Express explanation: Imagine sending 100 old grandmas to a convenience store, with all of them trying to tell a story from their childhood to the cashier so that no other customers can buy anything.

@MegaZsolti

7 жыл бұрын

Yeah, while forgetting their stories halfway through and starting all over.

@ArunBasilLal

7 жыл бұрын

You should be on ELI5 subreddit.

@Kodufan

5 жыл бұрын

shouldn't you be busy saving the world, Niko?

@godfreypoon5148

5 жыл бұрын

That variation of the attack is described in more detail in this video watch?v=tc_KJEwzq74

@danielsharp2402

5 жыл бұрын

That's a clever IRL DoS.

The first rule of coding: All user input is evil.

@TechyBen

7 жыл бұрын

Second rule of coding: Checking rule 1 is NP-hard!

@TheTrueSmitch

7 жыл бұрын

Wouter Damen Ikr! All the parsing and data validation!

@greenanubis

7 жыл бұрын

Like life: cant trust anyone. But obviously thats not the optimal strategy.

@simonfrohlich7766

7 жыл бұрын

So true!

@ibrax1

7 жыл бұрын

+TechyBen Why is it NP-hard?

This is now my favorite Denial of Service attack as well

@TheAnimystro

7 жыл бұрын

indeed

@chainingsolid

7 жыл бұрын

same I was laughing alot at how simple but effective this is.

@CGoody564

7 жыл бұрын

Chaining Solid not really effective anymore except for unpatched web servers. but yeah, genius in it's conception by using the artificial limits used to stop DDoS against the server to DDoS it anyway. lol

@RealNovgorod

7 жыл бұрын

Yeah, except it's useless because every sensible webserver has a connection limit per client or IP (something on the order of 2-10, beyond that you're blocked). It's true that it saves traffic, but there's no way around owning a botnet...

@murphy54000

7 жыл бұрын

could just go through a few proxies/VPNs if you really needed to do it solo.

This is so beautifully evil it made me cry.

@power-max

7 жыл бұрын

Dr EVIL would be proud!

@dvdr14eb

7 жыл бұрын

Mojo Jojo would be proud

@RonJohn63

7 жыл бұрын

Cry? Like a girly man? This is so beautifully evil is makes me rage at myself for not thinking of it first!!

@sUmEgIaMbRuS

7 жыл бұрын

And your comment made me WannaCry

@cameronbarrett9808

7 жыл бұрын

Ambrus Sümegi a

I understand why this is his favorite. And I like the gleam in his eyes for this one..

To add to that: Other webservers like nginx are not vulnerable to slowloris because they don't reserve a thread per connection. Instead, they have a worker thread pool. Each thread in that pool has a task queue. These threads run all tasks in their queues until the queues are empty. So, as soon as you insert a task in their queue, it eventually gets run. Every time a bit of data comes in from a client, a new task is created - "process this data". This task is then assigned to one of the worker threads whose task queue isn't full. The assigned thread then eventually runs the task. That way, even incredibly slowly arriving partial HTTP requests won't block anything, because the threads aren't exclusively reserved for handling one particular connection. The whole HTTP request handling is broken up into these small individual tasks instead.

@Dearth123

4 жыл бұрын

I really needed this! Thank you for your clear writing.

All Mikes videos seem to be so simple to follow and his presentation makes you want to follow.... Where were you when I was at school?

@astropgn

7 жыл бұрын

Yeah, he should have a dedicated channel

@bl33kselderij

7 жыл бұрын

It's also great how he has to add the obligatory 'don't really do this', but you can see in his eyes that he thinks this stuff is awesome ;-)

@dariusduesentrieb

7 жыл бұрын

would be cool, but i think its more complicate that it seems to be here

@DamagedSave

7 жыл бұрын

I am at the Uni he teaches at, very nice guy in general. Can occasionally hear him talking in an office and wonder if a new Computerphile video is on the way :)

@astropgn

7 жыл бұрын

DamagedSave Go talk to him! Say we would like to see his channel :P

It seems weird that he's using the Ubuntu machine for browsing and the Windows machine for serving.

