One Request to Kill Them All: Amplification, Data Landmines and Parser Killers

Application-level denial of service works by exploiting the quirks and misconfigurations of an application rather than flooding it with traffic. A single well-crafted request costs an attacker very little, yet can tie up server resources, and it is harder to detect than a volume spike. The talk groups these cases into three families: response size amplification, data landmines and parser killers.

The cases covered include a 5G router that returned a large response to a stream of commas and rebooted under a few parallel requests; a login form that echoed the submitted email several times, with HTML-encoded characters multiplying the response size; and a GraphQL endpoint whose verbose validation errors repeated a long operation name up to a hundred times. Other examples are stored API keys with no count or length limits, all returned by one fetch, a messaging parser that accepted malformed input and generated many error messages, and an email regex that backtracked heavily until response delays grew enough to fail. Where possible the findings were reported to the vendors before full outages were triggered, with further testing moved to staging.

The practical takeaways are to enforce length and count limits on all user input, avoid verbose error messages, paginate results, apply complexity limits to regular expressions, and add timeouts and circuit breakers. The speaker also suggested asking which request in the application is the most expensive to serve. GraphQL was only touched on, and the speaker noted it deserves a dedicated talk.