Is this a symptom of an attack (DoS/DDoS)?

Question

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one.

We have a search functionality in our website and the supposed attacker is sending a lot of requests directly to our search. Right now it is taking us down as this is a bottleneck (database). We are working to scale it up (taking the search out of the database into lucene) so this traffic should not be a problem in the future.

All requests come from a dozen IP addresses spread across German and USA's Amazon AWS hostnames, but since query terms they are using are not entirely unrelated (they are passing sequences of numbers and weird full names) to our business I got to think if this is really an attack.

Any thoughts on this?

Thanks

Answer 1

From the summary of your issue, if it is causing resource consumption then even if this is not an evil 'attack' it is still causing you a Denial of Service condition and you are right to revisit your architecture.

However, in terms of identification of this being an attack, you would need to investigate the query terms further, to understand if any of them are attempts to conduct injection based attacks (such as cross-site scripting (XSS) / SQL Injection etc.). The high volume of numbers and names could be used to create noise to hide malicious attempts.

You should also look for trends within the data to identify if this is potentially a coordinated effort and thus classify all of the bad traffic as the same or if you have a specific subset of bad traffic that you can focus on.

Answer 2

If you see that "dozen" IPs send you 1,000th requests in few seconds/minutes interval, it more likely that you suffer from DOS attack.

Just dozen IPs I wouldn’t call it DDOS.

But it’s possible that it’s preparation for something bigger.

Answer 3

All requests come from a dozen IP addresses spread across German and USA's Amazon AWS hostnames, but since query terms they are using are not entirely unrelated (they are passing sequences of numbers and weird full names) to our business I got to think if this is really an attack.

On the face of it, it seems typical of a flood attack using proxy servers and placing repeated or hammer action type requests on your webserver aiming at search terms that will cause the greatest amount of search results, thus consume the most CPU usage as possible of the database server.

The sequence numbers could be as a cache breaking exercise as the problem with using proxy servers is that many of them are caching to the attacker wants every send to be an actual request on your webserver.

An example might be www.yoursite.com/?searchword=aeroplanes&randomfieldname=100001

While the webserver will ignore randomfieldname because it is not looking for it, it will take the value from searchword and apply the request.

A caching proxy however will see the following

www.yoursite.com/?searchword=aeroplanes&randomfieldname=100001

www.yoursite.com/?searchword=aeroplanes&randomfieldname=100002

www.yoursite.com/?searchword=aeroplanes&randomfieldname=100003

www.yoursite.com/?searchword=aeroplanes&randomfieldname=100004

etc

as new requests therefore always pass the request through to your server even though the search word has not changed.

This is an example of a hammer attack.

Typically though, hammer tools are basic in that they may not understand more advanced validation of a legitimate request. For example a validated search request could mean using image validation, or demanding a cookie response, or even demanding the viewing browser understands javascript in order to execute a valid search request.

These extra security checks though can be annoying for legimate site viewers, for example image validation.

Have a look at Cafe Counter Intelligence Soap CMS class for ideas of how the author is using a clever combination of sessions and javascript to demand that the viewing browser understands js before accepting the page request. A request counter is then started and the IP address is denied access if the requests are too frequent...i.e. as is often the case in hammer attacks.

Although that class was written almost a decade ago, the concepts in it are as valid today as the day they were written, albeit their need to be updated to the latest PHP coding standards.