logo
logo
Sign in

Hidden Algorithm Flaws Expose Websites to DoS Attacks

avatar
Geekz Snow
Hidden Algorithm Flaws Expose Websites to DoS Attacks

But while classic DDoS attacks, which overwhelm a site with junk traffic, have persisted and evolved across the web, researchers are warning about a new spinoff: subtle attacks that target not server capacity, but algorithms.

Many websites and services rely on algorithms to transform data inputs into actions and results.

But new research detailed Thursday at the Black Hat cybersecurity conference in Las Vegas shows how a small, seemingly innocuous input for an algorithm can cause it to do a huge amount of work—slowing a service down or crashing it entirely in the process, all with just a few bytes.

Nathan Hauke and David Renardy of the security firm Two Six Labs started looking for these "algorithmic complexity" issues in mainstream services, and quickly found them in PDF readers, remote desktop servers, and a popular password strength evaluation tool.

Their research showed that, given some carefully crafted inputs, they could bring all of those services to a halt.

What's troubling is that these vulnerabilities aren't really software bugs that can be easily patched or fixed—they're fundamental issues in the way algorithms are built and implemented that allow a tiny input to generate major resource drain.

collect
0
avatar
Geekz Snow
guide
Zupyak is the world’s largest content marketing community, with over 400 000 members and 3 million articles. Explore and get your content discovered.
Read more