[ISN] New Denial-Of-Service Attack Cripples Web Servers By Reading Slowly

http://www.darkreading.com/advanced-threats/167901091/security/attacks-breaches/232301367/new-denial-of-service-attack-cripples-web-servers-by-reading-slowly.html

By Kelly Jackson Higgins
Dark Reading
Jan 05, 2012

A researcher today published proof-of-concept code that takes a 
different spin on the slow HTTP denial-of-service (DoS) attack simply by 
dragging out the process of reading the server's response -- and 
ultimately overwhelming it.

Sergey Shekyan, senior software engineer with Qualys, also has added 
this new so-called Slow Read attack to his open-source slowhttptest 
tool.

Slow Read basically sends a legitimate HTTP request and then very slowly 
reads the response, thus keeping as many open connections as possible 
and eventually causing a DoS.

Shekyan's Slowhttptest attack tool initially was inspired by related 
open-source tools Slowloris and OWASP's Slow HTTP Post. Slowloris keeps 
connections open by sending partial HTTP requests and sends headers at 
regular intervals to prevent the sockets from closing, while the Slow 
HTTP POST distributed DoS (DDoS) tool simulates an attack using POST 
headers with a legitimate "content-length" field that lets the Web 
server know how much data is arriving. Once the headers are sent, the 
POST message body is transmitted slowly, thus gridlocking the connection 
and server resources.

[...]


_____________________________________________________
Did a friend send you this article? Make it your
New Year's Resolution to subscribe to InfoSec News!
http://www.infosecnews.org/mailman/listinfo/isn