CDN Cannon: Exploiting CDN Back-to-Origin Strategies for Amplification Attacks
Description
This presentation introduces Back-to-Origin Amplification (BtOAmp) attacks, which exploit CDN performance-optimization strategies to overwhelm origin servers. Researchers demonstrate how specific back-to-origin mechanisms can be weaponized to achieve massive bandwidth amplification using minimal attacker resources.
CDN Cannon: Turning Web Accelerators into DDoS Amplifiers
Content Delivery Networks (CDNs) are the backbone of the modern web, serving as both performance accelerators and shields against Distributed Denial of Service (DDoS) attacks. However, groundbreaking research presented by Zhiwei Lin and Ziyu Lin at Black Hat Asia reveals a fundamental flaw in this architecture. By exploiting 'Back-to-Origin' strategies—mechanisms designed to optimize how CDNs fetch data from source servers—attackers can turn these shields into powerful cannons. This technique, dubbed Back-to-Origin Amplification (BtOAmp), allows a single laptop to take down a high-bandwidth enterprise website with ease.
The Irony of the CDN Shield
CDNs function by placing edge servers closer to users to cache content. When a cache miss occurs, the edge server performs a 'back-to-origin' request to fetch the data. This leg of the journey—between the CDN and the origin—is where the vulnerability resides. Historically, DDoS protection focused on preventing attackers from overwhelming the CDN. BtOAmp flips the script by using the CDN's own resources to overwhelm the origin server. Because the origin often trusts traffic coming from the CDN's IP addresses, these attacks bypass traditional IP-based filtering and firewalls.
Technical Deep Dive: The Four Faces of BtOAmp
The research identifies four distinct methods to achieve this amplification, each exploiting a different optimization strategy.
1. Image Optimization Abuse
Modern CDNs offer on-the-fly image processing. A user can request an image with parameters like format=webp or crop=100,100. The CDN fetches the original high-resolution image from the origin, processes it, and sends the result to the user.
The Attack: An attacker requests a 1x1 pixel crop of a massive 10MB image. The CDN must fetch the full 10MB from the origin server to perform the crop, but only sends a few hundred bytes back to the attacker. By repeating this, the attacker forces the origin to pump out gigabits of data while consuming almost no bandwidth themselves.
2. Request Modification
CDNs often modify requests before forwarding them to ensure compatibility or provide analytics (e.g., adding X-Forwarded-For headers).
The Attack: An attacker can configure a CDN (often through a free trial account) to append massive, oversized headers or rewrite short URLs into extremely long strings. A 100-byte request from the attacker can be expanded by the CDN into a 10KB or 100KB request. This consumes the origin server's inbound bandwidth, a particularly effective tactic against servers with asymmetrical connections.
3. Method Conversion (HEAD to GET)
To improve cache hit rates, many CDNs convert a client's HEAD request into a GET request. The logic is that if a user asks for headers, they will likely ask for the full file soon, so the CDN pre-fetches it.
The Attack: An attacker sends thousands of HEAD requests for large files. The CDN converts these to GET requests and fetches the full files from the origin. The origin sends the full payload to the CDN, but the CDN only sends the small headers back to the attacker. This creates a massive traffic imbalance at the origin's expense.
4. Connection Decoupling
CDNs often maintain a connection to the origin even if the client disconnects, ensuring the resource is fully cached for the next user.
The Attack: By using Transfer-Encoding: chunked or other header tricks, attackers can trick the CDN into maintaining a high-bandwidth download from the origin long after the attacker has closed their connection to the CDN. This allows for 'fire and forget' attacks where the CDN continues to hammer the origin autonomously.
Bypassing the Cache
For any of these attacks to work, the attacker must ensure the CDN doesn't serve the request from its cache. The researchers highlighted several 'Cache-Busting' techniques, the most common being URL parameter randomization. By appending a unique string like ?random=12345 to every request, the CDN is forced to treat each request as a unique 'miss' and fetch the data from the origin every single time.
Mitigation and Defense
Defending against BtOAmp requires cooperation between CDN providers and origin owners. The researchers suggest several key strategies:
- Parameter Limitation: CDN vendors must enforce strict limits on the size and complexity of image optimization and header modification parameters.
- RFC Compliance: CDNs should follow RFC standards more strictly; specifically, a
HEADrequest should remain aHEADrequest unless explicitly configured otherwise by the site owner. - Connection Synchronization: If a client connection drops, the CDN should prioritize closing the corresponding origin connection to prevent decoupling attacks.
- Ownership Validation: CDNs must verify that a user actually owns the origin server they are configuring to prevent attackers from using a CDN trial to attack third-party sites.
Conclusion
The CDN Cannon research serves as a stark reminder that performance optimizations often come with hidden security costs. In the race to make the web faster, we have inadvertently created a powerful infrastructure for amplification. As 12 out of 14 tested vendors confirmed these vulnerabilities, it is clear that the industry must move toward 'Security by Design' rather than just 'Performance by Design.' For developers and security teams, the lesson is clear: do not blindly trust traffic just because it originates from a CDN. Monitor your origin bandwidth and validate your CDN configurations today.
AI Summary
The presentation, titled 'CDN Cannon: Exploiting CDN Back-to-Origin Strategies for Amplification Attacks,' focuses on a new class of HTTP amplification vulnerabilities known as Back-to-Origin Amplification (BtOAmp). The speakers, Zhiwei Lin and Ziyu Lin, explain that while Content Delivery Networks (CDNs) are designed to improve performance and protect against DDoS attacks, their internal optimization strategies can be turned into weapons against the origin servers they are supposed to protect. The core of the issue lies in the asymmetry between the bandwidth required by an attacker to send a request to a CDN and the bandwidth consumed between the CDN and the origin server when the CDN processes that request. The researchers identified four primary attack vectors: Image Optimization, Request Modification, Method Conversion, and Connection Decoupling. In the Image Optimization attack, an attacker requests a highly compressed or cropped version of a large image (e.g., a 1x1 pixel crop). The CDN fetches the full, high-resolution image from the origin server but delivers only a tiny fragment to the attacker, creating a massive traffic imbalance. Request Modification exploits the CDN's ability to append large HTTP headers or rewrite URLs. An attacker sends a small POST request, which the CDN expands into a much larger request before forwarding it to the origin, exhausting the origin's inbound bandwidth. Method Conversion occurs when a CDN converts a HEAD request into a GET request to pre-fetch content for its cache. If the resource is not yet cached, the origin sends the entire file to the CDN, though the CDN only returns headers to the client. Finally, Connection Decoupling exploits the behavior where a CDN continues to download a resource from the origin even after the client has disconnected. The researchers found that by using specific 'Transfer-Encoding' headers, they could bypass modern mitigations and keep the CDN-to-origin connection alive. A critical prerequisite for all these attacks is bypassing the CDN's cache. The speakers detailed seven techniques for cache bypassing, primarily involving the randomization of URL parameters (e.g., adding ?s=123) to ensure the CDN treats every request as unique and forwards it to the origin. Their real-world evaluations against 14 major CDN vendors revealed that 11 were vulnerable. In a controlled test, they successfully overwhelmed a 1 Gbps origin server using only 200 Kbps of attacker bandwidth. The talk concludes with mitigation strategies, including stricter parameter validation, origin ownership verification, and better synchronization between client-side and origin-side connections. Most vendors have been notified, and several have already implemented patches based on this research.
More from this Playlist
Dismantling the SEOS Protocol
