Slowloris attack is famous for slowly draining the life out of a website until it can no longer function properly. In addition, this type of attack is known for its ability to cause significant damage to websites and servers, leading to slowdowns, crashes, and data loss. But don’t let that scare you! By understanding how Slowloris attacks work and how to protect your website from them, you can keep your online presence secure and running smoothly. So without any further ado, let’s get started!
What is the Slowloris attack?
Slowloris attack is a type of Denial of Service (DoS) that aims to flood a targeted server with incomplete HTTP requests. As a result, it overwhelms the target with a slow and steady stream of traffic. The attack works by sending a massive amount of incomplete HTTP requests, exploiting the server’s limited number of connections and eventually leading to a complete shutdown.
The key characteristic of the Slowloris attack is that it utilizes a very low bandwidth and can persist for an extended period of time. That makes it hard to detect and mitigate and can cause significant damage. It has proven to be highly effective against various types of web server software, such as Apache 1.x and 2.x.
Slowloris is actually a piece of software created back in 2009 in the Perl programming language by Robert “RSnake” Hansen. An interesting fact is that the attack gets its name from a type of slow-moving Asian primate that completes the job by moving slowly but steadily.
Why Are Slowloris Attacks Dangerous?
Slowloris attacks are more difficult to detect because they send partial, instead of corrupted, packets. That is especially challenging when the attacker uses a group of infected devices to initiate a Slowloris DDoS attack. Therefore, traditional intrusion detection systems are less effective at detecting this type of DDoS attack. Furthermore, if a Slowloris attack goes unnoticed, it can persist for a prolonged period, causing significant harm.
Here are the main reasons why Slowloris attacks are so dangerous:
- Hidden: They are challenging to detect as they use low bandwidth and slowly consume server resources over time.
- Persistent: These attacks can last for an extended period, making them more difficult to mitigate than other types of DDoS attacks.
- Disruptive: Slowloris attacks can cause significant harm to a website or server by disrupting its performance and causing slowdowns, crashes, and data loss.
- Resource intensive: The attack demands large amounts of server resources to defend against it, potentially leading to decreased performance or complete failure of the target.
- Widespread impact: Slowloris attacks can impact not only the targeted website or server but also its users and customers, who may experience slowdowns, errors, or complete unavailability.
How does it work?
The Slowloris attack works by sending a massive amount of incomplete HTTP requests to the target web server. The cybercriminal sends partial requests, which never get fully established. The target server holds these connections open, waiting for the missing information. Over time, the increased number of open connections begins to consume the server’s resources, eventually becoming incapable of processing legitimate requests. This results in a Denial of Service (DoS) attack, causing the server to become slow, unresponsive, or even crash.
The Slowloris attack is performed mainly in the following four steps:
- Multiple Connections: The attacker opens multiple connections to the targeted server by sending multiple partial HTTP request headers.
- Server Threads: The target opens a thread for each incoming request, planning to close it once the connection is completed. Yet, if a connection takes too long, the server will time it out to free up the thread for new requests.
- Keeping Connections Alive: To stop the target from timing out the connections, the attacker periodically sends partial request headers to maintain the request alive. Basically, it says, “I’m still here! I’m just slow. Please wait for me!”
- Resource Exhaustion: The targeted server cannot release any open partial connections while waiting for the termination of the request. Once all available threads are in use, the server will be unable to respond to requests from regular traffic, leading to a Denial of Service (DoS).
The main advantage of the Slowloris attack is its ability to cause significant damage with very little bandwidth consumption.
What are the signs of Slowloris attack?
A Slowloris attack, as its name indicates, is slow and methodical in its approach. The attack sends partial HTTP requests to the targeted web server yet never completes them. As a result, the server opens more and more connections in expectation of the requests being completed.
Over time, the server’s maximum number of connections is gradually occupied, leaving no room for legitimate requests to be processed. For high-traffic websites, it may take longer for Slowloris to take control fully, but eventually, the attack will block all valid requests.
Here are some of the signs of an appearing Slowloris attack:
- Slow website performance – Your website may suddenly become slow or unresponsive.
- High server resource usage – If you notice a sudden increase in server resource usage, such as high CPU or memory usage, it could indicate a Slowloris attack.
- Error messages – If you receive error messages, such as “504 Gateway Timeout” or “403 Forbidden,” it could be a sign that your website is under attack.
- Increased traffic – If you witness an unexpected spike in traffic, it could signify that a Slowloris attack is targeting your website.
- Connection reset messages – If you receive connection reset messages, it may indicate that the attacker is attempting to disrupt your website’s connections.
It’s crucial to monitor your website and server performance closely and take action if you suspect that you are under attack. Early detection and response are essential to mitigating the effect of a Slowloris attack.
How to protect yourself?
Implementing different techniques for protection and mitigation is crucial for keeping your website or service safe from these attacks. Here are some things you could do in order to avoid Slowloris attacks:
- Increase web server connection limits: By increasing the maximum number of open connections, you could reduce the vulnerability to Slowloris attacks. The attacker would have to increase the number of connections as well before they can overload the server.
- Implement rate limiting: You can restrict access based on particular usage factors in order to prevent a Slowloris attack. Some useful techniques are: limiting the number of connections one IP address is permitted to make, limiting the period a user is allowed to stay connected, and restricting slow transfer speeds.
- Use load balancers: Load balancing techniques can help buffer connections and implement multiple connection management techniques. That helps stop incomplete HTTP requests from impacting applications and web servers.
- Web application firewalls (WAFs): WAFs are helpful in defending against application attacks, like Slowloris. They recognize and block malicious traffic before it gets to your network.
- Implement DDoS protection: A DDoS protection service is highly recommended for providing an extra layer of security. It can help stop malicious traffic toward your website and guarantee that it will remain available to legitimate users.
- Monitor Network Traffic: Constant monitoring can be extremely beneficial for identifying different types of cyber-attacks early. That allows you to take action before the attack becomes too severe.
- Patch Systems: Keep your software and all systems up-to-date by regularly installing the latest security patches. That will help you stop attackers from exploiting known vulnerabilities.
- Upgrade Web Server Software: It is important to frequently upgrade the web server software. That way, it helps to address known security vulnerabilities that potential attackers can exploit.
The Slowloris attack is a dangerous Denial of Service (DoS) attack that sends many incomplete HTTP requests to a targeted server, leading to slowdowns, crashes, and data loss. This attack is difficult to detect and can persist for a prolonged period, making it highly effective and disruptive. That is why it is important to monitor your website’s performance and resource usage, be aware of the signs of an attack, and implement protective measures, such as firewalls and DDoS protection services. By doing so, you can keep your online presence secure and running smoothly.
Hello! My name is Vasilena Markova. I am a Marketing Specialist at ClouDNS. I have a Bachelor’s Degree in Business Economics and am studying for my Master’s Degree in Cybersecurity Management. As a digital marketing enthusiast, I enjoy writing and expressing my interests. I am passionate about sharing knowledge, tips, and tricks to help others build a secure online presence. My absolute favorite thing to do is to travel and explore different cultures!