What Is a Slowloris DDoS Attack?

A Slowloris DDoS attack is considered a distributed denial of service, and it can remain undetected by traditional intrusion detection systems by sending legitimate HTTP request packets at low request-per-second rates, rather than large volumes or high rates of HTTP requests per second. Additionally, since the log file cannot be written until a request is completed, Slowloris can immobilize a server for periods of time without a single entry appearing in the log file to raise a red flag for anyone monitoring it.

Traditional application DDoS attacks are designed to take down a server by flooding it with an overwhelming number of HTTP requests, which requires substantial resources from the attacker. In contrast, a Slowloris attack may require only a few hundred requests at long, low, and regular intervals, rather than tens of thousands of HTTP requests on an ongoing basis. Bandwidth is not a key measurement for detecting this type of DDoS. Instead, security teams should assess the standard number of connection attempts, open connections, connection pools, incoming HTTP requests, partial HTTP requests, maximum number of allowed connections per source IP address, load balancers maintaining session tables, web server logging infrastructure, and other network or system paths throughout the DMZ.

Slowloris attacks can be mitigated by:

• Limiting the number of connections a single IP address may request to open.

• Increasing the minimum transfer speed allowed for any connection.

• Limiting the time a client is allowed to stay connected.

• Increasing the maximum number of clients the server will allow.

• Deploying robust cloud mitigation services, configuring robust load balancers, using web application firewalls (WAFs) or other virtual patching techniques, and rate-limiting the number of requests per source.

A Slowloris attack is executed in four steps:

• The attacker issues command and control instructions to their botnet or reverse proxies, which sends multiple HTTP requests, randomized headers, and other bypassing techniques, while opening multiple connections to a targeted server from their global networks.

• The targeted server opens a TCP connection for each request, planning to close the thread as soon as the HTTP request is completed. The server will time out any connection that is excessively long, to free up the thread for subsequent requests.

• To prevent threads from timing out, the attacker will intermittently send partial request headers or additional HTTP requests to keep the targeted web server alive, effectively convincing the server to wait for the HTTP request to be completed.

• While waiting for more HTTP requests and TCP connections to be initiated, the target server eventually runs out of available connections and is no longer able to respond to requests from legitimate traffic, leading to denial of service..

Cybercriminals may launch an attack to bring down the website of a rival or enemy; as part of a political hacktivism campaign; or to draw attention away from other, more dangerous security breaches in progress, called smokescreen attacks. This attack is also commonly used because it is difficult to identify a signature and rate of abuse. Implementing mitigation for these types of attacks can lead to high false positive rates and impact the experience of the user accessing different modules of the web server or web application.