@tommessig2060

7 жыл бұрын

yeah, i was thinking the same thing. moreso that it's apache on windows.

@NickleJ

7 жыл бұрын

That's what I was thinking. Though if you're deploying apache with the specific intention of breaking it, maybe windows is the better platform.

@matek9975

6 жыл бұрын

it doesn't matter and it's faster to install server on windows than on linux

@nimisidiv9244

6 жыл бұрын

He'll be using the university network which will most likely be windows enviroments.

@johnfrancisdoe1563

5 жыл бұрын

Nimisidiv Except the other machine is Linux. Anyway, installing Apatchy httpd on Linux is very fast it's an OS feature. But installing Monty Python etc. on Windows is harder than installing Apache, so if he only had those two machines it's just easier to do the python script on the Linux machine and use a badly configured toy web server on Windows as the target.

Dr. Mike Pound: writes 67 lines of codes and breakes a site Me: writes 5000 lines of codes and my program is still useless.

@arttu1229

4 жыл бұрын

Emanuele Giordano he didnt write it as he said

@baronvonbeandip

2 жыл бұрын

Well, maybe you should drop H and do something in JS or Python

@reda29100

2 жыл бұрын

It's called denial of execution attack injected by the creator of the language to prevent your code from doing what you want it to do. Just like this very comment is denial of skill attack by me to prevent you .. [Okay, this joke took a mean turn, I'll stop now.]

I love these kinds of videos. My favorite one is when tom scott talked about the NTP attack method.

OMG! a computerphile that actually shows some code! Is it christmas or something?

@simonfrohlich7766

7 жыл бұрын

Well, seriously, you could probably find the code fairly quickly or writ it yourself knowing the idea behind it, so...

@xanderlewis

7 жыл бұрын

I'm pleased too, but computer science/computing isn't ALL about code. :)

@shala_shashka

6 жыл бұрын

tru tru

@aakksshhaayy

6 жыл бұрын

but its in a noob language like python

@tapwater424

6 жыл бұрын

>noob language aakksshhaayy is living in 2080 with his "assembly code only" ideology

One of my favorite computerphile videos in recent memory! Will you cover how servers would defend against this technique?

@bidaubadeadieu

7 жыл бұрын

+ Yeah I'd love to know this too.

@NikkiDimesYT

7 жыл бұрын

Use Lighttpd or nginx ;P

@sooooooooooomebody

7 жыл бұрын

I wonder how many Apache threads some normal Linux box could handle.

@brodaclop

7 жыл бұрын

One obvious answer is: don't spawn a new thread for every connection. If you keep your processing as lightweight as possible, attacks like this have a much smaller effect.

@sallerc

7 жыл бұрын

You could also limit the number of open concurrent connections to the same IP.

People calling themselves hackers because they did a DDoS attack, is like people calling themselves lock pickers for blowing up the safe.

@egonzalez4294

7 жыл бұрын

Simple rule. If you can make money out of it then you are a real hacker. Otherwise you are just an aficionado.

@koohikoo

7 жыл бұрын

nah, script kiddie

@cookiesnmilkfilms9056

7 жыл бұрын

Makes so much sense now

@martinkunev9911

6 жыл бұрын

What is the relevance of this comment to the video?

@sixstringedthing

6 жыл бұрын

Eh, but then you've destroyed the contents of the safe, which isn't what a DDoS does. It would be more like throwing the safe off a bridge into very deep water. Or launching it into space on an extrasolar trajectory. And then proclaiming yourself to be the greatest safecracker of all time. :)

thanks gonna use this on the scientology website now

@aybmnn

7 жыл бұрын

lol

@ricodelta1

7 жыл бұрын

and if you did that on an islamic website, youd be called a racist

@Brutaltronics

7 жыл бұрын

they are gonna sue!

@DanDart

7 жыл бұрын

My idea too

@Brutaltronics

7 жыл бұрын

they might be using apache, how can you tell before hand

My God, this guy is so freaking amazing.

@aries_9130

7 жыл бұрын

I don't really care for an accurate description as long as the concept behind it is described, which he did. If one were to want a more accurate description, I'm sure one could find one for themselves. I don't think that this video is meant as a walk-through to an exploit.

