Sign up ×
Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources. As a counter measure to Rsnake (Robert Hansen) script, this vulnerability mainly in Apache web servers, is addressed by limiting the number of concurrent connection from a single source done in the Apache configuration file.

just imagine these two combined:
1- PyLoris can utilize SOCKS proxies and SSL connections, and can target protocols such as HTTP, FTP, SMTP, IMAP, and Telnet; when correctly configured, it use low bandwidth, making it possible for a single machine to bring a server down
2- Tor protects you by bouncing your communications around a distributed network of relays run by volunteers all around the world: it prevents somebody watching your Internet connection from learning what sites you visit, and it prevents the sites you visit from learning your physical location. Tor works with many of your existing applications, including web browsers, instant messaging clients, remote login, and other applications based on the TCP protocol.

Is there any way to detect such a denial of service
any suggestion or discustion is highly encourged

share|improve this question

4 Answers 4

up vote 11 down vote accepted

sarepta: To start off, I am the author of PyLoris, so I have done a good amount of research into this. In fact, the attack you have envisioned is one that I specifically coded to when developing PyLoris--the current version even comes bundled with an helper app which routes the attack through multiple Tor exit nodes.

The only good way of detecting a Tor-based flood is by checking source IP addresses against known Tor exit nodes. This is trivial with blacklisting or plugins like mod_security. In my research, mod_antilors does not prevent the PyLoris+Tor vector as it is IP address based. My personal choice for preventing this attack is to use any server other than Apache to handle direct connections from the internet. This could mean using a reverse proxy like Varnish to marshal requests or switching to something like nginx for your web server.

Aside from rethinking your infrastructure, I do feel that a combination of low timeouts, IP connection limits, minimum data transfer rates, maximum connection time limits, and maximum request sizes can provide adequate protection from this form of attack. I say this all with the disclaimer that there is no way to prevent this form of attack, and that these configurations should be thought through thoroughly to gauge their impact on a per-server basis.

To counter Tom Leek's assertion that Tor is not an efficient way of performing Denial of Service attacks, PyLoris and SlowLoris are application layer attacks, and are not based overwhelming bandwidth. In fact, connection exhausting methods like the one these use are one of the few techniques that work in throttled environments (see Slow/PyLoris' use in Iran's Green Revolution). At the peak of a *loris attack a server would likely experience less than 1kbps of traffic.

To counter D.W.'s reasoning, one of the big selling features of Atlas Networks' Pravail APS was the ability to prevent PyLoris and SlowLoris (explicitly stated in their earlier brochures). This attack method is less prevalent than standard HTTP floods like LOIC, but only because it is a significantly more difficult technique to use correctly.

share|improve this answer
Excellent answer from the most reliable source. Reverse proxy is always a reliable DDoS prevention method but in this case would you suggest using IP blockage (as it will be cheaper and because Tor IP ranges are well known)? – Igal Zeifman Sep 5 '12 at 8:20
@IgalZeifman: I strongly oppose blocking all Tor nodes outright--Tor is an excellent tool to subvert oppressive regimes and if every site went around blacklisting it, the efficacy of Tor for that purpose would be hindered. – Motoma Sep 5 '12 at 11:11
@IgalZeifman: In my testing, the benefits gained by adding nginx as a proxy on the same machine make up for the additional memory usage by offloading network connection handling to a server that is really good at handling it. That is to say, I've found installing nginx and Apache on the same server uses less resources, not more. – Motoma Sep 5 '12 at 11:14

I spent a lot of time last week analyzing a big attack which was lunched against my servers. The attack first was lunched from a botnet network which was very easy to block. In fact my firewall blocked it automatically.

The second attack was made of http requests which were sent through TOR. At the beginning I downloaded the TOR list of ip addresses (from here and blocked them all then I analyzed the packets and found out that they share many flag similarities and I was able to block the packets based on flag.

I hope this helps.

share|improve this answer
totally reasonable, thanks alot – sarepta Sep 4 '12 at 22:16

Tor is not an efficient way to perform Distributed Denial of Service attacks. Tor propagates requests through a number of relays, but there is no amplification. Anything which comes out of the Tor network has had to come in at some point. A lone attacker with his PC, trying to submerge your server with zillions of requests, will have to first get his requests out of his own PC, through his ISP. He will fail first.

Tor is good at hiding the source but is not a botnet. To do a DoS by overflowing a server with a lot of requests, the attacker must be able to send a lot of requests, which entails using either a server bigger than yours (especially its network bandwidth), or using lots of machines which all talk to your server through their network connections (hence the first D in DDoS).

share|improve this answer
I think the point is that you don't need a lot of requests. You just need to consume all of the worker threads/sockets. – rox0r Sep 3 '12 at 22:17

Just use standard defenses against the Slowlaris attack.

Tor is not likely to be an effective attack tool. It is highly rate-limited and the attacker won't be able to send many attack packets through it. I wouldn't worry about it too much.

It is important to keep in mind that this attack is inherently detectable. That means that, if it does happen to you, it'll be easy for you to detect. It also means that if it were happening to others frequently, we'd hear about it. The fact that this kind of attack is not widely reported by others indicates that this is probably not a high-priority attack you need to worry very much about.

If someone wants to mount a DOS attack against your website, it is more likely that they are going to use low-tech methods, like trying to flood your network connection with tons of packets. So focus on defending against the most-likely risks. For example, arrange for a CDN or hosting site that can withstand such a DOS attack. (That will also help against Slowloris, as a side benefit.) For small sites, you could look at CloudFlare or competitors.

See also How to best defend against a “slowloris” DOS attack against an Apache web server? and Slowloris DOS Mitigation Guide and mod_antiloris.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.