Computer Security: Analysis of CPDoS Exploit and Mitigation Strategies

This report provides a comprehensive analysis of the Cache-Poisoned Denial-of-Service (CPDoS) vulnerability, focusing on its implications for computer security. It begins by defining and explaining Content Delivery Networks (CDNs), detailing their working principles and practical applications. The report then delves into the CPDoS exploit, describing its mechanics, including the role of HTTP headers and various attack vectors such as HTTP Header Oversize, HTTP Meta Character, and HTTP Method Override. It explores how attackers can manipulate HTTP requests to poison CDN caches, leading to denial-of-service conditions. Furthermore, the report critically discusses potential mitigation strategies, examining solutions to defend against CPDoS attacks. Finally, the report offers an analysis of the likely future importance and effectiveness of CPDoS, considering its potential impact on web security. The report uses references to support all the information.

Running head: COMPUTER SECURITY
COMPUTER SECURITY
Name of the Student
Name of the University
Author Note

1COMPUTER SECURITY
Table of Contents
Introduction................................................................................................................................2
Content Distribution Network....................................................................................................2
Working of CDN........................................................................................................................3
Working Principle of CDN........................................................................................................4
CPDoS Attack............................................................................................................................4
HTTP Headers............................................................................................................................5
Working of CPDoS....................................................................................................................5
Variations of CPDoS..................................................................................................................6
Mitigation of CPDoS Attack......................................................................................................9
Conclusion................................................................................................................................10
References................................................................................................................................11

2COMPUTER SECURITY
Introduction
The security of the computer is the protection of a system of networks and
information from unauthorized use and theft. It is the procedure of detecting and preventing
unauthorized use of the operation of the computer. The security of computers is essential
against the threats of the computer system. The risks are the hazards that can damage the
usual functioning of the equipment. A virus is a malicious program that is obstructed in the
computer of the end-user. It duplicates itself and then contaminates the applications and the
files.
The report discusses the computer security. The report provides an overview of the
Content Distribution Network and reviews the principles of CDN. The report describes the
CPDoS exploit and the solution to the feat of CPDoS. The report provides an overview of the
future importance and the effectiveness of CPDoS.
Content Distribution Network
The full of CDN is a Content Distribution Network or Content Delivery Network. A
content Delivery Network is a system of several servers that are distributed that does the job
of delivering pages and the other web content to the end-user (Zhao et al 2019). It is usually
based on the geographic position of the end-user, server of content delivery, and the origin of
the webpage.
This service is very useful in increasing the speed of delivery of the website contents
that have high traffic, and the websites are globally active. The nearer the server of CDN to
the end-user, the quicker the material will be transported to the end-user (Retal et al 2017).
The Content Delivery Network also offers to safeguard from massive rushes in the traffic of
the network.

3COMPUTER SECURITY
Figure 1: Content Delivery Network
(Source: Created By Author)
Working of CDN
The servers that are located closer to the website react to the request. The Content
Delivery network duplicates the pages of a website to the system of servers that are
disseminated at various locations geographically, thereby caching the contents of the page
(Srivastav and Nath 2017). When an end-user desires a webpage, which is a part of the
Content Delivery Network, The CDN will forward the request from the server of the server
that is originating to the server that id present in CDN, which is very close to the server, and
then distribute the cached content. The CDNs can also converse with the server that is
originating for the delivery of any of the content, which was not cached previously.

4COMPUTER SECURITY
The process of bouncing through CDNs is translucent to the user. The only way by which the
user would know if a CDN has been entered when the URL that is transported is not similar
to the URL that is demanded (Wu et al 2018).
Working Principle of CDN
The working principle of Content Delivery Network without the cache service:
 The user to the browser to offer access to the domain name
 After that, the browser calls the analytic function library of the domain name to parse the
domain name gets this domain name that is corresponding to the IP address
 The browser utilizes the IP address that is obtained, the service host of the domain name
sends the request of data access
 The browser that is based on data is returned by the host or domain name to display the
web page content
With the four steps mentioned above, the browser finishes the procedure of receiving the
domain name from the end-user to access the data from the service host of the Domain Name
(Chen et al 2016).
CPDoS Attack
The researchers of security have announced an attack known as the Cache-Poisoned
Denial-of-Service, and it belongs to a kind of attack of web cache of poisoning (Nguyen,
Iacono and Federrath 2019). An attack of CPDoS works by creating a request of HTTP that is
malformed, and that passes through a content delivery network to produce a response of error
from the server of the victim. The reaction of failure is then cached that is within the Content
Delivery Network, and it will cause a Denial of Service to the users who are legitimately
trying to enter the content that is original.

