如果你能算上我:列举负载平衡器后面的QUIC服务器

Electron. Commun. Eur. Assoc. Softw. Sci. Technol. Pub Date : 2021-09-08 DOI:10.14279/TUJ.ECEASST.80.1172

K. Thimmaraju, B. Scheuermann

{"title":"如果你能算上我:列举负载平衡器后面的QUIC服务器","authors":"K. Thimmaraju, B. Scheuermann","doi":"10.14279/TUJ.ECEASST.80.1172","DOIUrl":null,"url":null,"abstract":"QUIC is a new transport protocol over UDP which is recently became an IETF RFC. Our security analysis of the Connection ID mechanism in QUIC reveals that the protocol is underspecified. This allows an attacker to count the number of server instances behind a middlebox, e.g., a load balancer. We found 4/15 (~25%) implementations vulnerable to our enumeration attack. We then concretely describe how an attacker can count the number of instances behind a load balancer that either uses Round Robin or Hashing.","PeriodicalId":115235,"journal":{"name":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","volume":"3 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2021-09-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"4","resultStr":"{\"title\":\"Count Me If You Can: Enumerating QUIC Servers Behind Load Balancers\",\"authors\":\"K. Thimmaraju, B. Scheuermann\",\"doi\":\"10.14279/TUJ.ECEASST.80.1172\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"QUIC is a new transport protocol over UDP which is recently became an IETF RFC. Our security analysis of the Connection ID mechanism in QUIC reveals that the protocol is underspecified. This allows an attacker to count the number of server instances behind a middlebox, e.g., a load balancer. We found 4/15 (~25%) implementations vulnerable to our enumeration attack. We then concretely describe how an attacker can count the number of instances behind a load balancer that either uses Round Robin or Hashing.\",\"PeriodicalId\":115235,\"journal\":{\"name\":\"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.\",\"volume\":\"3 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2021-09-08\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"4\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.14279/TUJ.ECEASST.80.1172\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Electron. Commun. Eur. Assoc. Softw. Sci. Technol.","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.14279/TUJ.ECEASST.80.1172","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}

引用次数: 4

摘要

QUIC是基于UDP的一种新的传输协议，最近成为了IETF RFC。我们对QUIC中连接ID机制的安全性分析表明，该协议没有明确规定。这允许攻击者计算中间设备(例如负载平衡器)后面的服务器实例的数量。我们发现4/15(约25%)的实现容易受到枚举攻击。然后，我们具体描述了攻击者如何计算使用轮询或散列的负载均衡器后面的实例数量。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

查看原文本刊更多论文

Count Me If You Can: Enumerating QUIC Servers Behind Load Balancers

QUIC is a new transport protocol over UDP which is recently became an IETF RFC. Our security analysis of the Connection ID mechanism in QUIC reveals that the protocol is underspecified. This allows an attacker to count the number of server instances behind a middlebox, e.g., a load balancer. We found 4/15 (~25%) implementations vulnerable to our enumeration attack. We then concretely describe how an attacker can count the number of instances behind a load balancer that either uses Round Robin or Hashing.

求助全文

通过发布文献求助，成功后即可免费获取论文全文。去求助

来源期刊

Electron. Commun. Eur. Assoc. Softw. Sci. Technol.

自引率

0.00%

发文量