Billion laughs
In computer security, a billion laughs attack is a type of denial-of-service (DoS) attack which is aimed at parsers of XML documents.[1] It's also referred to as an XML bomb or as an exponential entity expansion attack.[2] The example attack consists of defining 10 entities, each defined as consisting of 10 of the previous entity, with the document consisting of a single instance of the largest entity, which expands to 1 billion copies of the first entity. In the most frequently cited example, the first entity is the string "lol", hence the name "billion laughs". The amount of memory used would likely exceed that available to the process parsing the XML (it certainly would have at the time the vulnerability was first reported).
While the original form of the attack was aimed specifically at XML parsers, the term may be applicable to similar subjects as well.[1]
The problem was first reported as early as 2003, but began to be widely addressed in 2008.[3]
[edit] Code example
<?xml version="1.0"?> <!DOCTYPE lolz [ <!ENTITY lol "lol"> <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;"> <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;"> <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;"> <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;"> <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;"> <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;"> <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;"> <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;"> <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;"> ]> <lolz>&lol9;</lolz>
When an XML parser loads this document, it sees that it includes one root element, “lolz”, that contains the text “&lol9;”. However, “&lol9;” is a defined entity that expands to a string containing ten “&lol8;” strings. Each “&lol8;” string is a defined entity that expands to ten “&lol7;” strings, and so on. After all the entity expansions have been processed, this small (< 1 KB) block of XML will actually contain a billion “lol”s, taking up almost 3 GB of memory.[4]
[edit] References
- ^ a b Harold, Elliotte Rusty (27 May 2005). "Tip: Configure SAX parsers for secure processing". IBM developerWorks. Archived from the original on 4 March 2011. http://www.webcitation.org/5wwJidGdh. Retrieved 4 March 2011.
- ^ Sullivan, Bryan (November 2009). "XML Denial of Service Attacks and Defenses". MSDN Magazine (Microsoft Corporation). http://msdn.microsoft.com/en-us/magazine/ee335713.aspx. Retrieved 2011-05-31.
- ^ "CVE-2003-1564". Common Vulnerabilities and Exposures. The MITRE Corporation. 2003-02-02. http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1564. Retrieved 2011-06-01.
- ^ Bryan Sullivan. "XML Denial of Service Attacks and Defenses". http://msdn.microsoft.com/en-us/magazine/ee335713.aspx. Retrieved 2011-12-21.
 |
This computer security article is a stub. You can help Wikipedia by expanding it. |