5COMPUTER SECURITY
The full form of Cache-poisoned Denial of service is a typical web cache poisoning
attack that is aimed at disabling the assets of the web and the websites. The poisoning of the
web cache has been a weakness (Alharbi et al 2019). It is a threat that is utilised in order to
scare the developers into the issues of patching that nobody can exploit.
HTTP Headers
The headers of HTTP are an important component of the protocol of HTTP. They
play an important role in administering the requests from a browser and the response that is
received from the server of web. Splitting these components of protocol that is based on the
source of the request classifies them into two logical units that include the request headers of
HTTP and response headers of HTTP (Petkova 2019). Both components include essential
information required to administer the communication between the destination and the source
of a request of HTTP. The settings that are associated with cache, request metadata, as well
as the types of media, languages and many more, are the kinds of data that are included
within the header of HTTP.
Working of CPDoS
CPDoS attacks are aimed at the two components of the web that are the servers of the
web and the content delivery networks.
The servers of the web store the website that is original and its contents while the
content delivery network store a copy of the cache of the website that are refreshed at certain
intervals of time (DiBenedetto and Papadopoulos 2016). The Content delivery Networks are
an essential part of the internet as they can lessen the load on the servers of web. Instead of a
server of web that is computing the similar request of user, a CDN can offer some of the
users those are incoming with a duplicate copy of the website until the Content delivery
network refreshes with a version that is new. The content delivery network are utilised

6COMPUTER SECURITY
widely. Any type of attack on the system of CDN can have a harmful consequence on the
availability of the website and the profitability of the website (Nagesh et al 2016).
In this context, the working of the CPDoS attack is as follows:
 An attacker first sends a simple request of HTTP that contains a header that is malicious
targeting a resource of victim provided by some server of web. The request is then
processed by the immediate cache while the header that is malicious remains
unrecognised
 The cache then forwards the request to the origin of server, as it does not store a copy that
is fresh of the resource that is targeted. At the server of origin, the request that is
processing then provokes an error because of the header it contains that is malicious.
 As a result, the server of origin returns a page of error that gets stored by the cache
instead of the resources those are requested.
 The attacker knows that the attack was successful when an error page in response is
retrieved
 The users those are legitimate trying to get the resource that is targeted with the requests
those are subsequent
 Will get the page of cached error of the original content
With the assists of CPDoS, a client that malicious can block any resource of web that is
distributed through the Content Distribution Networks or those are hosted on the proxy
caches (Kumar 2016). A single request that is crafted is enough in order to restrain the entire
request from entering the content that is targeted.
Variations of CPDoS
According to the team of research, there are three variants of the attack of CPDoS exists
and it depends on the way the attackers decide to structure the header that is malformed

7COMPUTER SECURITY
(Prabadevi et al 2019). The names are self-explainable with utilising the header fields those
are oversized, Meta characters that activate instructions or the users that override responses of
normal server.
 HTTP Header Oversize
 HTTP Meta Character
 HTTP Method Override
HTTP Header Oversize
A request header of HTTP has important information for the systems those are
intermediate and the servers of web. This contains header fields those are related to cache or
the meta data on the types of media supported by client. The standard of HTTP does not
define any limit of size for the request headers of HTTP (Masdari and Jalali 2016). As a
result, the servers of web, intermediate systems and the frameworks of web define the limit
on their own. Most of the servers of web and the proxies offer a size limit of request header in
order to mitigate the attack. The semantic gap that is in terms of the size limit of the request
header can be exploited in order to conduct an attack and that can lead to the attack of denial
of service.
The HHO attacks of CPDoS attacks operate in several scenarios where an application
of web utilises a cache that accepts a larger size limit of header than the server that is
original. In order to attack such an application of web, a client that is malicious sends a
request that consists of a header that is larger than the size of the header supported by the
original server but smaller than the size that is supported by the cache. In order to do so, an
attacker has two options (Tanwar, Sharma and Mittal 2018). First option is to design a
request header with various headers those are malicious and the second option is to contain
just one header with a key that is oversized.