I want Mike to explain RUDY as well! The most common DDoS attack methods would be awesome to hear more about. He explains it very nicely!

6:34 CTRL+SHIFT+R will refesh whilst ignoring the cache.

I love how the amplifier was set to 11 :-)

@DaveWhoa

5 жыл бұрын

Nigel respect

@anonymousyoutubeguy7940

4 жыл бұрын

Amplified?

I love the videos with Dr Pound, he's always so enthusiastic and speaks clearly.

I could listen to Dr Pound explain things for hours. Such an interesting video! Thanks for the upload Computerphile :)

Wow that's such a clever attack.

@duminicad

7 жыл бұрын

it is, but just glance at apache's documentation and you'll find timeouts for keep alives and "read timeout"

it would make things so much easier if viruses actually had the .virus extension like at 0:45

@godfreypoon5148

5 жыл бұрын

Hey, would you like to download my file? It is called secretbitcoinaddress.notavirus

@genericdeveloper3966

5 жыл бұрын

W3C is working on the standard

@scodiofficer0012

4 жыл бұрын

Instead of ".exe"

@anandsuralkar2947

4 жыл бұрын

@@godfreypoon5148 lol

@baronvonbeandip

2 жыл бұрын

Virus software be like "del /S C:\*.virus"

Always love to see the enthusiasm Dr. Pound puts in his explanations.

ive been watching/listening your vids for 2 consecutive days while im at my work. it's so informative and how you deliver your explanations is so incomparable. i love it

Dr Pounds videos are the best by far.

Kind of a passive aggressive DOS. Totally agree … beautifully elegant and diabolical :D

Every video i see from Computerphile(Mike) i am totally in love how excited he explains everything he always infect me to try it out on my next customer...

i hope you guys don't stop uploading like these informative videos. they are pretty informative and well organized. keep going with these videos

Now it's my new favourite too..thanks for giving me ideas computerphile

People! The first D in DDoS has a meaning, and it is DISTRIBUTED. If only one computer attacks, it's just a regular DoS.

One of my favorite computerphile videos!

Love these server and networking videos, keep 'em coming

It's rare that I get excited like a little kid anymore but when I saw a new Dr Mike Pound video in my feed I almost started jumping up and down clapping my hands lol

"Mike's Website" "It's purple"

One of my favorite Computerphile videos!

I love how excited he is about this DoS and explaining it. The explanation really helped with my studies for CEH! THanks!

Very interesting. We so often get told about what something like this does, but this is the first time I have ever seen such a thing actually demonstrated. And, nice to see a Linux box on this channel. :)

Dude, I love these videos!

I love Mike Pound's videos, especially this one. Cheers. 🙂

@computerphile: I love how the servers are in the cloud. You guys do great work!

I was giggling the whole time thinking this is my favorite too. So how is the wild dealing with this? Are servers cutting off slow connections now but the cutoff point is like where the battles are fought?

Would you say the server technology is "a patchy" one?

Excellent video! One of my favorites so far.

Mike is great in front of a camera. Good at explaining and charismatic!

beautiful

I love Mike's videos explaining how to do these attacks! I would never do them (I don't want to go to jail :) ), but they are really interesting. Keep 'em coming!

@joukevandermeijden2433

7 жыл бұрын

Thomas Gourley

@joepelletier6694

7 жыл бұрын

do you honestly think that you could go to jail for this?

@svnhddbst8968

7 жыл бұрын

+joe 10001001 you absolutely would go to jail for a denial of service attack like this. if i'm not mistaken, it's a federal offense.

@joepelletier6694

7 жыл бұрын

it depends who you do it to and how effective it is tho right?

