Nginx server not safe against ldos | feedback from sys admins? • Hacker News Board

Nginx server not safe against ldos | feedback from sys admins?

#1

Post by rudhir-secpanel » Sun, Nov 20, 2011, 8:34 PM UTC

Nginx server not safe against ldos | feedback from sys admins?
blog.crackerhost.com

Re: Nginx server not safe against ldos | feedback from sys admins?

#2

Post by andrewcooke » Sun, Nov 20, 2011, 9:10 PM UTC

why would it matter what the server was? isn't the attack against the TCP/IP stack? (low rate DOS fools TCP's flow control into over-restricting transmission afaict).

Re: Nginx server not safe against ldos | feedback from sys admins?

#3

Post by makira » Sun, Nov 20, 2011, 9:14 PM UTC

From the page summary on Google:

LDoS = low rate denial of service (I didn't know, did you?).

Now the article doesn't load, anyone has the text?

Re: Nginx server not safe against ldos | feedback from sys admins?

#4

Post by asm89 » Sun, Nov 20, 2011, 9:19 PM UTC

makira wrote: post #3

From the page summary on Google: LDoS = low rate denial of service (I didn't know, did you?). Now the article doesn't load, anyone has the text?

Google cache link: http://webcache.googleusercontent.com/search?q=cache:http://...

Re: Nginx server not safe against ldos | feedback from sys admins?

#5

Post by jsn » Sun, Nov 20, 2011, 9:39 PM UTC

Attack description and analysis: http://www.cs.unc.edu/~jeffay/courses/nidsS05/attacks/TCP-sh...

I agree with andrewcooke, it doesn't seem to be a problem of nginx or apache. OS TCP implementation should be modified to handle this type of attacks.

Re: Nginx server not safe against ldos | feedback from sys admins?

#6

Post by delinka » Sun, Nov 20, 2011, 10:01 PM UTC

Editorialized title on HN? According to article text served by the Google cache says he did this to Apache first, then someone specifically requested a test against Nginx. Those of you saying "it's not Nginx, it's the OS" are definitely correct, please at least acknowledge that the tester/author isn't being completely duplicitous.

Re: Nginx server not safe against ldos | feedback from sys admins?

#7

Post by blissofbeing » Sun, Nov 20, 2011, 11:01 PM UTC

Honestly looks like there are no real good solutions to this yet.

Re: Nginx server not safe against ldos | feedback from sys admins?

#8

Post by rudhir-secpanel » Mon, Nov 21, 2011, 2:50 AM UTC

andrewcooke wrote: post #2

why would it matter what the server was? isn't the attack against the TCP/IP stack? (low rate DOS fools TCP's flow control into over-restricting transmission afaict).

the attack was done with slow http traffic. the delay effect on an apache server on the same os(centos) was different than was on nginx(again on centos). also i have been able to control the attack by focusing on the web server - apache or nginx.

Re: Nginx server not safe against ldos | feedback from sys admins?

#9

Post by rudhir-secpanel » Mon, Nov 21, 2011, 3:01 AM UTC

delinka wrote: post #6

Editorialized title on HN? According to article text served by the Google cache says he did this to Apache first, then someone specifically requested a test against Nginx. Those of you saying "it's not Nginx, it's the OS" are definitely correct, please at least acknowledge that the tester/author isn't being completely duplicitous.

Thanks for you 'vote' :). I have responded to the issue of nginx vs os

Re: Nginx server not safe against ldos | feedback from sys admins?

#10

Post by rudhir-secpanel » Mon, Nov 21, 2011, 3:02 AM UTC

blissofbeing wrote: post #7

Honestly looks like there are no real good solutions to this yet.

we have been working on this and have had some success in detecting and stopping an attack. would be glad to share more details, if you want