Analyzing Content Delivery Networks (CDN) and CPDoS Exploits

This report provides a comprehensive analysis of Content Delivery Networks (CDNs) and Cache Poisoning Denial-of-Service (CPDoS) attacks. It begins by explaining the principles and usage of CDNs, emphasizing their role in improving internet communication and enhancing website loading times. The report then delves into the specifics of CPDoS exploits, including HTTP Header Oversize (HHO), HTTP Meta Character (HMC), and HTTP Method Override (HMO) attacks. It details how these attacks compromise CDN security by manipulating HTTP headers and cache mechanisms to deliver error pages instead of the intended content. Furthermore, the report outlines the impact of CPDoS attacks on network performance and security, including the distribution of error pages across edge servers. Finally, it discusses mitigation strategies, such as deploying Web Application Firewalls (WAFs) and excluding error pages from caching, to safeguard against these exploits and ensure smoother network operations. This report is a valuable resource for understanding and addressing the vulnerabilities associated with CDNs and CPDoS attacks.

Running head: - CDN AND CPDOS
CDN AND CPDOS
Name of the Student
Name of the University
Author Note

1CDN AND CPDOS
Abstract
CDN have been designed to improve the communication over the internet and to enhance the
particular speed of the internet connection for improving the internet connectivity. As a
reason, this discussion has been undertaken to highlight the brief explanation of CDN along
with the working principle of the same along with their particular usage. Following this,
CPDoS attacks have been identified as a threat posed towards the CDNs that has been briefly
explained along with the various types of the same. Lastly, the discussion also states the
impacts that CPDoS has upon the connection and the ways to mitigate the threats for a
smoother functioning of the networks and internet connection.

2CDN AND CPDOS
Table of Contents
1. Introduction:...........................................................................................................................3
2. Principle and Usage of CDN:.................................................................................................3
3. Description of CPDoS exploit:...............................................................................................5
4. Performing CPDoS exploit and solutions:.............................................................................7
5. Impact of CPDoS:................................................................................................................10
6. Conclusion:..........................................................................................................................12
7. References:...........................................................................................................................13

3CDN AND CPDOS
1. Introduction:
Content Delivery Network is the term that is shortened to CDN referring to a network
that has been created as well as distributed over a large geographical area having the
inclusion of proxy servers and that of data centres (Berger, Sitaraman and Harchol-Balter
2017). The primary objective that this network deals with is to provide with high availability
as well as high performance in regards to the distributing of variously existing services to the
end users along with their connected devices. CDN had come into the existence in the year of
late 1990s for alleviating the particular performance of the internet functioning at that
particular period. Since that time, CDN have risen to act as a primary contributor towards the
internet connectivity that is provisioned to individuals all around the world including the likes
of internet objects, software, social media platforms, downloadable commodities as well as
video on demand. This discussion has been undertaken to put forwards the principles of CDN
and the CPDoS exploits that take place within the CDNs (Zhao et al. 2019). Following this, a
proper explanation of how the CPDoS carries out as well as the relative solution to the
exploits shall be highlighted. Lastly, impacts of such exploits have been briefly explained.
2. Principle and Usage of CDN:
CDN are commonly the abbreviation that stands for Content Delivery Network that
specifically refers to the particular fact of a network that has been designed and
geographically scattered among a collection of servers that carry out the work together as a
group for delivering of faster content on the internet.
CDN provisions with the allowance to carry out a quicker transfer of objects loading
on the web having the inclusion of HTML pages, videos, JavaScript files, style sheets as well
as images (Retal et al. 2017). The CDN services is popular and continues to experience a
significant increase within the usage in regards to the present condition of the web traffic that

