Cloud/middlebox-specific attacks¶

Attack pattern¶

Between two endpoints now sits a crowd of machines that were never part of the conversation: load balancers, stateful firewalls, TLS-terminating proxies, deep-inspection boxes, each rewriting, tracking or second-guessing the connection as it passes. Every one holds state it can be made to lose, makes an optimisation that can be tricked, and reads a protocol a little differently from its neighbour. Attacks here live in those disagreements: send the packet the firewall reassembles one way and the server another, exhaust the connection table the load balancer has to keep, or shape traffic so the monitoring box waves it through.

1. Cloud/middlebox-specific attacks [OR]

    1.1 Bypass cloud load balancers [AND]
    
        1.1.1 Crafted TCP segmentation evasion
            1.1.1.1 Overlapping TCP segment exploitation
            1.1.1.2 Out-of-order segment reassembly manipulation
            1.1.1.3 Maximum segment size (MSS) manipulation
            1.1.1.4 TCP option field abuse for evasion
            
        1.1.2 Instance resource exhaustion
            1.1.2.1 Connection pool exhaustion attacks
            1.1.2.2 Memory exhaustion through large requests
            1.1.2.3 CPU exhaustion via complex processing demands
            1.1.2.4 SSL/TLS handshake resource consumption
            
    1.2 Stateful firewall evasion [OR]
    
        1.2.1 TCP fast open cache poisoning
            1.2.1.1 TFO cookie theft or prediction
            1.2.1.2 Cache pollution through forged requests
            1.2.1.3 Race condition exploitation during TFO establishment
            1.2.1.4 Bypass of stateful inspection through TFO abuse
            
        1.2.2 Fragmentation overlap attacks
            1.2.2.1 Overlapping fragment exploitation
            1.2.2.2 Protocol field manipulation in fragments
            
        1.2.3 Evade BGP monitoring systems
            1.2.3.1 Crafted BGP update timing attacks
            1.2.3.2 Route attribute manipulation for evasion
            1.2.3.3 Monitoring system resource exhaustion
            1.2.3.4 False positive induction in detection systems
            
    1.3 Application delivery controller exploitation [OR]
    
        1.3.1 SSL/TLS termination bypass
            1.3.1.1 Certificate validation evasion
            1.3.1.2 Encryption protocol downgrade attacks
            1.3.1.3 Cipher suite manipulation
            1.3.1.4 Session renegotiation attacks
            
        1.3.2 Content caching exploitation
            1.3.2.1 Cache poisoning through request smuggling
            1.3.2.2 Cache bypass techniques
            1.3.2.3 Cache timing attacks
            1.3.2.4 Cache-based side-channel attacks
            
    1.4 Cloud-native network function attacks [OR]
    
        1.4.1 Container networking exploitation
            1.4.1.1 Kubernetes network policy bypass
            1.4.1.2 Service mesh security control evasion
            1.4.1.3 Container escape to host network
            1.4.1.4 Cloud metadata service abuse
            
        1.4.2 Serverless function networking attacks
            1.4.2.1 Cold start timing attacks
            1.4.2.2 Function chain exploitation
            1.4.2.3 Event source manipulation
            1.4.2.4 Resource limit exhaustion
            
    1.5 Network function virtualisation attacks [OR]
    
        1.5.1 Virtual network function exploitation
            1.5.1.1 Hypervisor networking stack attacks
            1.5.1.2 Virtual switch security bypass
            1.5.1.3 SR-IOV configuration manipulation
            1.5.1.4 NFV infrastructure compromise
            
        1.5.2 Management and orchestration attacks
            1.5.2.1 MANO system compromise
            1.5.2.2 Network service descriptor manipulation
            1.5.2.3 Virtualised network function image tampering
            1.5.2.4 Orchestration API exploitation
            
    1.6 Content delivery network attacks [OR]
    
        1.6.1 CDN cache poisoning
            1.6.1.1 Request routing manipulation
            1.6.1.2 Cache key confusion attacks
            1.6.1.3 Domain fronting techniques
            1.6.1.4 Cache timing and race conditions
            
        1.6.2 CDN security feature bypass
            1.6.2.1 Web application firewall evasion
            1.6.2.2 DDoS protection bypass
            1.6.2.3 Bot detection evasion
            1.6.2.4 Rate limiting circumvention

The middle does too much¶

Middleboxes inspect and rewrite packets, and every bit of that processing is attackable surface.
Holding connection state across a distributed system is hard, and once a middlebox and the server disagree about a connection’s state, a packet can pass the one that the other would have dropped.
Optimisations for speed routinely skip the security check that would have slowed them down.
Protocols carry edge cases, and a box under load resolves them differently from the endpoint behind it.
Multi-tenant platforms put strangers on shared hardware, opening cross-customer paths.
A middlebox inspects or rewrites connections it does not own, so its state can drift from the endpoints it sits between.
Features ship fast, and fast shipping outruns security review.