Thank you for Subscribing to Telecom Business Review Weekly Brief
Telecom Business Review | Friday, July 01, 2022
Slowloris is DDoS attack software that allows a single computer to take down a web server.
Fremont, CA: Robert "RSnake" Hansen develops Slowloris. Due to this attack's simple yet elegant nature, it requires minimal bandwidth to implement and affects the target server's web server only, with almost no side effects on other services and ports.
Slowloris has proven highly effective against many famous types of web server software, including Apache 1.x and 2.x.
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
Over time, Slowloris has been credited with several high-profile server takedowns. Especially, it was used extensively by Iranian 'hackivists' following the 2009 Iranian presidential election to attack Iranian government websites.
Attack description
Slowloris works by opening many connections to the aimed web server and keeping them open as long as possible. It does this by constantly sending partial HTTP requests, none of which are ever completed. As a result, the attacked servers open more, and connections open, waiting for each attack request to be completed.
Periodically, the Slowloris transmits subsequent HTTP headers for each request but never actually completes the request. Finally, the targeted server's maximum concurrent connection pool is filled, and extra (legitimate) connection efforts are denied.
By sending partial, as opposed to malformed packets, Slowloris can readily slip by conventional Intrusion Detection systems.
Titled after a type of slow-moving Asian primate, Slowloris does win the race by moving slowly and steadily. A Slowloris attack must wait for sockets to be released by legitimate requests before consuming them.
For a high-volume website, this can take some time. Moreover, the process can be further slowed if legal sessions are reinitiated. But in the end, if the attack is relentless, Slowloris—like the tortoise—wins the race.
If unseen or unmitigated, Slowloris attacks can also last for long periods. This is because Slowloris simply reinitiates the connections when attacked sockets time out, continuing to max out the web server until mitigated.
Designed for stealth and efficacy, Slowloris can be modified to send different host headers in the event a virtual host is targeted, and logs are stored separately for each virtual host.
More significantly, Slowloris can be set to suppress log file creation in the course of an attack. This indicates the attack can catch unmonitored servers off-guard without any red flags appearing in log file entries.
More in News