An attacker initiates a resource depletion attack where a large number of
small XML messages are delivered at a sufficiently rapid rate to cause a
denial of service or crash of the target. Transactions such as repetitive
SOAP transactions can deplete resources faster than a simple flooding attack
because of the additional resources used by the SOAP protocol and the
resources necessary to process SOAP messages. The transactions used are
immaterial as long as they cause resource utilization on the target. In
other words, this is a normal flooding attack augmented by using messages
that will require extra processing on the target.
Attack Execution Flow
Explore
Survey the target:
Using a browser or an automated tool, an attacker
records all instance of web services to process XML
requests.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
Use an automated tool to record all
instances of URLs to process XML requests.
env-Web
env-ClientServer
2
Use a browser to manually explore the
website and analyze how the application processes
XML requests.
env-Web
env-ClientServer
Indicators
ID
Type
Indicator Description
Environments
1
Positive
The URL processes XML requests.
env-Web
env-ClientServer
2
Positive
The application does not accept XML
requests.
env-Web
env-ClientServer
Outcomes
ID
Type
Outcome Description
1
Success
A list of URLs which process
XML requests.
Security Controls
ID
Type
Security Control Description
1
Detective
Monitor velocity of
page fetching in web logs. Humans who view a page
and select a link from it will click far slower
and far less regularly than tools. Tools make
requests very quickly and the requests are
typically spaced apart regularly (e.g. 0.8 seconds
between them).
Exploit
Launch a resource depletion
attack:
The attacker delivers a large number of small XML
messages to the target URLs found in the explore
phase at a sufficiently rapid rate. It causes denial
of service to the target application.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
Send a large number of crafted small XML
messages to the target URL.
env-Web
env-ClientServer
Outcomes
ID
Type
Outcome Description
1
Success
The attacker causes the target
application denial of
service.
Security Controls
ID
Type
Security Control Description
1
Detective
Monitor velocity of
page fetching in web
logs.
2
Preventative
Build throttling
mechanism into the resource allocation. Provide
for a timeout mechanism for allocated resources
whose transaction does not complete within a
specified interval.
Attack Prerequisites
The target must receive and process XML transactions.
Typical Likelihood of Exploit
Likelihood: Low
Methods of Attack
Flooding
Examples-Instances
Description
Consider the case of attack performed against the
createCustomerBillingAccount Web Service for an online store. In this
case, the createCustomerBillingAccount Web Service receives a huge
number of simultaneous requests, containing nonsense billing account
creation information (the small XML messages). The
createCustomerBillingAccount Web Services may forward the messages to
other Web Services for processing. The application suffers from a high
load of requests, potentially leading to a complete loss of availability
the involved Web Service.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
To send small XML messages
Skill or Knowledge Level: High
To use distributed network to launch the attack
Resources Required
Transaction generator(s)/source(s) and ability to cause arrival of messages
at the target with sufficient rapidity to overload target. Larger targets may be
able to handle large volumes of requests so the attacker may require significant
resources (such as a distributed network) to affect the target. However, the
resources required of the attacker would be less than in the case of a simple
flooding attack against the same target.
Solutions and Mitigations
Design: : Build throttling mechanism into the resource allocation. Provide
for a timeout mechanism for allocated resources whose transaction does not
complete within a specified interval.
Implementation: Provide for network flow control and traffic shaping to
control access to the resources.
