'App DDoS bombs' that slam into expensive APIs worry Netflix

Netflix has identified denial of service threat to microservices architectures that it's labelled “application DDoS”.

Traditional DDoS attacks flood networks with bogus traffic so that infrastructure runs out of resources to serve legitimate users. Netflix characterises an application DDoS attack as one in which attackers “focus on expensive API calls, using their complex interconnected relationships to cause the system to attack itself.”

Netflix's Scott Behrens and Bryan Payne describe a scenario in which attackers figure out which API calls create the most work inside an application, then send plenty of requests to that API.

“A single request at the edge can fan out into thousands of requests for the middle tier and backend microservices,” they write. “If an attacker can identify API calls that have this effect, then it may be possible to use this fan out architecture against the overall service. If the resulting computations are expensive enough, then certain middle tier services could stop working. Depending on the criticality of these services, this could result in an overall service outage.”

The pair say the potential for application DDoS is caused in part by web application firewalls not being aware of the potential impact of mass API calls. Traffic crafted to look legitimate, but maliciously targeting the APIs that make the most work, could therefore have very nasty consequences.

It's not hard to see why Netflix cares about this stuff: it's built on microservices and runs in the cloud. Which raises the possibility of a loosely-configured cloud-native application falling victim to an application DDoS and using resource levels its owners never budgeted for, even if the attack doesn't degrade customer experience.

Netflix thinks it can help those of you that have potential exposure to application DDoS: it's built a tool called Repulsive Grizzly that helps you to test applications to understand their susceptibility to this type of attack. It also advises careful inspection of apps to ensure they can fail gracefully - or just degrade - rather than falling over.

The company's also released a new tool called “ChAP”, aka the Chaos Automation Platform, which automates chaos in microservices architectures. ®