4

I have apache behind nginx on my webserver.

Today my apache stops answering to requests. Investigations shows this situation:

  1. Number of apache processes grows more that 500 but MaxChildren=256 in config (I have mpm_itk, also tried mod_prefork).

  2. server-status shows that 256 of processes were busy and near all of them served request like GET /A0A32579-2767-F346-A463-9EC16718D7E7/9FDAE968-8090-9C4F-8122-DCBEA5A9A8EC/from.

    First part before "/" was always same and second differs.

  3. According apache logs it answers 404 to such requests.

  4. After blocking such request on nginx everything goes normal. But I'm interested what was it?

I have

Ubuntu 12.04.5  
apache-2.2.22-1ubuntu1.7  
php-5.3.10-1ubuntu3.1
Improve this question
1
  • I suggest you capture the full content of the request - specifically, the HTTP headers. It's unlikely that the URI itself was what was impacting Apache. But if you're vulnerable to Shellshock, for example, those requests could've had a whole lotta shaking going on your server.
    – gowenfawr
    Commented Nov 2, 2014 at 16:35

2 Answers 2

Reset to default
4

From my experience, it looks like you were DoSed with a SlowLoris attack. It would appear that the attacker tried to retrieve a random non-existent page and then used SlowLoris which caused the DoS effect.

Essentially the attacker generated two 16-byte GUID's/UUID's, appended them together with /, and then loaded the index file of /GUID_1/GUID_2. When the server began to reply, the attacker's application then read back the bytes very slowly and thus caused the connection to stay open. Meanwhile, several other threads likely opened other concurrent connections and performed the same process. Thus each of the attacker's threads occupied 1 connection on the server and the server could not reply to any other connections because it was still attempting to serve the attacker's connections with the 404 error.

Because this is considered a layer 7 attack ("Application Layer"; see the image below), a smart attacker could use proxies to prevent tracking and IP blocking. enter image description here

The best mitigation would be both blocking the attacker's IP Address(es) (or the IP Address(es) of the proxies the attacker used) and installing some server mods which can detect and prevent these attacks. In this article, I read that installing libapache2-mod-qos to the server will prevent SlowLoris on susceptible Apache machines.

It is worth noting that Microsoft's ISS servers are not vulnerable to a SlowLoris incomplete HTTP GET Attack; however, the ISS servers are vulnerable to "R-U-DEAD-YET" incomplete HTTP POST Attacks.

Improve this answer
3
  • 1
    The Incomplete HTTP POST Attacks are referred to the "R-U-DEAD-YET" attack, but has the same idea of Slow Loris.
    – user3818650
    Commented Apr 17, 2015 at 12:33
  • @user3818650, thank you for that information. I was unaware that was the name given to Slowloris-like HTTP POST Attacks.
    – Spencer D
    Commented Apr 17, 2015 at 18:59
  • Read this. It gives summaries on layer 4 DoS attacks and layer 7 DoS attacks :).
    – user3818650
    Commented Apr 18, 2015 at 1:54
0

This is the slow loris attack of incomplete HTTP GET Requests.

How to protect your server: Update your Apache Server, there are many updates for this attack, this attack was discovered in like 2011. Other options are to reduce timeout on your Apache Server, etc. This attack works on timeout. Here tells you how to protect your Apache from DoS/DDoS (slow loris included) on Linux (provides updates, shows settings to be changed).

What is the slow loris? The slow loris is a layer 7 Denial of Server (DoS, can be carried out with 1 computer) that is used widely on Apache servers and more, because these servers if not updated have this "bug".

How does the slow loris work? The slow loris is done by a TCP connection being made, and then an incomplete HTTP GET request is sent to the server. The server then does not timeout this connection for long periods of time as high as 400 seconds. The server (such as Apache server's) do this because the idea is, it thinks you are on some untrusted network, or simply slow internet and will wait for the rest of the HTTP GET Request.

More Information: This is an HTTP DoS not a TCP DoS because the request is what is causing this. A slow loris attack can work at sending 1 packet per second for each new connection.

Examples of how this request looks like:

GET / HTTP/1.1\r\nHost: www.whatever.com\r\nUser-Agent: Mozilla 5.0\r\n

or

GET / HTTP/1.1\r\nHost: www.whatever.com\r\nUser-Agent: Mozilla 5.0

Example of normal HTTP GET Request:

GET / HTTP/1.1\r\nHost: www.whatever.com\r\nUser-Agent: Mozilla 5.0\r\n\r\n
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .