News for hackers. Stuff that matters.

A comment on The AWS S3 Denial of Wallet Amplification Attack. Parent comment

Re:The AWS S3 Denial of Wallet Amplification Attack by easton on Wednesday May 01, 2024 @04:49PM (#40229223)
> this completely fails to explain the article's observed 3 TB sent vs 130 TB billed

I interpreted that to be that their code was doing this over and over again, so in total they retrieved 3TB over a set of requests. Still horrifying, but mildly more explainable.

[ Parent | on HN ]
Re:The AWS S3 Denial of Wallet Amplification Attack by scottlamb on Wednesday May 01, 2024 @09:54PM (#40231940)
Even so, TCP windows generally don't start at the maximum size, so I'm really not buying that ratio of bytes ACKed to sent.

One could disprove this explanation with a packet capture; just add the remaining window.

[ Parent | on HN ]