"Slow Read" Denial of Service Attacks

[dhatz]

This attack centers on a method of slowing down the rate at which the client (attacker) is able to consume the response data sent back by the web server - hence the name "Slow Read" DoS.

https://community.qualys.com/blogs/securitylabs/2011/11/02/how-to-protect-against-slow-http-attacks

The popular Apache mod_security recently introduced mitigation tools:

For those of you familiar with the old LaBrea Tarpit app for slowing down network based worms, this is somewhat of a reverse approach.  Instead of the defender (LaBrea) sending back a TCP Window size of 0 to the attacker (worm) which would force the TCP client to wait for a period of time before resubmitting, in this scenario the attacker is the one forcing the web server to wait.  After sending in the request, the client responds with TCP window sizes that are much smaller than normal.  This forces the web server to queue the response a break it up into smaller chunks that the client will accept.

http://blog.spiderlabs.com/2012/01/modsecurity-advanced-topic-of-the-week-mitigation-of-slow-read-denial-of-service-attack.html