Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Unauthenticated DoS by big messages #174

Open
Sandwichs-del opened this issue Jan 11, 2023 · 1 comment
Open

Unauthenticated DoS by big messages #174

Sandwichs-del opened this issue Jan 11, 2023 · 1 comment

Comments

@Sandwichs-del
Copy link
Contributor

Sandwichs-del commented Jan 11, 2023

I found two ways to DoS a PySyncObj server by naive fuzzing aka cat /dev/urandom >/dev/tcp/localhost/5010

First: If attackers has sufficient bandwidth, they can just send infinite stream of data. This causes __tryReadBuffer() to loop forever, saving everything in memory until it runs out.
Second: If attackers does not have sufficient bandwidth, they can still send message with length 0x7FFFFFFF and 2GiB of garbage. This again allows filling 2GiB of available memory per one attacker connection.

I fix it on my servers like this: https://github.com/Sandwichs-del/PySyncObj/tree/Sandwichs-del-patch-3-fix-unauthenticated-DoS, feel free to pull if you think changing __tryReadBuffer like that is acceptable.


But even with these holes plugged I am starting to feel it will never be as good as TLS (#46).

@Sandwichs-del
Copy link
Contributor Author

Sandwichs-del commented Jan 11, 2023

Protection on my servers was still too easy to bypass. An attacker who captured just one message signed by the right key could use it to defeat the protection. I updated protection of my server like this: https://github.com/Sandwichs-del/PySyncObj/tree/Sandwichs-del-patch-4-improve-DoS-protection, again feel free to inspire or pull if you think it is okay to limit size of SelfAddress message and of utility command messages like that.

After this, only attacker in position to hijack running TCP connection should be able to DoS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant