REvisiting RE DoS
Eric Davisson (XlogicX) dissects Regular Expression Denial of Service (ReDoS), explaining NFA catastrophic backtracking mechanics and audit methodologies.
Summary
Architecture and Background
Regular Expression Denial of Service has existed for well over a decade, but has not received the love it deserves lately. There are some proof of concept attacks out there currently, most of which are ineffective due to implementation optimizations.
Vulnerability Analysis
Regardless of the effectiveness most of these PoC's are geared only to NFA engines. This talk will demonstrate working PoC's that bypass optimizations.
Exploitation and Demonstrations
Both NFA and DFA engines will get love. Tools will be released (with demonstration) that benchmark NFA/DFA engines and automate creation of 'evil strings' given an arbitrary regular expression.
Remediation and Defensive Strategies
Attendees can expect a review of regex and a deep under the hood explanation of both regex engines before abuses ensue.
Related talks
Main Stage·22 min
Joseph Gabay
How supermarket cart locks can be analyzed and abused as a shopping-system denial path.
Black Hat·58 min
Matthew Prince
Engineers explore architecture and security mechanisms for USA 2013 - Lessons from Surviving a 300Gbps Denial of Service Attack.
Main Stage·38 min
Tony Mui · Wai Leng Lee
Tony Mui and Wai Leng Lee details kill 'em All — DDoS Protection Total Annihilation.