@joepelletier6694

7 жыл бұрын

large companies rely on a lack of public knowledge on tech and bribery to make things like dos illegal. if you think about it dos is a form of peaceful protest (when the participants are willing). using current event as an example, ddos attacks are analogous to a crowd of people standing in front of trump tower to prevent people getting in and by extension, trump making money. this dos attack is perfectly understood by this hypothetical scenario. you fine out that a restraint has been steeling credit card numbers, so you gather a group of 30 friends who each take a table, then when a waiter comes to get their order they ask for 5 more minutes. in my opinion, you and your friends are not committing a crime, any loss in profit that the restaurant is facing is their fault because they chose not to kick you out. and with the normal ddos attack you are simply peacefully protesting (if you are using a botnet and not and not a community who agrees and wants to help the cause) you are guilty of a different crime.

thanks so much, the info is gold and the way you present it is perfect

That was educational and so fun to watch at the same time :) thanks for making this video! Please continue to show more code/ link code in the description.

Someone has registered their copy of Sublime Text... not sure if it's a good or bad sign.

@Phenom98

5 жыл бұрын

I like the theme he's using so it's fine

@NeoKailthas

4 жыл бұрын

"Registered"

@maninthecrowd5076

4 жыл бұрын

Maybe he also has a registered winrar somewhere.

@hexagonist23

4 жыл бұрын

Lol, he pays for software that is basically free. Look up VScode.

@kirschitz64

3 жыл бұрын

@@hexagonist23 or VSCodium if you don’t want to get your linux install dirty with Microsoftware

"The same person looking at the website really slowly 200 times"

best explaination ............ I am blessed to watch a Channel like computerphile, david bombal etc

Yay Ubuntu, using it right now and have been for 3 years as my main OS. Used it before for like 2 or more years as a 2nd OS to play around with

@horseradish843

7 жыл бұрын

Nobody cares m8

@ELYESSS

7 жыл бұрын

good for you

@AnesuC

7 жыл бұрын

Speedyjens I was just sharing my experience with Ubuntu cos you rarely see people use it. If you don't care, you can skip along like everyone else does. I am sure you don't care about every KZread comment and you generally skip along. This one shows you somewhat care to make the effort to reply to....

@horseradish843

7 жыл бұрын

Anesu C You comment really had nothing to do with the video. *cough* alot of servers uses ubuntuu *cough*

@AnesuC

7 жыл бұрын

Speedyjens​​ They use Linux not specifically ubuntu, tha I have experienced first hand. Also it doesn't matter if it wasn't explicitly related to the topic, it's like watching a show and your favorite actor/singer/etc shows up. You will notice a lot of comments about that person rather than the topic of the show itself.... Just another note, this video pretty much covered the topic well, I had nothing else to add, hence I mentioned this instead.

I don’t know shit about programming but it’s always fun to see a nerd talk about their passion lmao

@Creepkido

5 жыл бұрын

your profile pic is intresting lol

You can just as well call it "the power of being lazy"

loved the video. also please tell Mike to retake neural nets series, I'm eager to see more

This guy is the best computerphile host!

These videos are fun but I would have liked to see a part about how not to get downed by such a attack especially since a large portion of viewers possible has a website or server somewhere since most of us are working with computers every now and again.

@dustinjames1268

7 жыл бұрын

I agree. Not much substance to this video without preventative measures.

@user255

7 жыл бұрын

Just drop the connection if it is unrealistically slow.

@DantalionNl

7 жыл бұрын

user255 Sure could you give a example of how to setup a iptable rule or apache configuration that would do this for me then?

@user255

7 жыл бұрын

Dantali0n I think I spoke too soon... it is not as easy as I thought. But check this: insights.sei.cmu.edu/cert/2009/07/mitigating-slowloris.html

This guy reminds me a lot of that guy that played Spiderman in the movies.

Such an elegant explanation

That is so clean and elegant.

Err, wait, we were using that in the 90s all the time, I always thought there had been countermeasures implemented even back then...

@garryiglesias4074

7 жыл бұрын

You don't need a thread per socket... A thread could handle "thousands" of slow socket... This is a design problem in a "optimisation" done on the Apache server. As he said, not all http server have this weakness.

@PlasmaHH

7 жыл бұрын

Hendrik-Jan Smit You might want to research the C10k problem. For one you can make connection handling much much more effective, also you can rather easily detect a client misbehaving this way and block it.

