Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×

Submission + - Apache webserver vulnerable to "slow get", too 5

mcrbids writes: About a month ago, a story broke that http (apache, IIS and everything else out there) was susceptible to a "slow post", where a malicious client starts a connection to a web server, sends headers indicating a very large upload via POST, and then sends that upload very slowly, starving resources and eventually causing a DDOS.

Well today, doing some research to see how effective this attack was (hint: VERY EFFECTIVE) I tried the same thing using http GET as well, and saw very similar results. With a simple, 20-line PHP script run from my laptop, I was able to take a fairly beefy internal webserver (8 core, 12 GB RAM, CentOS 5) offline in just under a minute, and keep it that way for as long as I wanted to. The technique was simple: send "GET /" and then append letters, 1 or 2 every second or so. After several hundred simultaneous connections were achieved, the web server was no longer responsive. I don't have an IIS server to test against, and don't feel like using any "unwitting volunteers".

It doesn't take a large botnet to take most hosts offline. It takes only a single, relatively low-powered laptop and a 20-line script hacked up in PHP 5.Given that the "slow post" attack is already well known, it's only a matter of time before a black hat discovers that even disabling form post won't protect anybody, either!

Submission + - P2P LItigation Crippled in US Court Ruling

An anonymous reader writes: In a stunning defeat for the US Copyright Group, DC District Court Judge Rosemary Collyer is forcing copyright holders to sue only those who the DC court has personal jurisdiction over. The USCG has sued over 4,500 people on behalf of a German producer that created the Far Cry movie in the DC court. But the Judge is having none of that; in her ruling today, Judge Collyer stated that only those who are in the DC court's jurisdiction can be sued — shrinking what could have been a windfall of defendant's cash into perhaps a mere trickle.
Google

Submission + - CBS blocking Linux Chrome (google.com)

Tsarnon writes: It looks like CBS doesn't want Linux Chrome users to watch videos on their site. Recently if you try and watch a TV show on CBS.com some people get the message, "The video you have requested is not available on this device." People in the forums are speculating that it might have to do Google TV.

Comment Re:Wikileaks puts lives at risk (Score 2, Interesting) 725

They released documents that put Afghan civilians and US troops at risk.

War puts lives at risk. If anything negative actually happened as a result of the release, well, [citation needed]. And if it's not a primary source, [citation needed] all the way down until it goes no farther, and then we can evaluate the legitimacy of the information.

This isn't protecting democracy, it's treason.

Do you even understand the definition of treason in the United States Constitution? Or the dictionary definition, for that matter?

Wikileaks is giving aid to the enemy.

Again, [citation needed].

The founder should be in prison, and slashdot is whining about the donation page getting shut down?

Put up hard information, or shut your authoritarian piehole.

Comment Re:Maybe it wasn't timing, but milieu (Score 1) 235

On which platform do newer developers have a much easier time gaining entry into the market? For now, at least, one has a significantly better shot at making a name for oneself out of nothing by creating games for the general-purpose computers, rather than for consoles which require paid-for SDKs and physical media. That said, digital distribution and creative pricing may ruin even this.

And yet, I'm still going spend my time and money on products to be used outside those saccharine ghettos of gaming which the newer consoles have created, and I'm hoping that there will be enough devs who avoid it as as their exclusive (primary) platform too.

Comment There's virus source out there. Be careful. (Score 1) 366

Obviously, you should know exactly what it is that the virus is doing. No, not approximately: I mean all the way down to the machine instruction level. If it comes only in a binary, disassemble and figure out everything. Use virtual machines to add a layer of protection, and be aware that some malware knows it's being run in a VM and may behave differently under these conditions. Of course, those are much more than you need.

The safest bet is to write your own. That way, you know what it's doing.

Slashdot Top Deals

The sooner all the animals are extinct, the sooner we'll find their money. - Ed Bluestone

Working...