A flaw in the HTTP protocol leaves the door open for attackers to wage a new form of distributed denial-of-service (DDoS) attack that floods Web servers with very slow HTTP “POST” traffic. Researchers will present the research on the attack at the OWASP 2010 Application Security Conference next week. The attack works like this: The attacker sends POST headers with a legitimate “content-length” field that lets the Web server know how much data is arriving. An agentless botnet-borne attack is difficult to trace because there’s no permanent source of the attack.”]