4 ms·
After RSnake introduced slowloris in 2009, it’s been something of a minor miracle that L7 attacks have stayed as rare as they have until now. Don’t understand w
by agnokapathetic 9y ago
After RSnake introduced slowloris in 2009, it’s been something of a minor miracle that L7 attacks have stayed as rare as they have until now. Don’t understand why SYN Floods have been the preferred way to DDoS until recently-they’ve been obsolete for nearly a decade..
- simcop2387 9y agoSynfloods are really easy to accomplish comparatively. That said with the size and sophistication of the botnets these days I suspect that'll start to change to higher level attacks against services.
- Godel_unicode 9y ago>they’ve been obsolete for nearly a decade.. It's almost like the entire Internet doesn't immediately handle every vulnerability as soon as it comes out...
- tinus_hn 9y agoYou’d be surprised to learn that most of the targets are using the same small group of cdns, mostly Cloudflare and a few more. Handling these attacks is difficult and a cdn is cheap.
- dgemm 9y agoThey still work.
- ec109685 9y agoSlowiris doesn’t affect an async server like nginx, which Cloudflare deploys.
- jazoom 9y agoMust be hard to adjust to different light with a slowiris.
- dullgiulio 9y agoYou need to configure it properly, though, otherwise you can still easily hit the open file descriptors limits in the OS.
- bostik 9y agoDumb packet flood is easy. L7 DoS requires more sophistication, because the attack code needs to stateful (iow. establish sessions) and craft requests that are better targeted. These in turn require either real effort or tools that reduce the effort. All of this implies one thing: packet flood mitigation has finally become so ubiquitious that dumb flooding is no longer lucrative. So one could say that due to lack of low-hanging fruit the attackers are now moving up in the value chain.
- PhasmaFelis 9y agoIf it's the most effective tool for the job, it's not obsolete.