4CDN AND CPDOS
is specifically served through a CDN network. This also has the inclusion of majorly existing
sites such as Amazon, Facebook as well as Netflix. In addition to this, if the CDN network
has been properly configured then it can also provision a particular website with protection
against many malicious threats that exist online such as the likes of DDoS attacks.
Figure-1: Content Delivery Network
(Source- Nguyen, Iacono and Federrath 2019)
However, it has to be kept in mind that CDN is not a web host and does not carry the
potential capability to host contents along with the fact that it does not provision a helping
hand to the cache related content present on the edge network. This significantly brings a
degree of improvement within the performance of the website (Sung et al. 2016). In regards
to this, it has been visibly identified that majority of the websites face a problem in terms of
performance needs from the traditional hosts and hence, such companies opt for the content
delivery network to solve this particular issue. The CDNs are a primary source of reducing
the bandwidth, improving the security as well as preventing the interruptions that are caused

5CDN AND CPDOS
in the service that makes the CDN to be a popular choice over the traditional hosts in the
current cyber world.
The CDNs are used for the following purposes that act as a benefit in using the same
(Huang et al. 2019). These are,
i) Improvement of website loading time- this is done by distributing the content in a
much closer proximity to the visitors of the website with the proper usage of a
CDN server located nearby that makes the visitors experience to a faster loading
time of the particular webpage.
ii) Reduction of bandwidth costs- the costs directly associated with the bandwidth
required for the purpose of hosting the website refers to a primary expense related
to having a website (Sarddar, Roy and Sen 2017). Hence, caching or other kinds
of optimizations, the CDNs have been able to bring in a reduction within the
associated price for the origin server that shall reduce the overall costing for the
owners.
iii) Increasing of content- huge chunks of traffic or might as well be failures of the
hardware modules can bring in an interruption within the normal functioning of
the website. This provisions the CDN, which can handle the increasing traffic in a
better way as well as deal with the failures occurring within the hardware better
than the original servers that exists.
iv) Improvement of website security- CDN networks can greatly improve the security
with the help of DDoS mitigation, optimizations as well as improving the
certificates related to security (Triukose and Rabinovich 2016).

6CDN AND CPDOS
3. Description of CPDoS exploit:
CPDoS commonly abbreviates for Cache Poisoning Denial-of-Service attacks that
was found out by the German Cyber Security researchers belonging to the Cologne
University and the University of Hamburg. They had specifically derived this attack that
provisions the particular attackers with a special allowance (Jia et al. 2017). With the use of
this allowance, the attacker can compel a particular webpage or an entire website for
delivering a page that is an error instead of the original one that the respective visitor had
tried to access while searching up with the help of the URL. Web caching refers to a primary
component of the modernised architecture, in which the particular cache puts forward the
promotion of performing the website as well as offering with an additional form of protection
such as the likes of DoS attack.
Figure-2: CPDoS Attack
(Source- DiBenedetto and Papadopoulos 2016)
The basic blue print of how the attack gets carried out has been described below with
the help of the following points (Nguyen, Iacono and Federrath 2019). These are,
i) The particular attacker sends a potential request of a common HTTP command
that has the primary inclusion of a maliciously active header painting a target
upon the resource of the victim provisioned by some existing web server. This
particular request made is significantly processed by that of the intermediately
existing cache, while on the other hand the malicious header remains recessive.

7CDN AND CPDOS
ii) This cache then particular forwards the command to the originated server since,
the server has no storage functions to store the original or a fresh copy (Brown
and Willink 2018). Back at the server, this particular processing of the request is
done provoking an error in regards to the existence of the malicious header that is
still contained in the same.
iii) As a result of this, the originated server takes the visitor to a page of error that
specifically gets into the storage by the existing cache keeping apart from the
resource that had been originally asked for.
iv) This provides a satisfaction to the attacker knowing that the upcoming of an error
highlights the fact of a successful attack (DiBenedetto and Papadopoulos 2016).
v) Following this, the users or the visitor who have been still trying to get hold of the
targeted webpage with consecutive requests showing a page of error rather than
the original one.
Figure-3: CPDoS Attack steps
(Source- AbdAllah, Zulkernine and Hassanein 2018)

