Slow Loris Attack - Computerphile
Вставка
- Опубліковано 8 лис 2016
- Denial of service usually relies on a flood of data. Slow Loris takes a more elegant approach, and almost bores a server to death. Dr Mike Pound explains.
Cracking Windows by Atom Bombing: • Cracking Windows by At...
Zero Size Files: • Zero Size Files - Comp...
Google Deep Dream: • Deep Dream (Google) - ...
Babbage's Analytical Engine: COMING SOON
/ computerphile
/ computer_phile
This video was filmed and edited by Sean Riley.
Computer Science at the University of Nottingham: bit.ly/nottscomputer
Computerphile is a sister project to Brady Haran's Numberphile. More at www.bradyharan.com
Express explanation: Imagine sending 100 old grandmas to a convenience store, with all of them trying to tell a story from their childhood to the cashier so that no other customers can buy anything.
Yeah, while forgetting their stories halfway through and starting all over.
You should be on ELI5 subreddit.
shouldn't you be busy saving the world, Niko?
That variation of the attack is described in more detail in this video watch?v=tc_KJEwzq74
That's a clever IRL DoS.
The first rule of coding: All user input is evil.
Second rule of coding: Checking rule 1 is NP-hard!
Wouter Damen Ikr! All the parsing and data validation!
Like life: cant trust anyone. But obviously thats not the optimal strategy.
So true!
+TechyBen
Why is it NP-hard?
This is now my favorite Denial of Service attack as well
indeed
same I was laughing alot at how simple but effective this is.
Chaining Solid not really effective anymore except for unpatched web servers. but yeah, genius in it's conception by using the artificial limits used to stop DDoS against the server to DDoS it anyway. lol
Yeah, except it's useless because every sensible webserver has a connection limit per client or IP (something on the order of 2-10, beyond that you're blocked). It's true that it saves traffic, but there's no way around owning a botnet...
could just go through a few proxies/VPNs if you really needed to do it solo.
This is so beautifully evil it made me cry.
Dr EVIL would be proud!
Mojo Jojo would be proud
Cry? Like a girly man?
This is so beautifully evil is makes me rage at myself for not thinking of it first!!
And your comment made me WannaCry
Ambrus Sümegi a
To add to that: Other webservers like nginx are not vulnerable to slowloris because they don't reserve a thread per connection. Instead, they have a worker thread pool. Each thread in that pool has a task queue. These threads run all tasks in their queues until the queues are empty. So, as soon as you insert a task in their queue, it eventually gets run. Every time a bit of data comes in from a client, a new task is created - "process this data". This task is then assigned to one of the worker threads whose task queue isn't full. The assigned thread then eventually runs the task. That way, even incredibly slowly arriving partial HTTP requests won't block anything, because the threads aren't exclusively reserved for handling one particular connection. The whole HTTP request handling is broken up into these small individual tasks instead.
I really needed this! Thank you for your clear writing.
I understand why this is his favorite.
And I like the gleam in his eyes for this one..
It seems weird that he's using the Ubuntu machine for browsing and the Windows machine for serving.
yeah, i was thinking the same thing. moreso that it's apache on windows.
That's what I was thinking. Though if you're deploying apache with the specific intention of breaking it, maybe windows is the better platform.
it doesn't matter and it's faster to install server on windows than on linux
He'll be using the university network which will most likely be windows enviroments.
Nimisidiv Except the other machine is Linux. Anyway, installing Apatchy httpd on Linux is very fast it's an OS feature. But installing Monty Python etc. on Windows is harder than installing Apache, so if he only had those two machines it's just easier to do the python script on the Linux machine and use a badly configured toy web server on Windows as the target.
All Mikes videos seem to be so simple to follow and his presentation makes you want to follow.... Where were you when I was at school?
Yeah, he should have a dedicated channel
It's also great how he has to add the obligatory 'don't really do this', but you can see in his eyes that he thinks this stuff is awesome ;-)
would be cool, but i think its more complicate that it seems to be here
I am at the Uni he teaches at, very nice guy in general. Can occasionally hear him talking in an office and wonder if a new Computerphile video is on the way :)
DamagedSave Go talk to him! Say we would like to see his channel :P
OMG! a computerphile that actually shows some code! Is it christmas or something?
Well, seriously, you could probably find the code fairly quickly or writ it yourself knowing the idea behind it, so...
I'm pleased too, but computer science/computing isn't ALL about code. :)
tru tru
but its in a noob language like python
>noob language
aakksshhaayy is living in 2080 with his "assembly code only" ideology
Dr. Mike Pound: writes 67 lines of codes and breakes a site
Me: writes 5000 lines of codes and my program is still useless.
Emanuele Giordano he didnt write it as he said
Well, maybe you should drop H and do something in JS or Python
It's called denial of execution attack injected by the creator of the language to prevent your code from doing what you want it to do. Just like this very comment is denial of skill attack by me to prevent you ..
[Okay, this joke took a mean turn, I'll stop now.]
One of my favorite computerphile videos in recent memory!
Will you cover how servers would defend against this technique?
+
Yeah I'd love to know this too.
Use Lighttpd or nginx ;P
I wonder how many Apache threads some normal Linux box could handle.
One obvious answer is: don't spawn a new thread for every connection. If you keep your processing as lightweight as possible, attacks like this have a much smaller effect.
You could also limit the number of open concurrent connections to the same IP.
People calling themselves hackers because they did a DDoS attack, is like people calling themselves lock pickers for blowing up the safe.
Simple rule.
If you can make money out of it then you are a real hacker.
Otherwise you are just an aficionado.
nah, script kiddie
Makes so much sense now
What is the relevance of this comment to the video?
Eh, but then you've destroyed the contents of the safe, which isn't what a DDoS does. It would be more like throwing the safe off a bridge into very deep water. Or launching it into space on an extrasolar trajectory. And then proclaiming yourself to be the greatest safecracker of all time. :)
I love these kinds of videos. My favorite one is when tom scott talked about the NTP attack method.
thanks gonna use this on the scientology website now
lol
and if you did that on an islamic website, youd be called a racist
they are gonna sue!
My idea too
they might be using apache, how can you tell before hand
6:34 CTRL+SHIFT+R will refesh whilst ignoring the cache.
it would make things so much easier if viruses actually had the .virus extension like at 0:45
Hey, would you like to download my file? It is called secretbitcoinaddress.notavirus
W3C is working on the standard
Instead of ".exe"
@@godfreypoon5148 lol
Virus software be like "del /S C:\*.virus"
I love how the amplifier was set to 11 :-)
Nigel respect
Amplified?
Wow that's such a clever attack.
it is, but just glance at apache's documentation and you'll find timeouts for keep alives and "read timeout"
My God, this guy is so freaking amazing.
I don't really care for an accurate description as long as the concept behind it is described, which he did. If one were to want a more accurate description, I'm sure one could find one for themselves. I don't think that this video is meant as a walk-through to an exploit.
I love the videos with Dr Pound, he's always so enthusiastic and speaks clearly.
I could listen to Dr Pound explain things for hours. Such an interesting video! Thanks for the upload Computerphile :)
I want Mike to explain RUDY as well! The most common DDoS attack methods would be awesome to hear more about. He explains it very nicely!
Always love to see the enthusiasm Dr. Pound puts in his explanations.
ive been watching/listening your vids for 2 consecutive days while im at my work. it's so informative and how you deliver your explanations is so incomparable. i love it
Kind of a passive aggressive DOS. Totally agree … beautifully elegant and diabolical :D
Dr Pounds videos are the best by far.
i hope you guys don't stop uploading like these informative videos. they are pretty informative and well organized. keep going with these videos
Yay Ubuntu, using it right now and have been for 3 years as my main OS. Used it before for like 2 or more years as a 2nd OS to play around with
Nobody cares m8
good for you
Speedyjens I was just sharing my experience with Ubuntu cos you rarely see people use it. If you don't care, you can skip along like everyone else does. I am sure you don't care about every UA-cam comment and you generally skip along. This one shows you somewhat care to make the effort to reply to....
Anesu C You comment really had nothing to do with the video.
*cough* alot of servers uses ubuntuu *cough*
Speedyjens They use Linux not specifically ubuntu, tha I have experienced first hand. Also it doesn't matter if it wasn't explicitly related to the topic, it's like watching a show and your favorite actor/singer/etc shows up. You will notice a lot of comments about that person rather than the topic of the show itself.... Just another note, this video pretty much covered the topic well, I had nothing else to add, hence I mentioned this instead.
Now it's my new favourite too..thanks for giving me ideas computerphile
It's rare that I get excited like a little kid anymore but when I saw a new Dr Mike Pound video in my feed I almost started jumping up and down clapping my hands lol
Every video i see from Computerphile(Mike) i am totally in love how excited he explains everything he always infect me to try it out on my next customer...
One of my favorite computerphile videos!
People! The first D in DDoS has a meaning, and it is DISTRIBUTED. If only one computer attacks, it's just a regular DoS.
"Mike's Website"
"It's purple"
One of my favorite Computerphile videos!
Love these server and networking videos, keep 'em coming
Very interesting. We so often get told about what something like this does, but this is the first time I have ever seen such a thing actually demonstrated. And, nice to see a Linux box on this channel. :)
Dude, I love these videos!
I love how excited he is about this DoS and explaining it. The explanation really helped with my studies for CEH! THanks!
@computerphile: I love how the servers are in the cloud. You guys do great work!
Someone has registered their copy of Sublime Text... not sure if it's a good or bad sign.
I like the theme he's using so it's fine
"Registered"
Maybe he also has a registered winrar somewhere.
Lol, he pays for software that is basically free. Look up VScode.
@@hexagonist23 or VSCodium if you don’t want to get your linux install dirty with Microsoftware
I was giggling the whole time thinking this is my favorite too.
So how is the wild dealing with this? Are servers cutting off slow connections now but the cutoff point is like where the battles are fought?
I love Mike Pound's videos, especially this one. Cheers. 🙂
Mike is great in front of a camera. Good at explaining and charismatic!
beautiful
Would you say the server technology is "a patchy" one?
Excellent video! One of my favorites so far.
thanks so much, the info is gold and the way you present it is perfect
"The same person looking at the website really slowly 200 times"
I don’t know shit about programming but it’s always fun to see a nerd talk about their passion lmao
your profile pic is intresting lol
Wow, this attac honestly is quite beautiful
That was educational and so fun to watch at the same time :) thanks for making this video! Please continue to show more code/ link code in the description.
I love Mike's videos explaining how to do these attacks! I would never do them (I don't want to go to jail :) ), but they are really interesting. Keep 'em coming!
Thomas Gourley
do you honestly think that you could go to jail for this?
+joe 10001001 you absolutely would go to jail for a denial of service attack like this. if i'm not mistaken, it's a federal offense.
it depends who you do it to and how effective it is tho right?
large companies rely on a lack of public knowledge on tech and bribery to make things like dos illegal. if you think about it dos is a form of peaceful protest (when the participants are willing). using current event as an example, ddos attacks are analogous to a crowd of people standing in front of trump tower to prevent people getting in and by extension, trump making money. this dos attack is perfectly understood by this hypothetical scenario. you fine out that a restraint has been steeling credit card numbers, so you gather a group of 30 friends who each take a table, then when a waiter comes to get their order they ask for 5 more minutes. in my opinion, you and your friends are not committing a crime, any loss in profit that the restaurant is facing is their fault because they chose not to kick you out.
and with the normal ddos attack you are simply peacefully protesting (if you are using a botnet and not and not a community who agrees and wants to help the cause) you are guilty of a different crime.
These videos are fun but I would have liked to see a part about how not to get downed by such a attack especially since a large portion of viewers possible has a website or server somewhere since most of us are working with computers every now and again.
I agree. Not much substance to this video without preventative measures.
