IT specialists have discovered a new type of DoS attack.

Experts recently discovered a new type of DoS attack. It deviates from the classic definition of this type of attack and affects higher layers of the network protocol stack. At the BlackHat conference in the US, experts from Trustwave-SpuderLabs proposed possible defenses against this new generation of DoS attacks.

Tom Brennan, director of Trustwave-SpuderLabs, explained that a layer-4 DoS attack affects simultaneous connections across multiple network layers, causing network channel blocking. He proposed exploiting all seven layers of the TCP/IP network protocol and inducing DoS at the end-application level.

A level seven DoS attack occurs when a client logs into a web server and sends a connection request via requests such as HTTP Post, which are responsible for submitting web form data. The web server begins waiting to receive form data, which in reality is transmitted very slowly, but the server keeps the receiving channel open. This type of DoS attack could block access for legitimate users.

Trustwave-SpuderLabs has developed the HTTPS POST Tool, a software tool that helps network administrators determine whether and to what extent their machines are vulnerable to new types of DoS attacks.

Administrators already have modules available to combat new types of attacks. For example, Apache 2.2 includes the mod_reqtimeout module and the RequestReadTimeout option, which applies to the entire server rather than to specific sites.

Trustwave-SpuderLabs believes that measuring application performance and monitoring traffic flow can partially solve the problem. However, the most effective protection method involves blocking spam requests not by the web server, but by gateways that analyze the traffic.