New HTTP/2 vulnerability leaves servers in danger of devastating DoS attacks, even from a single TCP connection
Www.oeisdigitalinvestigator.com
Serving tech enthusiasts for over 25 years.
TechSpot means tech analysis and advice you can trust.
What just happened? Introduced in 2015, HTTP/2 brought several enhancements to the HTTP protocol including efficient data transmission, request handling, responsiveness, and header compression for website-based information transactions. But in addition to those efficiencies, HTTP/2 also brought its own unique set of challenges for administrators and security teams. Earlier this week, researchers announced a newly discovered HTTP/2-related exploit that can be used to conduct denial-of-service (DoS) attacks against vulnerable targets.
In a report from The Hacker News, security researcher Bartek Nowotarski was credited with reporting the issue to Carnegie Mellon’s Computer Emergency Response Team (CERT) Coordination Center on January 25.
The vulnerability, known as HTTP/2 CONTINUATION Flood, exploits improperly configured HTTP/2 implementations that fail to limit or sanitize the CONTINUATION frames in a requests’ data stream.
CONTINUATION frames are a method used to continue a sequence of header block fragments, allowing header blocks to be split across multiple frames. The previously-fragmented header block is considered completed when the server receives a specific END_HEADERS flag, indicating that there are no further CONTINUATION or other frames.
HTTP/2 implementations are vulnerable to attack when the implementation does not limit the amount of CONTINUATION frames that can be sent within a single data stream. Should an attacker begin an HTTP request to a vulnerable server with no set END_HEADERS flags, the request would allow the attacker to send an ongoing stream of CONTINUATION frames to that server, eventually causing an out-of-memory crash and resulting in a successful denial of service (DoS) attack.
CERT also cited another variation of the vulnerability that uses HPACK Huffman encoded CONTINUATION frames cause CPU resource exhaustion, also resulting in a successful DoS attack.
According to Nowotarski, a single machine or even a single connection has the potential to disrupt server availability, with consequences ranging from crashes to performance degradation.
Unlike a distributed denial of service (DDoS) attack that creates large scale botnets to overwhelm networks through sheer traffic volume, a DoS attack can create fake web traffic using a single device by flooding a transmission control protocol (TCP) connection with requests designed to exhaust a target server’s resources.
Several Common Vulnerability and Exposure (CVE) records have been created related to the new vulnerability. These include:
CVE-2024-28182 – Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
CVE-2024-27983 – node::http2::Http2Session::~Http2Session() leads to HTTP/2 server crash
CVE-2024-2758 – Tempesta FW rate limits are not enabled by default
According to a survey from w3techs.com, HTTP/2 is currently used by approximately 35.5% of all websites.
Administrators of affected servers should upgrade any software identified in the CVEs to the latest version in order to mitigate potential CONTINUATION threats. If a fix is not available, administrators are advised to consider temporarily disabling HTTP/2 on the impacted servers.
Examine the forefront of digital research in our Latest News & Blog. Study expert analyses, technological advancements, and key industry insights that keep you informed and prepared in the ever-evolving world of digital forensics.
Cloud computing has always been marketed to enterprises as a more cost-effective way for companies to access the compute resources they need, because they only pay for what they use and can easily scale back how much they are using, based on demand.
Enterprises were encouraged, on the back of these benefits, to streamline their on-premise datacentres and start migrating the applications and workloads that resided in them to the public cloud.
In the early 2010s, it is fair to say that companies had a much wider choice of public cloud providers to entrust their data to, with (the technology firms formally known as) HP and Dell both having enterprise propositions in this space, alongside Rackspace and the likes of Microsoft, Google and Amazon Web Services (AWS).
Towards the latter half of that decade, HP, Dell and Rackspace (and a handful of others) had all bowed out of the public cloud race, with the rise of AWS often cited as a factor in their decisions to pivot their business models towards a mix of private and managed cloud services provision.
This, in turn, has paved the way for the cloud infrastructure market to become the three-horse race it is today, with AWS leading the charge, followed by Microsoft and Google Cloud.
With around two-thirds of an entire market dominated by just three players, it is perhaps unsurprising that the hold companies like AWS, Microsoft and Google have on the cloud infrastructure services market is coming under increased regulatory scrutiny in various markets across the world – and the UK is no different.
In September 2022, the communications regulator Ofcom launched year-long probe into the UK’s £15m cloud services market, with particular emphasis on the actions and activities of the market’s biggest players: AWS, Microsoft and Google.
The study’s aim, as outlined by Ofcom at the time, was to “assess the strength of the competition in cloud services and the position key companies hold in the market” under the terms of the Enterprise Act 2002, which is an act of Parliament concerned with preserving market competitiveness.
Halfway through its investigation, Ofcom published an interim report in April 2023 that singled out AWS and Microsoft, specifically, for engaging in anti-competitive behaviours that it claimed might financially disadvantage UK consumers and businesses.
