RailsConf 2022 - Service Denied! Understanding How Regex DoS Attacks Work by Kevin Menard

Channel:

Confreaks

Subscribers:

42,400

Published on January 16, 2023 4:00:30 PM ● Video Link: https://www.youtube.com/watch?v=XpF3H6w1NSY

Duration: 30:44

109 views

0

Did you know that people can knock your Rails application offline just by submitting specially formatted strings in a form or API request? In this talk, we’ll take a look at what’s really going on with a regex denial of service (DoS) attack. We’ll take a peek into the CRuby regex engine to see what it’s really doing when we ask it to match against a string. With a basic understanding of how regular expressions work, we can better understand what these attacks do, why they tie up so much CPU, and what we can do to guard against them.