@depravedone

7 жыл бұрын

As Morgan says, "Everything gets a return"

Is it possible to combine this attack with IP Spoofing, so that the IP adr is never the same? It would look like 200 different slow people would look at this at a time.

@dneendcreeper3239

4 жыл бұрын

Even better than that, the packets are so small that you can easily route them through the Tor network, maybe even with a separate connection for each socket. (Depending on the per socket timeout)

Good job with the videos, they're really interesting. It would be nice if you also showed how one could defend the server from such attacks

Wow, this attac honestly is quite beautiful

So....What's the fix? how to prevent such an attack?

@moaqyigl

7 жыл бұрын

I would think having a hard timeout on connections (as in having any single connection not be longer than a few seconds) would work, although it might make accessing the site from a very slow connection impossible.

@TurkishLoserInc

7 жыл бұрын

Any server that doesn't have one thread dedicated for each socket will fair well against this attack. Nginx can handle 10k concurrent connections, probably more of these "pseudo"connections

@ELYESSS

7 жыл бұрын

I don't know but maybe limit the number of connections per user or don't use apache?

@stensoft

7 жыл бұрын

+Natanor That would not work. Apache already has hard timeout for requests but the script recreates each connection that was closed by the server. +ILYES You can limit the number of connections from an IP address but that may make your website unuseable from some large companies or organisations that have only a few external IP addresses.

@chainingsolid

7 жыл бұрын

I would try solving it by prioritizing the faster connections and having lower time outs.

It's the modern equivalent of standing behind 200 grandma's at the post office.

Dr. Pound is always so good.

The SYN flood is a more prevelant kind of DOS. Awesome video!

This is the funniest DDOS

@AxeLea3

7 жыл бұрын

Where you're right, you're right. Thanks for your clarification

@dzikiLOS

7 жыл бұрын

I'd like to give props to both of you guys - nidefawl for giving proper explanation and Axel for taking the lesson. If only internet was full of people like you! ;)

@AxeLea3

7 жыл бұрын

+dzikiLOS I guess the Internet will never be full of people like the ones in this comment section -_- But that's more in a conjunction to people in general. not the web

@breadleymcthicc5444

5 жыл бұрын

@nidefawl I'd thought it would be, given the amount of connections, and all of them distributing a connection. I don't know, though, because I have hardly any experience with any form of coding.

It goes up to 11

This is great for testing how much HTTP requests a server can handle aside from simulating a DOS attack it can really show you how much your server can handle.

Randomly ended up here and really enjoyed the demo.

I accidently did this to my own server

What's the solution?

@boothegoopc8417

7 жыл бұрын

Typewriters and postage stamps

@Hypernerdwithcam

6 жыл бұрын

boothegoo pc No, iptables

@critico4396

6 жыл бұрын

Design a thread to handle all the slow connections? ---> Two lorises having fun chatting with each other...

@porsche911CarreraRSR

6 жыл бұрын

That's not an automatic solution though right? You need an administrator to recognize the problem and block their IP right?

@critico4396

6 жыл бұрын

@Yanni mouzakis I have no idea. Even if it's possible to handle/consolidate slow connections automatically, it just make the attacker pay as much resource as the server in the end.

Dude you get so excited when explaining these things, I find that I end up smiling from start to finish, and in the end my smile slowly fades after a minute or so. lol

This is awesome, I love this attack. I tried it out on a google site I made and it made the site really slow, but I didn’t feel like waiting for the site to go down.

now I know how to break my website, but how can I defend it?

@recklessroges

7 жыл бұрын

#firewall might fix this for you ip6tables -I INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 10 -j DROP iptables -I INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 10 -j DROP

@wood_croft

7 жыл бұрын

Can you elaborate? I assume that drops the slow connections, right?

@unaliveeveryonenow

7 жыл бұрын

I assume it limits the number of connections per IP to 10 on port 443. This might ban an entire country.

@unaliveeveryonenow

7 жыл бұрын

***** Qatar has only one public IP. Everything I say is 100% serious.

@unaliveeveryonenow

7 жыл бұрын

***** I don't know either. A different situation: a bunch of governments are blocking a lot of sites. If one were to use Tor to bypass it he would have found that some CDNs are blocking Tor IPs. I guess these are rare cases and generally shouldn't be worried about.