8COMPUTER SECURITY
HTTP Meta Character
The HTTP Meta Character attack of CPDoS work very same to the HHO attack of
CPDoS. Instead of transferring a header those are oversized, this attack tries to avoid a cache
with a header request that includes a Meta character that is harmful. The Meta characters can
be for example characters of control and many more (Kamikubo and Saito 2017). A cache
that is unaware forwards such as request to the server of origin without blocking any
messages or any of the Meta characters. The server of origin can classify such a malicious
request as it includes Meta characters those are harmful. As a result, the server of origin
returns a message of error that is stored and then it is reused by the cache.
HTTP Method Override Attack
The HTTP Standard offers various methods of HTTP for the servers of Web and the
clients in order to execute transactions on the web. The most utilised HTTP methods include
GET, POST, PUT and DELETE. There are various intermediate systems such as the
balancers of load, cache, firewalls and proxies but hey only support POST and GET
(Shahriar, Clincy and Bond 2018). This means that the requests of HTTP with PUT and
DELETE are blocked. Once the request gets to the server, the header then trains application
of web in order to override the method of HTTP in the line of request with the one in the
corresponding value of header.
If a service of Web uses a vulnerable CDN in order to upgrade the performance of the
website, the attackers can design a malicious header of HTTP in order to develop CPDoS
attack. For example, they can implant a request of POST into HTTP method override and
then send the request to the target that is intended (Keerthi 2016). The cache will understand
is a request of GET and then pass it into the service of web. The web service unpacks the
HTTP header and then sends a request of POST. After this, the target gives an error if there

9COMPUTER SECURITY
are no business logic exists in order to understand and administer this error. The service then
sends the page of error back to the cache by poisoning it and then developing an attack of
denial of service for the users those are legitimate.
Mitigation of CPDoS Attack
The mitigation against the attack of CPDoS exists. The best solution is that the
owners of website configure their service of CDN in order to not cache the error pages of
HTTP by default. There are various providers of CDN services that consist of such settings in
their dashboards and this will not be a complicated step to take (Prabadevi and Jeyanthi
2018). If the owners of the website do not have the control in the web dashboard of the
content delivery network in order to disable the caching of the pages of error, they can easily
disable this form within the configuration files of the server by adding the header of HTTP to
each page type error.
The more complex solution in order to deal with the attack of CPDoS resides with the
providers of Content Delivery Network and that can be altered the way the products execute
or operate. In order to explain and according to a team of research, the cause due to which
some of the providers of Content Delivery Network are vulnerable to the attacks of CPDoS is
that they do not follow the caching protocols of internet.
The caching standard of Web only permits to cache the codes of error and the team of
research said that pointing out that the Content Delivery Network should not be caching
pages of error those are produced by the attacks of CPDoS (DiBenedetto and Papadopoulos
2016). Taking this type of approach is more complicated and it needs some kind of work to
be done in the backend of various providers of Content Delivery Network. Until then, the
countermeasures are very easy to apply. Since the attacks of CPDoS are possible practically

10COMPUTER SECURITY
with some minimum effort most of the owners of the website should be able to safeguard
their servers against any of possible abuse
A firewall of web application can be implemented in order to mitigate the attacks of
CPDoS. However, the firewalls of web application should be positioned in front of the cache
to clock the content that is malicious before they reach the server at the origin. The firewalls
of web application those are positioned in front of server of origin can be exploited in order
to provoke the pages of error that are cached (Appelt, Panichella and Briand 2017).
The researchers have warned the webmasters not to ignore the problems. According
to a test, it is seen that 30% of the websites, 11% of domains of Department of Defence and
16% of the URLs are vulnerable to the attacks of CPDoS.
Conclusion
From this report, it can be inferred that CPDoS attack is a harmful attack and it can
poison any of the websites and the content delivery network. The report deals with the
content delivery networks and the working of the content delivery networks. These are the
system of server’s those are distributed and that transport the pages and other content of web
to the end user. The report also deals with the working principle of the content delivery
network. The content delivery networks are very important for the user. The report focuses on
the CPDoS attack cache poisoning denial of service attack that can poison a CDN. The report
discusses about the mitigation of the CPDoS attacks. The CPDoS attack can be mitigated by
implementing a web application firewall.

