HULK DDoS-from-one-computer is easily thwarted, say security pros

Security experts are downplaying the significance of a new denial-of-service (DoS) attack tool.

The HTTP Unbearable Load King (HULK) program was developed by a white-hat network security researcher, who shared it on his blog as a proof-of-concept demonstration of how to effortlessly knock over web servers. Nonetheless there is some concern that others might use it for more nefarious purposes.

Barry Shteiman, the developer of the HULK python script, was able to bring a Microsoft IIS 7 web server test system "to its knees" in under less a minute from a single host using the tool.

Neal Quinn, chief operating officer at DoS defence biz Prolexic, commented: "We’ve tested the tool internally and it is functional. What makes HULK dangerous is the fact that a single malicious actor with a single computer could feasibly take down a small, unhardened web server in minutes."

HULK starts a load of threads to fire off a flood of HTTP GET requests with randomly generated header and URL parameter values. This randomisation makes it more difficult to distinguish the attack from legitimate traffic. However thwarting the tool is not especially difficult, according to Prolexic.

“Fortunately, this is not a very complex DoS tool,” he added. “We were quickly able to dissect its approach and stop it dead in its tracks. It is fairly simple to stop HULK attacks and neutralise this vulnerability with the proper configuration settings and rules.”

Prolexic has added rules to its distributed-DoS mitigation tools to defend against possible attacks that leverage HULK's technique, as explained here. ®