28c3: Effective Denial of Service attacks against web application platforms
Why Stack Overflow recommends it
Stack Overflow users link it as the primary source for the HashDoS hash collision attack, both to explain why hash tables can degrade to O(n^2) and to justify randomized map iteration or hashing in languages like Go.
Recommended by 0 people across 0 different months, 2011 to 2012.
What it is
A 28C3 conference talk by Alexander Klink and Julian Wälde (zeri) showing how a shared flaw in hash table implementations across PHP, ASP.NET, Java and other web platforms lets one crafted HTTP request pin a server's CPU at 99% for minutes to hours. It explains the hash collision denial of service attack and its mostly platform independent nature.
What people said
Cites AppleGrew · 2011-12 · Stack Overflow · on “HashDoS: how can worst case complexity of Hashtable be O(n^2)?”
By now many of you must have heard about HashDoS [LINK] . The researchers who found this, claim in their video [this video] that the worst case complexity of Hastable is O(n^2) . How can this be?
Cites VonC · 2012-08 · Stack Overflow · on “Assignment order”
A map shouldn't always print its key-element in any fixed order: See " Go: what determines the iteration order for map keys? [LINK] " However, in the newest Go weekly release (and in Go1 which may be expected to be released this month), the iteration order is randomized (it starts at a pseudo-randomly chosen key, and the hashcode computation is seeded with a pseudo-random number). If you compile your program with the weekly release (and with Go1), the iteration order will be different each time you run your program. It isn't exactly spelled out like that in the spec though ( Ref Map Type [LINK] ): A map is an unordered group of elements of one type, called the element type, indexed by a set
Cites DeadAlready · 2012-09 · Stack Overflow · on “DDoS vulnerable forms”
DDoS'ing by submitting large amounts of data would require some vulnerability in data processing, otherwise it is not really plausible since the attackers upload speed becomes a bigger factor. It would be much easier to attack with using slowloris [LINK] or ping floods. Using data an outdated server can be DDoS'ed by using variable parsing problem aka the Hash Collision attack (not only PHP). It is discussed on the 28th Chaos Communication Congress which can be watched here [this video] .