CAPEC-125: Flooding
Description
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target.
- Likelihood of attack
- High
- Typical severity
- Medium
- Abstraction
- MetaA decidedly abstract characterisation of a methodology or technique.
Mechanism of attack: Abuse Existing Functionality
Prerequisites
- Any target that services requests is vulnerable to this attack on some level of scale.
Consequences
- Availability
Unreliable Execution; Resource Consumption
A successful flooding attack compromises the availability of the target system's service by exhausting its available resources.
Mitigations
- Ensure that protocols have specific limits of scale configured.
- Specify expectations for capabilities and dictate which behaviors are acceptable when resource allocation reaches limits.
- Uniformly throttle all requests in order to make it more difficult to consume resources more quickly than they can again be freed.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
Across MITRE's defensive frameworks
Linked through the 2 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-ISVAInbound Session Volume Analysis2 shared
- D3-ITFInbound Traffic Filtering2 shared
- D3-APCAApplication Protocol Command Analysis2 shared
- D3-CSPPClient-server Payload Profiling2 shared
- D3-NTCDNetwork Traffic Community Deviation2 shared
- D3-NTFNetwork Traffic Filtering2 shared
- D3-NTSANetwork Traffic Signature Analysis2 shared
- D3-PHDURAPer Host Download-Upload Ratio Analysis2 shared
- D3-PMADProtocol Metadata Anomaly Detection2 shared
- D3-RTSDRemote Terminal Session Detection2 shared
- D3-UGLPAUser Geolocation Logon Pattern Analysis2 shared