Lightning talk (5 minutes)
security
cloud

One night, a webservice hosted on a popular cloud provider was struck by a mysterious http request and surprisingly did not recover for half an hour. That event reminded that starting a publicly available webservice means becoming a target for scanners that relentlessly crawl the internet poking for vulnerabilities. This lightning talk discusses a real-world story of a certain message from such a massive scan that instead of failing gracefully with 404 response code (Not found) started to cause 408 (Request timeout) - a much bigger threat of Denial of Service. In order to reproduce the issue, different methods of logging were examined - both using cloud services, as well as Java application based. Surprisingly, it also offered a way to optimize the load on the hosting infrastructure.

Pawel Krzywicki