still DoS, except in this case the resource they're using up is your bank account. 🤑 – nbering Apr 14 '18 at 19:16
  • To provide a more specific example, if you're using Lambda, try to exit as quickly as possible if the user is not logged in. Don't even make a database call if it can be avoided. – nbering Apr 14 '18 at 19:18
  • 2
    You can actually use AWS cognito to authenticate and check, so you don't even write a custom lambda for auth, I'm just not sure if these calls stack up in the costs. Also, minimally, one would have to serve a login page through S3. – raphadko Apr 14 '18 at 19:50
  • Isn't it the case that AWS Budgets only allow notifications but don't allow the scenario whereby "your services would shut down instead of getting a 10k bill ..."? – Ronald Monson Apr 14 '18 at 23:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.