9

Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer.

This script launches about 50 threads to request Partial Content from the server with optional GZIP encoding. This either will consume too much memory that the OS has to kill all other processes, or too much CPU that the server is brough to its knee.

Apache Foundation has not yet released a patch.

What is the best way to combat this?

1

4 Answers 4

7

Five workarounds are discussed on the Apache mailing list. Go have a read for detail on each one:

1) Use SetEnvIf or mod_rewrite to detect a large number of ranges and then either ignore the Range: header or reject the request.

2) Limit the size of the request field to a few hundred bytes.

3) Use mod_headers to completely dis-allow the use of Range headers:

4) Deploy a Range header count module as a temporary stopgap measure:

5) Apply any of the current patches under discussion

3
7

By reading the script provided by Mark Davidson, the obvious temporary solution would be to disable apache's partial functionality if not needed.

This problem seem to be an old one, which have been "solved" by disabling the partial content requests. Here are two patches for previous versions of apache.

Apache 1.3.36

Apache 2.0.58

I downloaded the current apache source for debian squeezy to check for traces of this patch. Unfortunately, it seems like this is not implemented.

I'm not familiar with the source code for apache2, so I will not try to write a patch for it. This can be an exercise for the reader :)

4

http://www.guerilla-ciso.com/archives/2049 has an excellent analysis on DoS through resource thread exhaustion, as well as some thoughts on countermeasures including:

  • Know how to detect it.
  • Disable POST as a method if you don’t need it.
  • Set a low connection timeout

Have a read - good article.

2
  • Slow DoS is NOT the case of Apache Killer. Slow DoS affects Apache alone while the script mentioned could potentially kill all processes in the system. Besides, who does not need POST?
    – Nam Nguyen
    Aug 24, 2011 at 0:24
  • Hi @Nam - I know it isn't the same thing but a number of symptoms and countermeasures are still useful which is why I thought I'd post it. The 3 examples I gave are from the article's longer list, and yes, there are a lot of websites which do not use GET or POST:-)
    – Rory Alsop
    Aug 24, 2011 at 7:36
1

A bit late to the game here, but a WAF (web application firewall) would most likely also be a useful mitigation.
Even if it is not aware of this attack out of the box, any modern WAF should easily support blocking those types of requests even before they hit the webserver.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .