YoYo Attack DDo S Attack on Cloud Autoscaling

Yo-Yo Attack : DDo. S Attack on Cloud Auto-scaling Mechanisms Mor Sides, Anat Bremler-Barr, Eli Brosh Interdisciplinary Center, Herzliya, Israel Supported by ERC starting grant. IEEE INFOCOM 2017, Atlanta, GA, USA

Distributed Denial of Service • DDo. S creates overload performance degradation 2

Cloud as a DDo. S solution • Common Belief : Cloud is a solution (auto-scaling) – Auto scaling: ability to add machines to cope with the overload – #2 in AWS best practices for DDo. S Resiliency – No performance degradation Economic Damage • Economic Denial of Sustainability attack (EDo. S) VM 1 VM 2 VM 3 VM 4 3

We show: Auto-scaling (Cloud) is not a DDo. S solution • Attacker can perform an attack on the auto scaling mechanism – Yo-Yo attack: special crafted of waves of DDo. S • Nowadays is very common to be attacked by Waves of DDo. S VM 1 VM 2 VM 3 VM 4 4

We show: Auto-scaling (Cloud) is not a DDo. S solution • Attacker can perform an attack on the auto scaling mechanism – Yo-Yo attack: special crafted of waves of DDo. S • Nowadays is very common to be attacked by Waves of DDo. S – Economic damage & Performance degradation – Harder to detect & require less resources from attacker VM 1 VM 2 VM 3 VM 4 5

Agenda • Auto scaling overview • Analysis of Yo-Yo Attack • Detecting system state • Defense Strategies • Conclusions 6

Auto Scaling mechanism • User configures auto scaling rules (scale-up and scale down separately): – If the threshold exceeds for duration of scale interval, then action • Threshold: CPU utilization, BW • Scale interval: threshold interval (for scale-up and scale-down) • Action: Scale-up or Scale-down – Example: If CPU utilization is above 50% for 1 minute then perform a scale-up add one machine 7

Discrete / Adaptive auto-scaling • Discrete – the number of machines to increase or decrease is fixed. • Adaptive – the number of machines to increase or decrease is adaptive to the system load. • Google – has only adaptive auto-scaling. 8

Warming time of a machine • Given by the system infrastructure • Warming time of a scale-up – the time until the machine is ready to function: – The VM runs with the relevant software and state – 1 -13 minutes [Mao 2012] • Warming time of a scale-down – the time until the machine closed and all his resources released – Backup, Moving states. 9

Yo-Yo attack • The attacker repeatedly oscillates between the two phases: – On-attack phase: sends a burst of traffic scale-up • Several minutes. – Off-attack phase: stops sending the excess traffic scale down • Start off-attack phase when the attacker detects the scale-up has occurred and ended. – Repeat when the attacker detects the scale-down has occurred and ended. 10

Use case analysis: Parameter Value Requests 10, 000 requests per min machines 10 Scale up/ Scale down Interval 1 minutes Warming up/Warming down 2 minutes Power of attack (extra load) 200%

Yo-Yo Attack on Discrete Scaling Economic Damage Performance Damage 12

Use case analysis: System Cost of attack Performance Damage Economic Damage DDo. S traditional 100% active 200% extra load 0 DDo. S with Auto-Scaling 100% active 0 200% cost of cloud Yo-Yo Attack on Discrete System 50% active Avg. 30% extra load Avg. 100% cost of cloud With extra peak load of 200% 13

Yo-Yo attack on Adaptive Scaling Economic Damage Performance Damage Scale-up Interval Warming scale up 14

Analysis of use case System Cost of attack Performance Damage Economic Damage DDo. S traditional 100% active 200% extra load 0 DDo. S with Auto-Scaling 100% active 0 200% cost of cloud Yo-Yo Attack on Discrete System 50% active Avg. 30% extra load Avg. 100% cost of cloud Yo-Yo attack on Adaptive System 50% active Avg. 100% extra load Avg. 166% cost of cloud Outcomes: • • • Adaptive is more vulnerable than discrete policy Performance damage and Economic damage Less cost to the attacker, Harder to Detect 15

Adaptive is more vulnerable than discrete policy Economic Damage Performance Damage 16

Experimental Results on Amazon: Discrete auto-scaling 17

Experimental Results on Amazon: Adaptive auto-scaling 18

Detecting System State • Attacker: when to oscillate between on-attack to off-attack ? – Sending probe requests and checking the response time. – Rule of Thumb: • > 1 sec scale up process has not ended. • < 1 sec scale down process has not ended. 19

Defense strategies from Yo-Yo attack • Tradeoff: What do you agree to compromise on? Performance Cost Resource limitation Scale up early – scale down slowly 20

Conclusion • Auto scaling (and cloud) is not a remedy for DDo. S – Addresses peak hours problem not DDo. S problem – Need of DDo. S scrubber that copes with Yo-Yo attack “Auto scaling is a very powerful tool, but it can also be a double-edged sword. Without the proper configuration and testing it can do more harm than good” [Netflix blog] 21

Questions? 22