Attack Vector: Application DDoS

Quick review of Netflix article.

Application DDoS

There is a blogpost on Netflix which describes a new attack vector called Application DDoS. While traditional DDoS attacks rely on causing heavy network traffic to overload a system, application DDoS relies on heavy computation to bring down a microservice architecture.

Let's start with how this is suppose to work. In a microservice architecture, you have a network of microservices that rely on each other. Calling one service can lead to that service calling multiple other services that call other services. This gives attackers the ability to make one request that actually makes many many more internal requests. By leveraging this idea, they can amplify their attack on the system.

a single request in a microservices architecture may generate tens of thousands of complex middle tier and backend service calls

This attack cannot be stopped by a traditional firewall because it may not know that the initial request is causing harm in lower layers. It may also not know how much work per request will generate later.

What to do

The first step is to understand how your system operates, and identify the inter-dependencies between systems. From there you will want to limit the impact on customer-facing services. If one service looks to be unstable, the rest of your services should work in a degraded state.

The real key here is to:

Putting a limit on the allowable work per request can significantly reduce the likelihood of exploitation.

Takeaway

Relationships between your services has important performance impacts.  DDoS attacks take advantage of these vulnerabilities, so we must be mindful of how these work, and to design robust systems that can defend against them.