Apache HTTP DoS tool released
isc.sans.org
Apache HTTP DoS tool released
1–10 of 32 posts
Re: Apache HTTP DoS tool released
#2More info about this attack is available on http://ha.ckers.org/blog/20090617/slowloris-http-dos/
Re: Apache HTTP DoS tool released
#3More info about this attack is available on http://ha.ckers.org/blog/20090617/slowloris-http-dos/
After reading the main article and the link you provided, my interpretation/understanding is:
* The idea is to trick the web server into keeping a connection open and waiting for data, e.g. by keeping on sending pointless headers, not sending enough (* The reason this works is that apache has a limit of one thread or process per active connection, and there is typically an upper bound on
* The way to fix this once and for all in apache et al would be to handle socket I/O asynchronously, thus lifting the 1:1 ratio of connections to threads/processes.
Is that accurate? I'm mostly curious so that I can try to avoid any such pitfalls in any server software I might write.
One way to fix this in apache without breaking too many existing modules and extensions might be to use fibers to hide the asynchronicity and schedule them in the "blocking" I/O functions which would actually use non-blocking I/O underneath. (I don't actually know the apache architecture, so I might be wrong about the blocking I/O)
Re: Apache HTTP DoS tool released
#4woohoo!
Re: Apache HTTP DoS tool released
#5Put a reverse proxy in front. You should do this anyway. Modem and other pokey connections effectively do the same as this DOS.
Re: Apache HTTP DoS tool released
#6So... you basically just hold open all the TCP connections at once? How anticlimactic.
Re: Apache HTTP DoS tool released
#7So... you basically just hold open all the TCP connections at once? How anticlimactic.
In fairness, it does involve some HTTP, so it's not a pure TCP DoS. Anything other than apache on the same system is unaffected.
Re: Apache HTTP DoS tool released
#8There's really nothing new about this sort of depletion attack, and it's easy to launch in dozens of different ways in a line or two of code. (As far as a 'tool' to do it, I think the 'ab' benchmarking utility bundled with Apache suffices.)
In response, you block/throttle origin IPs, and decrease timeouts so zombie connections are dropped more quickly, and increase the capacity to serve or shake-off troublesome connections without locking out legitimate traffic. An inbound reverse proxy, as joshu suggests, often makes this easier -- and keeps such enforcement cruft from complicating the primary server.
Re: Apache HTTP DoS tool released
#9There's really nothing new about this sort of depletion attack, and it's easy to launch in dozens of different ways in a line or two of code. (As far as a 'tool' to do it, I think the 'ab' benchmarking utility bundled with Apache suffices.) In response, you block/throttle origin IPs, and decrease timeouts so zombie connections are dropped more quickly, and increase the capacity to serve or shake-off troublesome conne…
I think ab will send a full set of headers and not tie the server connection indefinitely.
Re: Apache HTTP DoS tool released
#10So... you basically just hold open all the TCP connections at once? How anticlimactic.
Yes, but since it's Apache, anything like this is big news.