Qualys Security Labs researcher Sergey Shekyan has created a
proof-of-concept tool that could be used to essentially shut
down websites from a single computer with little fear of
detection. The attack exploits the nature of the Internet's
Transmission Control Protocol (TCP), forcing the target server
to keep a network connection open by performing a "slow read" of
the server's responses. The Slow Read attack, which is now part
of Shekyan's open-source slowhttptest tool, takes a different
approach than previous "slow" attacks such as the infamous
Slowloris—a tool most notably used in 2009 to attack Iranian
government websites during the protests that followed the
Iranian presidential election. Slowloris clogs up Web servers'
network ports by making partial HTTP requests, continuing to
send pieces of a page request at intervals to prevent the
connection from being dropped by the Web server. Slow Read, on
the other hand, sends a full request to the server, but then
holds up the server's response by reading it ve