The “behaviours” were serious enough for Ofcom to confirm it was consulting on whether to refer the UK cloud infrastructure services market to the Competition and Markets Authority (CMA).
This was in the wake of its investigation bringing to light evidence that users were being hampered in their ability to switch from one cloud provider to another or add additional ones to their roster of technology providers.
Despite opposition from both Amazon and Microsoft, Ofcom confirmed – at the time its final report into the UK cloud infrastructure services market dropped in October 2023 – that it would be referring the market to the CMA for a further anti-trust probe.
Www.oeisdigitalinvestigator.com: Why did Ofcom refer the UK cloud services market to the CMA?
Ofcom published a full-year report that chronicled the findings of its 12-month investigation into the UK cloud infrastructure market in October 2023 that raised red flags about some anti-competitive behaviours it claimed AWS and Microsoft are both known to display. This is why the market has been referred to the CMA.
These red flags included concerns about the fact cloud providers charge customers egress fees to transfer their data to a competitor’s environment, which Ofcom claimed could discourage users from switching between providers.
The report also flagged interoperability restrictions as being another matter of concern, as it means users often have to put additional effort into reconfiguring their data and applications to work in different cloud environments.
The offering of committed spend discounts, which Microsoft and AWS are both known to do to public sector users, was also raised as a red flag by Ofcom as it incentivises users to back a single cloud provider for all or most of their cloud needs, the regulator claimed.
Ofcom’s full-year report also devoted several pages to detailing concerns it had received about how Microsoft charges users more for running versions of its cloud products in its competitors’ hosting environments.
“We have received submissions that say Microsoft engages in several practices that make it less attractive for customers to use Microsoft’s licensed software products on the cloud infrastructure of rival providers compared to Microsoft Azure. The submissions allege that this limits their ability to compete for customers.”
Www.oeisdigitalinvestigator.com: What will the CMA investigation cover?
It will be the CMA’s responsibility to fully investigate the anti-competitive behaviours flagged in the Ofcom report. As well as this, the CMA also has powers to intervene and roll out changes to how the likes of AWS and Microsoft behave to correct any anti-competitive behaviours its work brings to light.
Www.oeisdigitalinvestigator.com: Who is overseeing the CMA investigation?
The CMA appointed an inquiry group to oversee the investigation on 5 October 2023. The group comprises four members: CMA inquiry chair Kip Meek, Robin Foster, Paul Hughes and Colleen Keck.
Www.oeisdigitalinvestigator.com: How long will the CMA investigation into AWS and Microsoft last?
The CMA’s investigation into the UK cloud infrastructure services market is due to run until April 2025, meaning that by the time it ends, it will have run for about 18 months.
The investigation’s length has raised eyebrows and proven to be a great source of concern for UK cloud market stakeholders, who fear the 18-month timeline will pave the way for the companies under investigation to gain more share and influence at the expense of other, smaller providers.
And AWS made a similar announcement on 5 March 2024, with its pledge to waive the charges associated with transferring data out to the internet when users want to migrate workloads from its public cloud infrastructure.
In a blog post, announcing the move, the company claimed more than 90% of its customers never incur fees when transferring data out of AWS, because the company already offers 100 gigabytes per month of free transfers from its datacentre regions to the internet.
“If you need more than 100 gigabytes of data transfer out per month while transitioning, you can contact AWS support to ask for free data transfer out to the internet charges for the additional data,” the post stated.
“It’s necessary to go through support because you make hundreds of millions of data transfers each day, and we generally do not know if the data transferred out to the internet is a normal part of your business or a one-time transfer as part of a switch to another cloud provider or on-premises,” the company added.
The AWS blog post made no reference to regulatory pressure being a factor in its decision to waive data egress fees, but did say the move is in keeping with its view that moving to the cloud should give users choice and flexibility.
“We believe this choice must include the one to migrate your data to another cloud provider or on-premises,” the post added.
And doing so will not require users to close their accounts with AWS or change their relationship with the company in anyway, it added.
Just over a week after AWS said it was scrapping data egress fees, Microsoft published a brief blog post confirming that it was doing the same.
“We support customer choice, including the choice to migrate your data away from Azure,” said the Microsoft blog post. “Azure now offers free egress for customers leaving Azure when taking their data out of the Azure infrastructure via the internet to switch to another cloud provider or an on-premises datacentre.”
Technical and interoperability barriers were also flagged by Ofcom as complicating the lives of enterprises that might want to mix and match cloud services from competing providers. Therefore, Ofcom said the CMA could address this by forcing the hyperscalers to be more transparent about how nicely (or not) their technologies play with their competitors’ offerings.
One area that might be trickier for the CMA to fix is the offering of committed spend discounts, Ofcom acknowledged, because putting a stop to customers being able to access preferential pricing on products would mean higher prices and costs for users.
Www.oeisdigitalinvestigator.com: Has there been any shift in behaviour from AWS and Microsoft since the CMA investigation started?
