4 ms·

YouTube And a Distributed Denial-of-Service Attack

46 points by rasterizer 13y ago

emko 13y ago
Aren't timeouts (TCP and whatever) supposed to handle this without resorting to global conspiracy?
- SpikeGronim 13y ago
  TCP cannot tell what the application wants. If the client application never closes the connection then TCP will keep that connection alive indefinitely (assuming you configured it with keep alives). Each connection consumes some resources on the server (primarily send and receive buffers in memory). So if your application never tells TCP to close the connection then it hogs server resources. There are many malicious DoS tactics that go for the same effect.
  - martindale 13y ago
    Would a sane server not set an upper limit to the lifetime of these connections? In YouTube's case, something like... the length of the longest video? edit: or perhaps even the _exact_ length of the video being requested? Also, since this is video, why isn't this UDP?
  - shitlord 13y ago
    > There are many malicious DoS tactics that go for the same effect. One of the most popular is a slowloris attack. It's particularly pernicious if it's distributed and coming from a botnet or something. https://en.wikipedia.org/wiki/Slowloris https://en.wikipedia.org/wiki/Slowloris
  - cortesoft 13y ago
    The server can close it though. Just have the server ignore keep-alives after a certain amount of time or something.
stephengillie 13y ago
Apple's got a history of noisy services. I remember when iOS 4.0.0 was blocked from the email service I was working for and many others because it basically spammed mail servers. A lot of our customers were mad that the software update disconnected them, but Apple released 4.0.1 quickly to address this.
meshko 13y ago
What is "application level streaming"?
- twoodfin 13y ago
  http://googlesystem.blogspot.com/2013/06/youtubes-smarter-video-player.html http://googlesystem.blogspot.com/2013/06/youtubes-smarter-vi... Rather than using a single HTTP request to pull a video stream, your player makes (hopefully intelligent) HTTP requests as needed to pull pieces of potentially multiple streams of different bitrates.
alt_ 13y ago
Likely like the iOS6 AV Foundation bug[0] back in November. It caused me quite a bit of headache, but the 6.0.1 bugfix was released quite quickly. [0] http://labs.prx.org/2012/11/14/ios-6-0-devours-data-plans-causes-cdn-overages/ http://labs.prx.org/2012/11/14/ios-6-0-devours-data-plans-ca...
- eridius 13y ago
  Probably not, since the article said the issue was TCP connections being left open. That doesn't describe the AV Foundation bug.

46 points by rasterizer 13y ago

emko 13y ago

Aren't timeouts (TCP and whatever) supposed to handle this without resorting to global conspiracy?

SpikeGronim 13y ago
TCP cannot tell what the application wants. If the client application never closes the connection then TCP will keep that connection alive indefinitely (assuming you configured it with keep alives). Each connection consumes some resources on the server (primarily send and receive buffers in memory). So if your application never tells TCP to close the connection then it hogs server resources. There are many malicious DoS tactics that go for the same effect.
- martindale 13y ago
  Would a sane server not set an upper limit to the lifetime of these connections? In YouTube's case, something like... the length of the longest video? edit: or perhaps even the _exact_ length of the video being requested? Also, since this is video, why isn't this UDP?
- shitlord 13y ago
  > There are many malicious DoS tactics that go for the same effect. One of the most popular is a slowloris attack. It's particularly pernicious if it's distributed and coming from a botnet or something. https://en.wikipedia.org/wiki/Slowloris https://en.wikipedia.org/wiki/Slowloris
- cortesoft 13y ago
  The server can close it though. Just have the server ignore keep-alives after a certain amount of time or something.

stephengillie 13y ago

Apple's got a history of noisy services. I remember when iOS 4.0.0 was blocked from the email service I was working for and many others because it basically spammed mail servers. A lot of our customers were mad that the software update disconnected them, but Apple released 4.0.1 quickly to address this.

meshko 13y ago

What is "application level streaming"?

twoodfin 13y ago
http://googlesystem.blogspot.com/2013/06/youtubes-smarter-video-player.html http://googlesystem.blogspot.com/2013/06/youtubes-smarter-vi... Rather than using a single HTTP request to pull a video stream, your player makes (hopefully intelligent) HTTP requests as needed to pull pieces of potentially multiple streams of different bitrates.

alt_ 13y ago

Likely like the iOS6 AV Foundation bug[0] back in November. It caused me quite a bit of headache, but the 6.0.1 bugfix was released quite quickly. [0] http://labs.prx.org/2012/11/14/ios-6-0-devours-data-plans-causes-cdn-overages/ http://labs.prx.org/2012/11/14/ios-6-0-devours-data-plans-ca...

eridius 13y ago
Probably not, since the article said the issue was TCP connections being left open. That doesn't describe the AV Foundation bug.