Apache HTTP DoS tool released • Hacker News Board

Re: Apache HTTP DoS tool released

#11

Post by gojomo » Sat, Jun 20, 2009, 12:29 AM UTC

rbanffy wrote: post #9

gojomo wrote: post #8

There's really nothing new about this sort of depletion attack, and it's easy to launch in dozens of different ways in a line or two of code. (As far as a 'tool' to do it, I think the 'ab' benchmarking utility bundled with Apache suffices.) In response, you block/throttle origin IPs, and decrease timeouts so zombie connections are dropped more quickly, and increase the capacity to serve or shake-off troublesome conne…

I think ab will send a full set of headers and not tie the server connection indefinitely.

Yes, but with concurrency/repetition/keep-alive, you can still tie up essentially all of the connections. (And it's plenty easy to open any number of hanging connections without 'ab', too -- a few lines of shell script, at most.)

Re: Apache HTTP DoS tool released

#12

Post by moe » Sat, Jun 20, 2009, 1:23 AM UTC

rbanffy wrote: post #10

eli wrote: post #6

So... you basically just hold open all the TCP connections at once? How anticlimactic.

Yes, but since it's Apache, anything like this is big news.

It was big news 10 years ago (literally, 2001ish) when these kind of attacks were initially discussed. Nowadays it's more of a big yawn as the script kiddies rediscover old playgrounds.

Re: Apache HTTP DoS tool released

#13

Post by jsn » Sat, Jun 20, 2009, 2:40 AM UTC

And this is news somehow? Color me unimpressed. First time we'd been subjected to this kind of attack was, what, a year ago? Maybe two. It's a trivial next step after the old boring flood of http get requests.

Re: Apache HTTP DoS tool released

#14

Post by jsteele » Sat, Jun 20, 2009, 2:46 AM UTC

moe wrote: post #12

rbanffy wrote: post #10

Earlier quoted context omitted.

Yes, but since it's Apache, anything like this is big news.

It was big news 10 years ago (literally, 2001ish) when these kind of attacks were initially discussed. Nowadays it's more of a big yawn as the script kiddies rediscover old playgrounds.

10 years ago was literally, 1999ish.

Re: Apache HTTP DoS tool released

#15

Post by jimmyrcom » Sat, Jun 20, 2009, 3:31 AM UTC

It's a pretty short code written in perl. I'd be scared if it was modified from curl or written in erlang. The author admits being corrected about the type of attack not being new but claims thats the first tool. I don't see how its new though. Whether you keep alive by incomplete requests, by valid requests or by sending post data very slowly, it doesn't seem to make a difference. Just eat up as many connections as possible.

Re: Apache HTTP DoS tool released

#16

Post by gojomo » Sat, Jun 20, 2009, 7:27 AM UTC

jimmyrcom wrote: post #15

It's a pretty short code written in perl. I'd be scared if it was modified from curl or written in erlang. The author admits being corrected about the type of attack not being new but claims thats the first tool. I don't see how its new though. Whether you keep alive by incomplete requests, by valid requests or by sending post data very slowly, it doesn't seem to make a difference. Just eat up as many connections as…

That perl script is about 100x longer than it needs to be (even disregarding the embedded docs and ASCII graphics). This is a super-simple (and old) attack; many DoS attacks based on large amounts of traffic first cause problems by depleting this same limited pool of threads/connections.

Re: Apache HTTP DoS tool released

#17

Post by Locke1689 » Sat, Jun 20, 2009, 8:41 AM UTC

jsn wrote: post #13

And this is news somehow? Color me unimpressed. First time we'd been subjected to this kind of attack was, what, a year ago? Maybe two. It's a trivial next step after the old boring flood of http get requests.

It's also not that difficult to counter. The easiest way is to just do packet inspection - if something looks wrong (repeated bad/incomplete headers), just blacklist the IP for however many minutes. Repeat ad nauseam. Any IDS worth its salt shouldn't even hiccup at this.

Re: Apache HTTP DoS tool released

#18

Post by moe » Sat, Jun 20, 2009, 10:01 AM UTC

jsteele wrote: post #14

moe wrote: post #12

Earlier quoted context omitted.

It was big news 10 years ago (literally, 2001ish) when these kind of attacks were initially discussed. Nowadays it's more of a big yawn as the script kiddies rediscover old playgrounds.

10 years ago was literally, 1999ish.

Well, I know I have seen tools released in 2001. And I'm quite sure the discussion was older than that. Anyways, put 8 years if you want, this isn't news either way.

Re: Apache HTTP DoS tool released

#19

Post by jsn » Sat, Jun 20, 2009, 11:01 AM UTC

Locke1689 wrote: post #17

jsn wrote: post #13

And this is news somehow? Color me unimpressed. First time we'd been subjected to this kind of attack was, what, a year ago? Maybe two. It's a trivial next step after the old boring flood of http get requests.

It's also not that difficult to counter. The easiest way is to just do packet inspection - if something looks wrong (repeated bad/incomplete headers), just blacklist the IP for however many minutes. Repeat ad nauseam. Any IDS worth its salt shouldn't even hiccup at this.

It's trivial to counter indeed; you don't need any packet inspection for that. The main anomaly is not in the header structure, it's in the number of sessions opened simultaneously by one host. This particular tool uses broken headers for some reasons; other ones don't. But they all open sessions excessively.

So you just use iptables connlimit match block the clients with more than e.g. 10 connections.

Re: Apache HTTP DoS tool released

#20

Post by ryah » Sat, Jun 20, 2009, 11:16 AM UTC

pmjordan wrote: post #3

defied wrote: post #2

More info about this attack is available on http://ha.ckers.org/blog/20090617/slowloris-http-dos/

After reading the main article and the link you provided, my interpretation/understanding is: * The idea is to trick the web server into keeping a connection open and waiting for data, e.g. by keeping on sending pointless headers, not sending enough ( * The reason this works is that apache has a limit of one thread or process per active connection, and there is typically an upper bound on * The way to fix this once a…

> I'm mostly curious so that I can try to avoid any such pitfalls in any server software I might write.

If you start a thread for each connection, you're doing it wrong.