Slow Loris Attack - Computerphile

Denial of service usually relies on a flood of data. Slow Loris takes a more elegant approach, and almost bores a server to death. Dr Mike Pound explains.

Babbage's Analytical Engine: COMING SOON

This video was filmed and edited by Sean Riley.

[mebezaccraft]

Express explanation: Imagine sending 100 old grandmas to a convenience store, with all of them trying to tell a story from their childhood to the cashier so that no other customers can buy anything.

[WAMProducties]

The first rule of coding: All user input is evil.

[Energya]

This is now my favorite Denial of Service attack as well

[hrnekbezucha]

This is so beautifully evil it made me cry.

[paul]

All Mikes videos seem to be so simple to follow and his presentation makes you want to follow.... Where were you when I was at school?

[rikwisselink-bijker]

I understand why this is his favorite.

And I like the gleam in his eyes for this one..

[dvdv]

To add to that: Other webservers like nginx are not vulnerable to slowloris because they don't reserve a thread per connection. Instead, they have a worker thread pool. Each thread in that pool has a task queue. These threads run all tasks in their queues until the queues are empty. So, as soon as you insert a task in their queue, it eventually gets run. Every time a bit of data comes in from a client, a new task is created - "process this data". This task is then assigned to one of the worker threads whose task queue isn't full. The assigned thread then eventually runs the task. That way, even incredibly slowly arriving partial HTTP requests won't block anything, because the threads aren't exclusively reserved for handling one particular connection. The whole HTTP request handling is broken up into these small individual tasks instead.

[mikopiko]

I love these kinds of videos. My favorite one is when tom scott talked about the NTP attack method.

[Gooberslot]

It seems weird that he's using the Ubuntu machine for browsing and the Windows machine for serving.

[Dusk-MTG]

Dr. Mike Pound: writes 67 lines of codes and breakes a site
Me: writes 5000 lines of codes and my program is still useless.

[NeatNit]

One of my favorite computerphile videos in recent memory!
Will you cover how servers would defend against this technique?

[osenseijedi]

OMG! a computerphile that actually shows some code! Is it christmas or something?

[WWxeroWW.WERWKWWF__WPWWW.-_WWW]

thanks gonna use this on the scientology website now

[May-whrt]

I love the videos with Dr Pound, he's always so enthusiastic and speaks clearly.

[jelleverest]

People calling themselves hackers because they did a DDoS attack, is like people calling themselves lock pickers for blowing up the safe.

[aries_]

My God, this guy is so freaking amazing.

[Aragorn]

I love how the amplifier was set to 11 :-)

[mortenmoulder]

I want Mike to explain RUDY as well! The most common DDoS attack methods would be awesome to hear more about. He explains it very nicely!

[lewisb]

I could listen to Dr Pound explain things for hours. Such an interesting video! Thanks for the upload Computerphile :)

[diotough]

Kind of a passive aggressive DOS. Totally agree … beautifully elegant and diabolical :D