WS Denial of Service


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

WS Denial of Service

  1. 1. WS-Denial_of_Service Dariusz Grabka M.Sc. Candidate University of Guelph February 13 th 2007
  2. 2. The Point <ul><li>The Internet is fault tolerant because its functionality is distributed; Web Services (WS) are not. WS emulate enterprise architecture. </li></ul><ul><li>Servers on the Internet are susceptible to Denials of Service; WS are doubly (2x) sensistive. </li></ul><ul><li>Clients of WS are victimised as well; inherent to Service oriented architecture. </li></ul><ul><li>We need performance evaluations, secured connections, and limited exposure of WS functionality to protect from DoS. </li></ul>
  3. 3. The Outline <ul><li>The Internet and Distributed Risk </li></ul><ul><li>What is Denials of Service (DoS) </li></ul><ul><li>Web Services and their Clients </li></ul><ul><li>DoS Sensitivity </li></ul><ul><li>WS are Resource Intensive </li></ul><ul><li>Protecting WS from DoS </li></ul>
  4. 4. The Internet <ul><li>High availability of core services </li></ul><ul><ul><li>Internet Protocol (IP) addressing, Domain Name services (DNS), content serving over web (HTTP) and email (SMTP), etc. </li></ul></ul><ul><li>Functionality distributed, runs on each node of the Internet </li></ul><ul><ul><li>If one node fails, rest of Internet still has functionality </li></ul></ul><ul><ul><li>Many Linux distros have all necessary software </li></ul></ul><ul><ul><li>Unlike Web Services, where functionality is specialized at each node </li></ul></ul>
  5. 5. The Internet <ul><li>Internet nodes have exposed functionality (web servers, mail servers, etc.) </li></ul><ul><ul><li>Publicly accessible – trade off availability for susceptibility to attacks </li></ul></ul><ul><li>Many types of attacks </li></ul><ul><ul><li>Denial of Service (DoS) </li></ul></ul><ul><ul><li>Distributed Denial of Service (DDoS) </li></ul></ul><ul><ul><li>Spoofing – falsifying identity </li></ul></ul><ul><ul><li>Man-in-the-Middle – intercepting messages </li></ul></ul>
  6. 6. Denial of Service <ul><li>Overwhelm a system with requests </li></ul><ul><ul><li>Sum of minimally processing requests overwhelms system resources </li></ul></ul><ul><ul><li>Cannot respond to legitimate requests for service </li></ul></ul><ul><li>Requests can be: </li></ul><ul><ul><li>Malformed, Incomplete </li></ul></ul><ul><ul><li>Properly formed, and induce resource-intensive functionality </li></ul></ul><ul><ul><li>Formed to take advantage of vulnerability </li></ul></ul><ul><li>Single attacker, or multiple simultaneous attackers (DDoS) </li></ul><ul><li>Combined with Spoofing and Man-in-the-Middle </li></ul>
  7. 7. Web Services <ul><li>Before service oriented architecture (SOA): software interfaces to enterprise-critical functionality hidden away from Internet </li></ul><ul><ul><li>Done for safety, stability </li></ul></ul><ul><ul><li>Software services often localized at client location </li></ul></ul><ul><li>Web Services expose critical functionality by design </li></ul><ul><ul><li>Architecture different than the distributed Internet </li></ul></ul><ul><ul><li>WS emulate enterprise – specialised functionality at each node </li></ul></ul><ul><ul><li>Functionality dependent on availability of other nodes </li></ul></ul>
  8. 8. Web Service Clients <ul><li>Clients rely on the availability of the Web Service – WS enterprises are in the business of network uptime </li></ul><ul><ul><li>Must develop expertise to protect from attacks </li></ul></ul><ul><li>Clients of WS are affected by a DoS at the host or publisher of the service </li></ul><ul><ul><li>DoS affects internal functionality at the client site!! </li></ul></ul><ul><ul><li>Internet congestion, routing problems, etc. </li></ul></ul><ul><li>Client more susceptible than with localized or distributed model of software services </li></ul>
  9. 9. Double Sensitivity <ul><li>WS can experience DoS in two forms </li></ul><ul><ul><li>The transport protocol host: HTTP, SMTP, etc. </li></ul></ul><ul><ul><li>The Web Service itself </li></ul></ul><ul><li>To help attackers, the WSDL file provides functionality specification </li></ul><ul><ul><li>… though no more than public documentation </li></ul></ul><ul><li>Web Services are resource intensive </li></ul><ul><ul><li>Industry evidence suggests large gaps: 60% bulkier, 6 times slower than competing technolgy </li></ul></ul>
  10. 10. Protecting from DoS <ul><li>Transport protocol is probably OK </li></ul><ul><ul><li>Much research into protecting HTTP servers from DoS: avoid or stop attacks </li></ul></ul><ul><ul><li>Very little research in DoS protection for WS </li></ul></ul><ul><li>Several methods </li></ul><ul><ul><li>Secured and dedicated connections </li></ul></ul><ul><ul><li>Performance evaluations of platform </li></ul></ul><ul><ul><li>Limit exposure of resource intensive functionality </li></ul></ul><ul><ul><li>Establish trust between client and service provider </li></ul></ul>
  11. 11. Protecting from DoS <ul><li>Connections </li></ul><ul><ul><li>Dedicated connections for WS traffic between enterprises, hidden from general Internet traffic </li></ul></ul><ul><ul><li>Secured connections: Virtual Private Network (VPN), encrypted tunnels </li></ul></ul><ul><ul><ul><li>Identity of parties known, can avoid spoofing and man-in-the-middle </li></ul></ul></ul><ul><ul><li>Auditing security policies to avoid DoS within the shared, secured environment </li></ul></ul>
  12. 12. Protecting from DoS <ul><li>Performance Evaluation </li></ul><ul><ul><li>Not all WS platforms created equal </li></ul></ul><ul><ul><li>Determine threshold for DoS </li></ul></ul><ul><ul><li>Is a WS the best choice for implementing your service oriented architecture? </li></ul></ul><ul><li>Limit Exposed Functionality </li></ul><ul><ul><li>Initial contact should require authentication, authorization </li></ul></ul><ul><ul><li>Resource-light dismissal of requests </li></ul></ul><ul><ul><li>Authentication token for resource-heavy functionality </li></ul></ul>
  13. 13. Conclusion <ul><li>WS architecture is doubly susceptible to DoS: transport protocol, and WS itself </li></ul><ul><li>Clients of WS are at risk when service provider is at risk </li></ul><ul><li>Steps must be taken to minimize DoS risk </li></ul><ul><ul><li>Dedicated connections </li></ul></ul><ul><ul><li>Security, policy, authentication, authorization </li></ul></ul><ul><ul><li>Limited exposure of functionality </li></ul></ul><ul><ul><li>Performance evaluation: load-test those heavyweight platforms! </li></ul></ul>
  14. 14. <ul><li>Thank You for your attention! </li></ul>