11COMPUTER SECURITY
References
Alharbi, F., Chang, J., Zhou, Y., Qian, F., Qian, Z. and Abu-Ghazaleh, N., 2019, April.
Collaborative Client-Side DNS Cache Poisoning Attack. In IEEE INFOCOM 2019-IEEE
Conference on Computer Communications (pp. 1153-1161). IEEE.
Appelt, D., Panichella, A. and Briand, L., 2017, October. Automatically repairing web
application firewalls based on successful SQL injection attacks. In 2017 IEEE 28th
International Symposium on Software Reliability Engineering (ISSRE) (pp. 339-350). IEEE.
Chen, X., Zhang, X., Wu, Z., Xiang, Y., Xie, S. and Li, S., 2016, August. CDN Strategy
Adjustment System Based on AHP. In International Conference on Intelligent
Computing (pp. 232-241). Springer, Cham.
DiBenedetto, S. and Papadopoulos, C., 2016, April. Mitigating poisoned content with
forwarding strategy. In 2016 IEEE Conference on Computer Communications Workshops
(INFOCOM WKSHPS) (pp. 164-169). IEEE.
DiBenedetto, S. and Papadopoulos, C., 2016, April. Mitigating poisoned content with
forwarding strategy. In 2016 IEEE Conference on Computer Communications Workshops
(INFOCOM WKSHPS) (pp. 164-169). IEEE.
Kamikubo, R. and Saito, T., 2017. Browser-based ddos attacks without
javascript. International Journal of Advanced Computer Science and Applications, 8(12),
pp.276-280.
Keerthi, V.K., 2016. Taxonomy of SSL/TLS attacks. International Journal of Computer
Network and Information Security, 8(2), p.15.
Kumar, G., 2016. Denial of service attacks–an updated perspective. Systems science &
control engineering, 4(1), pp.285-294.

12COMPUTER SECURITY
Masdari, M. and Jalali, M., 2016. A survey and taxonomy of DoS attacks in cloud
computing. Security and Communication Networks, 9(16), pp.3724-3751.
Nagesh, K., Sumathy, R., Devakumar, P. and Sathiyamurthy, K., 2016, August. A survey on
denial of service attacks and preclusions. In Proceedings of the International Conference on
Informatics and Analytics (pp. 1-10).
Nguyen, H.V., Iacono, L.L. and Federrath, H., 2019, November. Your Cache Has Fallen:
Cache-Poisoned Denial-of-Service Attack. In Proceedings of the 2019 ACM SIGSAC
Conference on Computer and Communications Security (pp. 1915-1936).
Petkova, L., 2019. HTTP SECURITY HEADERS. Knowledge International Journal, 30(3),
pp.701-706.
Prabadevi, B. and Jeyanthi, N., 2018. A framework to mitigate ARP sniffing attacks by cache
poisoning. International Journal of Advanced Intelligence Paradigms, 10(1-2), pp.146-159.
Prabadevi, B., Jeyanthi, N., Udzi, N.I. and Nagamalai, D., 2019. Lattice Structural Analysis
on Sniffing to Denial of Service Attacks. International Journal of Computer Networks &
Communications (IJCNC) Vol, 11.
Retal, S., Bagaa, M., Taleb, T. and Flinck, H., 2017, May. Content delivery network slicing:
QoE and cost awareness. In 2017 IEEE International Conference on Communications
(ICC) (pp. 1-6). IEEE.
Shahriar, H., Clincy, V. and Bond, W., 2018. Classification of Web-Service-Based Attacks
and Mitigation Techniques. In Security and Privacy Management, Techniques, and
Protocols (pp. 360-378). IGI Global.

13COMPUTER SECURITY
Srivastav, M.K. and Nath, A., 2017, August. Content delivery and management system.
In 2017 International Conference on Information, Communication, Instrumentation and
Control (ICICIC) (pp. 1-5). IEEE.
Tanwar, J., Sharma, S.K. and Mittal, M., 2018, October. Secure Framework for Web Services
Communication. In 2018 International Conference on Automation and Computational
Engineering (ICACE) (pp. 187-190). IEEE.
Wu, Z., Lu, Z., Zhang, W., Wu, J., Huang, S. and Hung, P.C., 2018. A data-driven approach
of performance evaluation for cache server groups in content delivery network. Journal of
Parallel and Distributed Computing, 119, pp.162-171.
Zhao, J., Liang, P., Liufu, W. and Fan, Z., 2019, December. Recent Developments in Content
Delivery Network: A Survey. In International Symposium on Parallel Architectures,
Algorithms and Programming (pp. 98-106). Springer, Singapore.