Printable View
Hi guys,
A little heads up if you havent seen this. Apparently there is a proof of concept for a new type of DOS attack. From what I understand it works by opening a TCP connection then sending no free buffer packet to the server. This blocks the server connection open as it will then send ACK packets waitiing for the buffer to clear. Here is a link to the story :
http://mybroadband.co.za/news/quick-...to-detect.html
Any one have a take on this?
cheers
Muracu
As this saysAnyhow, surely your HIPS system would pick this up.Quote:
Shekyan said in his post about the tool that this type of attack could be prevented by setting up rules in the Web server's configuration that refuse connections from clients with abnormally small data window settings, and limit the lifetime of an individual request.
I'm pretty sure you could test this out using Hping or IPSorcery; Two tools I've been using and swear by, for a long time now.
I don't know if there are versions for Windows so I can't give any info about that. Basically they are packet creation tools to make your own packets.
Here is Sergey Shekyan blog with the POC.
https://community.qualys.com/blogs/s...1/05/slow-read
Effectively once the attack is known it seems easy enought block. I doubt if your HIS would pick it up by default as it uses very low traffic to perform the DOS and it is a new attack type. Still it will be interesting to see it this evolves and starts poping up in the wild.
edit :
Link to the TCP vulnerabilty exploited :
http://www.kb.cert.org/vuls/id/723308