Just drop the connection if it is unrealistically slow.
user255
Sure could you give a example of how to setup a iptable rule or apache configuration that would do this for me then?
Dantali0n I think I spoke too soon... it is not as easy as I thought. But check this:
insights.sei.cmu.edu/cert/2009/07/mitigating-slowloris.html
loved the video. also please tell Mike to retake neural nets series, I'm eager to see more
Such an elegant explanation
You can just as well call it "the power of being lazy"
Err, wait, we were using that in the 90s all the time, I always thought there had been countermeasures implemented even back then...
You don't need a thread per socket... A thread could handle "thousands" of slow socket...
This is a design problem in a "optimisation" done on the Apache server. As he said, not all http server have this weakness.
Hendrik-Jan Smit You might want to research the C10k problem. For one you can make connection handling much much more effective, also you can rather easily detect a client misbehaving this way and block it.
As Morgan says, "Everything gets a return"
Randomly ended up here and really enjoyed the demo.
That is so clean and elegant.
So....What's the fix? how to prevent such an attack?
I would think having a hard timeout on connections (as in having any single connection not be longer than a few seconds) would work, although it might make accessing the site from a very slow connection impossible.
Any server that doesn't have one thread dedicated for each socket will fair well against this attack. Nginx can handle 10k concurrent connections, probably more of these "pseudo"connections
I don't know but maybe limit the number of connections per user or don't use apache?
+Natanor That would not work. Apache already has hard timeout for requests but the script recreates each connection that was closed by the server.
+ILYES You can limit the number of connections from an IP address but that may make your website unuseable from some large companies or organisations that have only a few external IP addresses.
I would try solving it by prioritizing the faster connections and having lower time outs.
It's the modern equivalent of standing behind 200 grandma's at the post office.
This is great for testing how much HTTP requests a server can handle aside from simulating a DOS attack it can really show you how much your server can handle.
love the spinal tap reference on the amplifier
This guy reminds me a lot of that guy that played Spiderman in the movies.
Is it possible to combine this attack with IP Spoofing, so that the IP adr is never the same? It would look like 200 different slow people would look at this at a time.
Even better than that, the packets are so small that you can easily route them through the Tor network, maybe even with a separate connection for each socket. (Depending on the per socket timeout)
This is awesome, I love this attack. I tried it out on a google site I made and it made the site really slow, but I didn’t feel like waiting for the site to go down.
The SYN flood is a more prevelant kind of DOS. Awesome video!
It goes up to 11
I accidently did this to my own server
Good job with the videos, they're really interesting. It would be nice if you also showed how one could defend the server from such attacks
Dr. Pound is always so good.
While watching this video.... I casually used my toe to start up my ubuntu web server.... No reason....
now I know how to break my website, but how can I defend it?
#firewall might fix this for you
ip6tables -I INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 10 -j DROP
iptables -I INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 10 -j DROP
Can you elaborate? I assume that drops the slow connections, right?
I assume it limits the number of connections per IP to 10 on port 443. This might ban an entire country.
***** Qatar has only one public IP. Everything I say is 100% serious.
***** I don't know either. A different situation: a bunch of governments are blocking a lot of sites. If one were to use Tor to bypass it he would have found that some CDNs are blocking Tor IPs. I guess these are rare cases and generally shouldn't be worried about.
This guy is the best computerphile host!
something like this was alluded to in Gibson's "Neuromancer"; fascinating that it sometimes works in the real world!
This is the funniest DDOS
Where you're right, you're right. Thanks for your clarification
I'd like to give props to both of you guys - nidefawl for giving proper explanation and Axel for taking the lesson. If only internet was full of people like you! ;)
+dzikiLOS I guess the Internet will never be full of people like the ones in this comment section -_-
But that's more in a conjunction to people in general. not the web
@nidefawl I'd thought it would be, given the amount of connections, and all of them distributing a connection. I don't know, though, because I have hardly any experience with any form of coding.
This ...................................................................................................................
...........................................................................................................................