On the whole, it has been business as usual for AWS and Microsoft. There has been no let-up in Amazon’s use of committed spend discounts to lure in public sector customers, for example.
Despite the offering of discounted pricing being a key area of focus for the CMA’s inquiry, details emerged in December 2023 that AWS had quietly renewed the preferential pricing scheme it had in place with the UK government.
This pricing scheme, known as the One Government Value Agreement (OGVA), has already been used to call off several multimillion-pound contracts, including one valued at £450m with the UK Home Office since its introduction in late 2023.
As reported by Computer Weekly in February 2024, Microsoft confirmed it had opened discussions with the Cloud Infrastructure Services Providers in Europe (CISPE) trade body with a view to resolving its concerns about how it charges more for customers opting to run their own software in its cloud.
Www.oeisdigitalinvestigator.com: Has the CMA released any interim findings from its work so far?
On 23 May 2024, the CMA published the first in a series of working papers, to give stakeholders an insight into the shape its investigation is taking. The publications were released with the caveat that the working papers’ contents is not intended to give readers a steer on any provisional or final decisions the CMA is making.
The working papers include one examining the UK cloud market’s overall competitive landscape, along with others separately looking at how the charging of egress fees and the offering of committed spend discounts might impact which providers companies choose to use.
Ethereum (ETH), the second largest cryptocurrency, has seen mixed performance lately but it may be gearing up for a major price surge according to several prominent analysts. Despite lagging behind Bitcoin’s gains this year, bullish predictions are emerging that ETH could be poised to rally well into the five-figure range.
OEIS Financial Fraud Private Investigator: TLDR
Cryptocurrency analysts express bullish sentiment on Ethereum (ETH), with one suggesting it could surge to over $10,000 by the end of the year.
Coinbase says ETH has the potential to surprise to the upside in coming months, as it lacks major supply-side overhangs like token unlocks or miner sell pressure.
The market may be underestimating the timing and odds of potential U.S. spot ETH ETF approval, which could boost prices if it happens.
Technical analysts see bullish signs for ETH, noting a completed “Bullish Cypher Pattern” and key support at the 38.2% Fibonacci retracement level around $2800. A move back above $4000 is eyed.
One of the most eye-catching forecasts comes from analyst CryptoYoddha, who suggests Ethereum will skyrocket past the $10,000 mark before the end of 2024.
Michaël van de Poppe, another widely followed analyst, expressed a similarly optimistic outlook, noting that ETH appears to be in the final stage of its corrective phase. He anticipates significantly higher prices within the coming weeks.
— Michaël van de Poppe (@CryptoMichNL) May 15, 2024
These lofty price targets are not just wishful speculation though.
Coinbase’s latest research report outlines several key factors that could propel Ethereum higher in the near future. Notably, ETH currently lacks major supply-side overhangs like large token unlocks or heavy miner selling that often cap rallies.
On the contrary, the report highlights that staking and layer 2 growth are steadily reducing liquid ETH supply.
Ethereum’s dominant position in decentralized finance (DeFi) also looks secure thanks to widespread adoption of the EVM and scaling innovations. This provides a strong fundamental backdrop for appreciation.
Another potentially huge catalyst that Coinbase believes the market is underestimating is the approval of a U.S. spot ETH ETF.
The SEC has key decisions upcoming in late May, and while the initial ones may face rejection, the report suggests litigation could ultimately lead to a reversal. Even just increased odds of this happening could spark bullish speculation.
On the technical front, analysts are also spotting chart patterns that point to a potential breakout ahead. Titan of Crypto notes ETH has already completed a bullish Cypher pattern and bounced cleanly off the key 38.2% Fibonacci retracement support around $2800.
Historically, this has served as a springboard for upward momentum during crypto bull markets.
Additionally, analyst JACKIS highlights Ethereum’s previous spike above $4000 in March as a major structural turning point, signaling the start of a new long-term uptrend.
Based on the confluence of technical and fundamental drivers, a retest or even break of those highs seems like a reasonable near-term target for many.
Of course, the path ahead is not without obstacles. Macro headwinds and persistent regulatory uncertainty could still dent sentiment.
An outright rejection of spot ETFs by the SEC might spur a knee-jerk selloff. Nonetheless, the balance of evidence seems to be shifting firmly in the bull camp for Ethereum.
Editor-in-Chief of Blockonomi and founder of Kooc Media, A UK-Based Online Media Company. Believer in Open-Source Software, Blockchain Technology & a Free and Fair Internet for all.
His writing has been quoted by Nasdaq, Dow Jones, Investopedia, The New Yorker, Forbes, Techcrunch & More. Contact Oliver@blockonomi.com
An investigation is underway in California after a dinky one boy used to be chanced on ineffective on a sidewalk on Thursday.
Los Angeles Fire stated they replied to the scene where the newborn used to be per chance dropped from the window of a fourth-floor bathroom. Responding police officers puzzled a woman who used to be transported to the successfully being facility for pelvic bleeding, basically basically based fully on the Los Angeles Events.