This ................................................................................................................... ........................................................................................................................... ........................................................................................................................... works ................................................................................................................ ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... for ..................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... comments ....................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... ........................................................................................................................... too.

Awesome video, great explanation.

Such a lovely video.

While watching this video.... I casually used my toe to start up my ubuntu web server.... No reason....

Apache opening a new thread be like: *"Haii! I'm Mr. Meeseek, look at me!"*

@revenevan11

3 жыл бұрын

Lol too accurate

Does this guy have his own channel? His stuff is the best on the channel and explained so succinctly.

Dude, I love your videos. 👏

0.:55, look at that amp. 11 :P

Ubuntu, Sublime Text and Python. I like that!

@Yuzuki1337

5 жыл бұрын

Daniele Dal Col Aka the "I just enlisted in an IT course but Ill still call myself a real programmer already" starter package :) /s

That is so dastardly and elegant.

he is such an amazing Prof, great understanding, perfect knowledge.

Where can I download that brownish windows theme?

@MikeTheFailboat

7 жыл бұрын

It's actually a different operating system, a Linux distro called Ubuntu.

@CRT601

7 жыл бұрын

not windows

Am i the only one who only likes this guy? :o

@contingenceBoston

7 жыл бұрын

Nope. And I'll bet I'm not the only one who is happy to a Linux box from my own Linux box.

This video is brilliant.

Awesome! Really interesting concept!

6:03 Dude, that's a public IP.

@willway1234

7 жыл бұрын

It's probably local for the University, their local IP address usually look like public ones.

@ZacharyClaretScott

7 жыл бұрын

Probably public, Universities often give out public IP's to clients

@hexagonist23

4 жыл бұрын

@@willway1234 Yes, it is.

Talking about DDoS, well, a lot of disappointed Americans did it to Canada Immigration Department, should it count as DDoS?

@anonymousyoutubeguy7940

4 жыл бұрын

So are you like the maple version of a Trump supporter. "Damn Americans, comings here too lazy to make hockey sticks like the rest of us; coming here go'n take my job at the hockey stick factory."

I want more from this guy ! He is the best!

love the spinal tap reference on the amplifier

Nginx, need I say more?

@noredine

7 жыл бұрын

yes, say more please

7 жыл бұрын

I'll say that I used Apache 2.2 and then 2.4 for a few years and I'm so happy that I switched to Nginx.

@noredine

7 жыл бұрын

thanks for more :)

@pr0kris

7 жыл бұрын

Or Node.js

7 жыл бұрын

Ljón That's quite different though.

Why not just go: Oh we have a few hundred stupidly slow connections; they're probably not legitimate; lets, for now, decrease the time out, any lost legitimate slow connection are just an acceptable loss. Edit: Actually you'd probably have to create a new time out that drops the connection regardless of weather it's still sending data.

@trbry.

7 жыл бұрын

sounds like a solution a business owner would agree with.

@stensoft

7 жыл бұрын

That is already implemented in Apache, requests have hard limit after which they are dropped. However, the script simply reopens every connection that the server closed. A few legitimate requests may skip through but that would hardly make a shop useable. The correct solution is to use a web server that does not spawn a new thread for each connection (usually as a reverse proxy that will collect and resend requests if you still need Apache for your website). Then they can easily handle tens of thousands of such connections.

@TeeDawl

7 жыл бұрын

That has the problem that the attacker still just opens up new requests. Even if you drop all of the connections quicker, the attacker will also open requests quicker. So the attacker still eats up your threads.

@ericsbuds

7 жыл бұрын

I wonder if there is a way that Apache servers can implement a non thread based connection scheme or something. There must be a common fix or prevention method if half of all webservers are running the most vulnerable system!

@TeeDawl

7 жыл бұрын

ericsbuds "non thread based" do you even know what threads are?

I subscribed to this channel just because of how this person speaks, it's like a therapy :D

THis is one of my favorite videos