...........................................................................................................................
works ................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
for .....................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
comments .......................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
...........................................................................................................................
too.
best explaination ............ I am blessed to watch a Channel like computerphile, david bombal etc
I want more from this guy ! He is the best!
What's the solution?
Typewriters and postage stamps
boothegoo pc No, iptables
Design a thread to handle all the slow connections? ---> Two lorises having fun chatting with each other...
That's not an automatic solution though right? You need an administrator to recognize the problem and block their IP right?
@Yanni mouzakis I have no idea. Even if it's possible to handle/consolidate slow connections automatically, it just make the attacker pay as much resource as the server in the end.
Apache opening a new thread be like: *"Haii! I'm Mr. Meeseek, look at me!"*
Lol too accurate
Dude you get so excited when explaining these things, I find that I end up smiling from start to finish, and in the end my smile slowly fades after a minute or so. lol
he is such an amazing Prof, great understanding, perfect knowledge.
0.:55, look at that amp. 11 :P
Am i the only one who only likes this guy? :o
Nope.
And I'll bet I'm not the only one who is happy to a Linux box from my own Linux box.
Such a lovely video.
Does this guy have his own channel? His stuff is the best on the channel and explained so succinctly.
Ubuntu, Sublime Text and Python. I like that!
Daniele Dal Col Aka the "I just enlisted in an IT course but Ill still call myself a real programmer already" starter package :)
/s
Talking about DDoS, well, a lot of disappointed Americans did it to Canada Immigration Department, should it count as DDoS?
So are you like the maple version of a Trump supporter. "Damn Americans, comings here too lazy to make hockey sticks like the rest of us; coming here go'n take my job at the hockey stick factory."
You got to love those layer 7 attacks, abusing services with ...
THis is one of my favorite videos
6:03 Dude, that's a public IP.
It's probably local for the University, their local IP address usually look like public ones.
Probably public, Universities often give out public IP's to clients
@@willway1234 Yes, it is.
Where can I download that brownish windows theme?
It's actually a different operating system, a Linux distro called Ubuntu.
not windows
I’m pretty sure you could configure monitoring on a web server to close connection which were slower once Apache’s max connections were reached. But I love the name of this attack!
That is so dastardly and elegant.
Nginx, need I say more?
yes, say more please
I'll say that I used Apache 2.2 and then 2.4 for a few years and I'm so happy that I switched to Nginx.
thanks for more :)
Or Node.js
Ljón That's quite different though.
Why not just go: Oh we have a few hundred stupidly slow connections; they're probably not legitimate; lets, for now, decrease the time out, any lost legitimate slow connection are just an acceptable loss.
Edit: Actually you'd probably have to create a new time out that drops the connection regardless of weather it's still sending data.
sounds like a solution a business owner would agree with.
That is already implemented in Apache, requests have hard limit after which they are dropped. However, the script simply reopens every connection that the server closed. A few legitimate requests may skip through but that would hardly make a shop useable.
The correct solution is to use a web server that does not spawn a new thread for each connection (usually as a reverse proxy that will collect and resend requests if you still need Apache for your website). Then they can easily handle tens of thousands of such connections.
That has the problem that the attacker still just opens up new requests. Even if you drop all of the connections quicker, the attacker will also open requests quicker. So the attacker still eats up your threads.
I wonder if there is a way that Apache servers can implement a non thread based connection scheme or something. There must be a common fix or prevention method if half of all webservers are running the most vulnerable system!
ericsbuds "non thread based" do you even know what threads are?
sounds very similar to (or built on) the resource exhaustion attack, where you open up as many sockets as you can muster, but don't send anything. The server runs out of sockets, primarily because the OS is typically going to allocate only so many resources to maintaining sockets in general (just like in *ix there are upper bounds on number of systemwide open file descriptors, number of per-process open file descriptors, number of slots in the process table, number of shared memory segments, number of GIDs of which a process can be a member, and similar arbitrary and sometimes configurable constraints).
Ah that's a pretty nifty attack, very cool.
My favorite DDOS is the NTP reflection monlist attack.