HTTP Desync Attack Explained With Paper

Key Takeaways

i um i go here up in the middle that's good that's a good spot here okay welcome to the internet so this is a very typical server setup that you have nowadays um uh online so imagine your web browser and you go on a website oftentimes you connect to one server so this load balancer or proxy is a server that you are connecting here so you have to imagine that a request is coming here from from this side and this load balancer is then proxying those requests to an internal backend service so this is the actual web server and this is just a proxy just a thing to manage requests so this thing is for example responsible maybe for rate limiting or it will maybe there are many there are a lot of different backend internal servers like hundreds maybe of internal servers handling the actual application logic and um you have one big load balancer and this load balancer doesn't do any real big computation all it does is takes your request and forwards it to a back-end service or one of the different servers and so forth so this is a very typical setup even in a one server setup it's often the case that you have a proxy in front of it and a back end after it especially when you have when you use things like amazon or like when you host your website on amazon or with google cloud or whatever then you have the google load balancer or the amazon load balancer also automatically kind of and maybe in front of it you don't even maybe realize it and then you have your website behind it very typical setup you have a request coming in to the load balancer and the load balancer now sends it over to the back end servers networks servers are connected over network with sockets for example and a socket is just a stream of of bytes right it doesn't have a socket you don't really need to know about how the networking with tcp or whatever really works underneath and you don't really need to understand http either um all we can what it how sockets work is um you you write data in and you can read that data again it's just a stream of data you just write zeros and ones in there in on the load balancer is writing that on one socket and the back end is then reading the data coming in now when you think of an a request coming in this request has a start and an end and you need to define what the start and end is so in this paper example let's say requests are separated by a line okay each request is separated by a line so now let's think about this let's say we send a request here we have here a line and we say we want to request no i don't have an example the the note number one okay we request the node number one so the load balancer is writing i want the node number one and to indicate the end of this request is drawing a line here and now comes the back end the back end now reads this data and it reads node 1 and sees the line and will now give you the content back so it will respond here with content a b c d it returns to you the node so it will write the date the abcd here and indicates with the line the end is done so you as a user you send your request to the load balancer and you indicate it i want node one that was forward to the back end and backend now returned with abcd indicating with a line the request is done and returning that now to you now we read the response abcd and now we come to http dsync attack kind of like the the principle idea of this attack class and remember what the rule i told you was the rule i told you was that requests are separated by lines okay a line indicates the separation of requests so let me create here a request coming in from the outside okay you sent an http request and i draw you this request really quick here and you tell me now what happens okay so i'm sending in now this request to the load balancer okay i'm sending this to the load balancer i [ __ ] this up so this is coming in i'm sending this is oh wait i [ __ ] it up i [ __ ] it up i [ __ ] it up okay here's the line missing okay so this is the request i sent coming in to the load balancer okay this the load balancer understands lines the load balancer understands that the line is the end of a request but this load balancer is implemented in a shitty way because it only understands black lines okay the load balancer sees this whole thing this data and sees a black line this is my request here's the black line so what does the load balancer do it forwards now this packet onto the socket and sends the data over to the back end now the back end is implemented differently it also understands lines but it also understands red lines now the back end uh thinks because it's just a socket like it doesn't understand it it sees now oh there are two requests waiting i'm seeing two lines so the back end will now send the response back node1 again abcd and will return that data now to me right like the the load balancer takes now this data and sends it back to my browser okay but now it also received the second request now it wants the admin information and the back end sees that second request because there's another line so this is another request and it will send back um a secret let's make this uh yeah xxx that's the secret okay it will send back this but i received already my response i have received abcd so the load balancer has a response waiting here that was not yet handled now imagine a normal user is coming in a normal user maybe wants to read note 2. a normal user sends now a request to the load balancer and says i want node 2 the load balancer sees the line so it knows this is one request and puts it onto the socket please give me no two the back end sees oh yeah there's a new note it has a line this is one request and it will create a response with ccc okay this is the node two it will respond with this data the load balancer now knows okay i need to read one response now from the receiving from the socket here and return that to the user but we haven't returned this response yet so what we will now return is this response is now returned to the user and now we have a dc and this is the desync state right um there's a there was a second response still pending on the on this socket here the response from the back end that the load balancer hasn't given a user yet and when the load balancer received another request send it to the back end um it was reading a response but it was reading this pending response still sitting on that socket and that's basically how dsync attack works this misunderstanding of what it means that requests are separated by a line the load balancer was dumb and only understood black lines so it forward this whole thing as one request but the back end understood also red lines so the back end thought oh the load balancer is sending me two requests so i have to send two responses but the load balancer thought it's only one request and only returned one response and so then when the next user came it returned this other pending response does that make sense why the back end handles lines if the load balancer does it in the front already uh that's just how it's implemented um there's just socket connect the load balancer is really dumb and the load balancer takes http requests and just forwards those http requests and so in when we now speak about the actual http dsync attack and we think about http requests the basic http uh dsync attack works because you have different content encoding so you have the content length that tells you how large is the whole request but you can also have chunked encoding where you now send the data in chunks and so this is basically this difference where the load balancer might think i'm sending um is looking maybe at the content length and so it's sending the whole http packet but the back end sees the the chunked encoding and interprets it as two chunks or something like this you know is a line so this is just abstract these lines do not really exist this is just abstract to explain that requests need to be separated somehow or like these requests need to be separated in this example they are separated by a line and do you think happens because these two systems disagree what a line is the load balancer only understands black lines while the back end understands red and black lines and this misunderstanding in parsing data causes this this is you can even abstract this further and we call we can call this a parcel differential there's a parser for requests here and a parser for requests here and they have a slightly different behavior and that is many times exploitable a lot of security issues happen because you have parts that try to understand the same data but do it slightly differently and this misunderstanding between those two parts can lead to security issues and that's why generally when we say things like we don't want complex protocols and we need very good references it's for security reasons because these these programmers that implement these things maybe one of them did it wrong maybe when i said we need to separate requests at lines maybe it meant i meant every line depend the color doesn't matter but maybe also adjustment black lines so it needs to be defined and when uh um these these standards of how a protocol is has to be implemented are not very very strict and leave room for interpretation you might end up with two different implementations that can be played against each other does that make sense this can also be done with responses not only requests yeah of course at the fundament it is two systems understand data differently yeah so this was my abstract explanation of how a desync attack works [Music] you