Slowloris is a type of denial of service attack tool which allows a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports. It is the prototypical slow DoS attack tool.

Slowloris tries to keep many connections to the target web server open and hold them open as long as possible. It accomplishes this by opening connections to the target web server and sending a partial request. Periodically, it will send subsequent HTTP headers, adding to, but never completing, the request. Affected servers will keep these connections open, filling their maximum concurrent connection pool, eventually denying additional connection attempts from clients.

The program was named after slow lorises, a group of primates which are known for their slow movement.

Affected web servers This includes but is not necessarily limited to the following, per the attack's author:

Apache 1.x and 2.x dhttpd Websense "block pages" (unconfirmed) Trapeze Wireless Web Portal (unconfirmed) Verizon's MI424-WR FIOS Cable modem (unconfirmed) Verizon's Motorola Set-top box (port 8082 and requires auth - unconfirmed) BeeWare WAF (unconfirmed) Deny All WAF (patched) Flask (development server)

The following are disputed (not affected according to author but affected according to PowerWAF): Internet Information Services (IIS) 6.0 and earlier Nginx 1.5.9 and earlier

Because Slowloris exploits problems handling thousands of connections, the attack has less of an effect on servers that handle large numbers of connections well. Proxying servers and caching accelerators such as Varnish, nginx, and Squid have been recommended to mitigate this particular kind of attack. In addition, certain servers are more resilient to the attack by way of their design, including Hiawatha, IIS, lighttpd, Cherokee, and Cisco CSS.

Affected by variants (the original version) offers the following options: Choice of DNS server and target port. Choice of HTTP timeout, connection count, local TCP timeout. Avoidance of HTTP cache (not well-tested) Avoidance of httpready protection by substituting GET for POST Option to use more than one parameter for virtual hosting-enabled targets. This often results in attack connections being logged to separate log files, making it stealthier. Option to use HTTPS instead of HTTP. This simply applies the attack on the enacpsulated HTTP connection and is not an attack on the SSL/TLS handshake. Not very useful per the author.

PowerWAF claims that there is a variant attack on the SSL/TLS handshake process. The following are allegedly affected:

Apache HTTP Server 2.2.15 and earlier Internet Information Services (IIS) 7.0 and earlier

Mitigating the Slowloris attack While there are no reliable configurations of the affected web servers that will prevent the Slowloris attack, there are ways to mitigate or reduce the impact of such an attack. In general, these involve increasing the maximum number of clients the server will allow, limiting the number of connections a single IP address is allowed to make, imposing restrictions on the minimum transfer speed a connection is allowed to have, and restricting the length of time a client is allowed to stay connected.

In the Apache web server, a number of modules can be used to limit the damage caused by the Slowloris attack; the Apache modules mod_limitipconn, , mod_evasive, , mod_noloris, and mod_antiloris have all been suggested as means of reducing the likelihood of a successful Slowloris attack. Since Apache 2.2.15, Apache ships the module mod_reqtimeout as the official solution supported by the developers.

Other mitigating techniques involve setting up reverse proxies, firewalls, load balancers or content switches. Administrators could also change the affected web server to software that is unaffected by this form of attack. For example, lighttpd and nginx do not succumb to this specific attack. (However, nginx suffers from a similar goloris attack which substitutes the HTTP GET with HTTP POST; the ngx_http_limit_conn_module is the author's recommended solution.)

R-U-Dead-Yet R.U.D.Y., short for "R U Dead Yet?", is an acronym used to describe a Denial of Service (DoS) tool used by hackers to perform slow-rate (known as "Low and slow") attacks by directing long form fields to the targeted server. It is known to have an interactive console, thus making it a user-friendly tool. It opens fewer connections to the website being targeted for a long period and keeps the sessions open as long as it is feasible. The amount of open sessions overtires the server or website making it unavailable for the authentic visitors. The data is sent in small packs at an incredibly slow rate; normally there is a gap of ten seconds between each byte but these intervals are not definite and may vary to avert detection.

The victim servers of these types of attacks may face issues such as not being able to access a particular website, disrupt their connection, drastically slow network performance, etc.

Hackers can use such attacks for different purposes while targeting different servers or hosts; these purposes include, but are not limited to, blackmail, vengeance or sometimes even activism.

The RUDY attack opens concurrent POST HTTP connections to the HTTP server and delays sending the body of the POST request to the point that the server resources are saturated. This attack sends numerous small packets at a very slow rate to keep the connection open and the server busy. This low-and slow attack behavior makes it relatively difficult to detect, compared to flooding DoS attacks that raise the traffic volume abnormally.

Notable usage

During the protests that erupted in the wake of the 2009 Iranian presidential election, Slowloris arose as a prominent tool used to leverage DoS attacks against sites run by the Iranian government. The belief was that flooding DDoS attacks would affect internet access for the government and protesters equally, due to the significant bandwidth they can consume. The Slowloris attack was chosen instead, because of its high impact and relatively low bandwidth. A number of government-run sites were targeted during these attacks, including gerdab.ir, leader.ir, and president.ir.

A variant of this attack was used by spam network River City Media to force Gmail servers to send thousands of messages in bulk, by opening thousands of connections to the Gmail API with message sending requests, then completing them all at once. (See Slow DoS attack for more information on similar attacks.)

Similar software Since its release, a number of programs have appeared that mimic the function of Slowloris while providing additional functionality, or running in different environments: PyLoris – A protocol-agnostic Python implementation supporting Tor and SOCKS proxies. Slowloris – A Python 3 implementation of Slowloris with SOCKS proxy support. Goloris – Slowloris for nginx, written in Go. slowloris - Distributed Golang implementation QSlowloris – An executable form of Slowloris designed to run on Windows, featuring a Qt front end. An unnamed PHP version which can be run from a HTTP server. SlowHTTPTest – A highly configurable slow attacks simulator, written in C++. SlowlorisChecker – A Slowloris and Slow POST POC (Proof of concept). Written in Ruby. Cyphon - Slowloris for Mac OS X, written in Objective-C. sloww - Slowloris implementation written in Node.js. dotloris - Slowloris written in .NET Core SlowDroid - An enhanced version of Slowloris written in Java for running on Android, reducing at minimum the attack bandwidth

See also SlowDroid Trinoo Stacheldraht Denial of service LAND Low Orbit Ion Cannon High Orbit Ion Cannon ReDoS Fork bomb Ping of death Zemra

References

External links Slowloris HTTP DoS hackaday on Slowloris Apache attacked by a "slow loris" article on LWN.net Slowloris – a short video (including a demo) Home page of SlowHTTPTest An Attempt at Simulating SlowLoris on LOIC Blog post explaining the inner workings of Slowloris r-u-dead-yet on Google Code r-u-dead-yet on SourceForge