8CDN AND CPDOS
4. Performing CPDoS exploit and solutions:
CPDoS exploits can be performed in three different variations that exists (AbdAllah,
Zulkernine and Hassanein 2018). The three varieties of CPDoS attacks are,
i) HTTP Header Oversize (HHO) - HTTP header has the primary inclusion of vital
information that belongs to the intermediary systems along with the web servers.
This has the primary inclusion of header fields or the meta data that is related to
the caches present on the media types that are supported by the clients such as the
likes of languages as well as encodings (Prabadevi et al. 2019). In regards to this,
the standard of the HTTP does not put forward a definition of the size limit
belonging to the headers for HTTP requests. In relation to this, the CPDoS attacks
of the HHO type takes place in places where the web application specifically
accepts larger size for the header rather than the origin server.
Figure-4: HHO CPDoS Attack
(Source- Prabadevi et al. 2019)

9CDN AND CPDOS
ii) HTTP Meta Character (HMC) – this particular attack works in a similar way to
that of the HHO CPDoS attack. However, instead of sending a header that has
been oversized, this particular attack makes tries and bypasses a cache that
consists of the requested header also having the containment of the meta character
(Sakhawat et al. 2018). Meta characters are of the likes such as \n, \r or \a.
Figure-5: HMC CPDoS Attack
(Source- Sakhawat et al. 2018)
iii) HTTP Method Override Attack (HMO)- this particular attack provisions with
multiple methods belonging to the HTTP to that of the web servers as well as the
clients for carrying out transactions through the use of internet. GET, DELETE,
POST as well as PUT are the commonly used methods of HTTP within the
internet based applications along with the REST based services on the web
(Prabadevi, Jeyanthi and Abraham 2020). In this, multiply existing medium such
as the likes of load balancers, firewalls, the proxies as well as the caches are
provisioned support from the GET as well as the POST.

10CDN AND CPDOS
Figure-6: HMO CPDoS Attack
(Source- Prabadevi, Jeyanthi and Abraham 2020)
Figure-7: HMO CPDoS step Attack
(Source- Prabadevi, Jeyanthi and Abraham 2020)
Such CPDoS attacks on the CDN networks can be impactful along with the three
variations of the attacks. Such impacts or the potential happening of the attacks can be
mitigated with the help of the following steps that have been briefly mentioned. These are,
i) A page that consists of the HTTP header that needs to be cached in accordance to
the set policies belonging to the standard of HTTP header.
ii) Deployment of WAF to be carried out in the front side of the existing individual
cache for blocking the requests from such maliciously active sources online.

11CDN AND CPDOS
iii) The last effective method that can be deployed for carrying out the activity of
excluding the pages of error from the method of caching.
5. Impact of CPDoS:
Once the page showing error has come up, the CDN network gets distributed to all the
edge servers and the relative location around the globe. The map that follows this discussion
puts forward a proper illustration of the distance to which the error page has been distributed
in regards to multiple locations of the edge servers throughout the entire CDN network
(Meghana, Subashri and Vimal 2017). However, not all the existing edge servers get
impacted by every CPDoS attacks, referring to the fact that the clients at those particular
locations of the edge servers have been served with the genuine page that had been initially
searched by the respective visitors in regards to obtain resources from the particular website.

12CDN AND CPDOS
Figure-8: CPDoS attacked areas
(Source- Meghana, Subashri and Vimal 2017)
Hence, it can be stated that the primary and the most effective impact of the CPDoS
attacks that is visibly identified and is much effective upon the normal searching of a
resource online by respective visitors is that of not getting hold of the genuine page. With the
deployment of the CPDoS attack throughout the Content Delivery Network (CDN), users all
around the world are impacted and they are again prevented from researching online and
extracting information from the webpages. On being surfed, the particular webpage that has
been attacked by the CPDoS takes a longer loading time than usual. The user waits thinking it
to be an internet issue. However, the end result is that the webpage comes up and displays an

13CDN AND CPDOS
error page to the user as many times as the webpage is reloaded. This hampers the work of
the common individuals on a regular basis.
6. Conclusion:
CDN networks had come into existence to establish a network that shall be
geographically wide as well as enhancing the speed of connectivity in a genuine way as well
as to alleviate the particulate functioning of the internet connectivity as well as the services.
This discussion briefly explains the particular principle of the CDN and the working of the
same. Following this, the report highlights the CPDoS attacks that specifically takes place
upon the CDN and establishes a threat to normal surfing of the internet. In addition to this,
the discussion also states the types of such attacks, the impacts as well as the techniques of
mitigation that might be incorporated to prevent the attacks from occurring.

14CDN AND CPDOS
7. References:
Berger, D.S., Sitaraman, R.K. and Harchol-Balter, M., 2017. AdaptSize: Orchestrating the
hot object memory cache in a content delivery network. In 14th {USENIX} Symposium on
Networked Systems Design and Implementation ({NSDI} 17) (pp. 483-498).
Sung, J., Kim, M., Lim, K. and Rhee, J.K.K., 2016. Efficient cache placement strategy in
two-tier wireless content delivery network. IEEE Transactions on Multimedia, 18(6),
pp.1163-1174.
Huang, L., Guan, Y., Zhang, X. and Guo, Z., 2019. Consistent Dynamic Server Assignment
in Content Delivery Network. arXiv preprint arXiv:1904.07018.
Sarddar, D., Roy, S. and Sen, P., 2017. Edge Multilevel Edge Server Co-operation in Content
Delivery Network using Hierarchical Classification. International Journal of Grid and
Distributed Computing, 10(3), pp.41-52.
Jia, Q., Xie, R., Huang, T., Liu, J. and Liu, Y., 2017. The collaboration for content delivery
and network infrastructures: A survey. IEEE Access, 5, pp.18088-18106.
Brown, J.D. and Willink, T.J., 2018. ARP cache poisoning and routing loops in ad hoc
networks. Mobile Networks and Applications, 23(5), pp.1306-1317.
AbdAllah, E.G., Zulkernine, M. and Hassanein, H.S., 2018. DADI: Defending against
distributed denial of service in information‐centric networking routing and caching. Security
and Privacy, 1(2), p.e16.
Prabadevi, B., Jeyanthi, N., Udzi, N.I. and Nagamalai, D., 2019. Lattice Structural Analysis
on Sniffing to Denial of Service Attacks. International Journal of Computer Networks &
Communications (IJCNC) Vol, 11.

15CDN AND CPDOS
Sakhawat, D., Khan, A.N., Aslam, M. and Chronopoulos, A.T., 2018. Agent-based ARP
cache poisoning detection in switched LAN environments. IET Networks, 8(1), pp.67-73.
Prabadevi, B., Jeyanthi, N. and Abraham, A., 2020. An analysis of security solutions for ARP
poisoning attacks and its effects on medical computing. International Journal of System
Assurance Engineering and Management, 11(1), pp.1-14.
DiBenedetto, S. and Papadopoulos, C., 2016, April. Mitigating poisoned content with
forwarding strategy. In 2016 IEEE Conference on Computer Communications Workshops
(INFOCOM WKSHPS) (pp. 164-169). IEEE.
Triukose, S. and Rabinovich, M., 2016, October. Client-Centric Content Delivery Network.
In 2016 Fourth IEEE Workshop on Hot Topics in Web Systems and Technologies (HotWeb)
(pp. 1-6). IEEE.
Meghana, J.S., Subashri, T. and Vimal, K.R., 2017, March. A survey on ARP cache
poisoning and techniques for detection and mitigation. In 2017 Fourth International
Conference on Signal Processing, Communication and Networking (ICSCN) (pp. 1-6). IEEE.
Retal, S., Bagaa, M., Taleb, T. and Flinck, H., 2017, May. Content delivery network slicing:
QoE and cost awareness. In 2017 IEEE International Conference on Communications (ICC)
(pp. 1-6). IEEE.
Nguyen, H.V., Iacono, L.L. and Federrath, H., 2019, November. Your Cache Has Fallen:
Cache-Poisoned Denial-of-Service Attack. In Proceedings of the 2019 ACM SIGSAC
Conference on Computer and Communications Security (pp. 1915-1936).
Zhao, J., Liang, P., Liufu, W. and Fan, Z., 2019, December. Recent Developments in Content
Delivery Network: A Survey. In International Symposium on Parallel Architectures,
Algorithms and Programming (pp. 98-106). Springer, Singapore.