Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet.

But what if, in like 5 years, everyone is able to rent a botnet? Shouldn't we just re-think the whole internet architecture then?

1: by stop I also accept remove the negative effects aka keep the service running.

share|improve this question
16  
Yeah, we should just re-think the whole internet architecture. While we're at it, I have some feature requests for the universe... –  Camil Staps Apr 5 '13 at 18:45
    
Currently everyone IS able to rent a botnet at low cost. It takes a few second on google to see advertised services free for all. This guy (gwapo) has people doing youtube ad's for him... youtube.com/watch?v=c9MuuW0HfSA&noredirect=1 –  NULLZ Apr 6 '13 at 2:18
5  
Yeah, I want a global fabric of point-to-point virtual circuits with guaranteed bandwidth, whose establishment is cryptographically authenticated. But at the same time, I want to keep my anonymity, god damn it, as well as unlimited usage plans for everyone. –  Kaz Apr 6 '13 at 6:04
add comment

7 Answers

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic.

Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many cases.

share|improve this answer
4  
Short and sweet, but somewhat incorrect. Most DDoSs are the result of a botnet. Botnets, however massive, are a subset of the Internet, that attack by making sustained, rapid requests, often in a manner differing significantly from legitimate traffic (no legitimate user sends SYN after SYN without completing the handshake). More sophisticated attacks that turn legitimate users against a site (DNS hacking, malicious Slashdot-style linking) are harder to defend against, but also harder to pull off and control (as in Tom Leek's analogy; you set it up and hope for the worst). –  KeithS Apr 5 '13 at 19:22
    
Are not DDOS attacks simply the result of a barrage of requests from the same computers (be it thousands or hundreds of thousands). Sure you can't stop the initial onslaught, but if you can identify and block the IP's that are making repeated, bot like requests couldnt you stop a simple attack (where IP's are not changing every request)? –  n00b Apr 5 '13 at 20:52
5  
@KeithS a syn flood is one specific kind of DDoS attack. Simply making HTTP requests or SMTP connections or other well-formed TCP or UDP traffic is also a successful form of DDoS attack. –  Sparr Apr 5 '13 at 21:25
    
DDoS just reminds me of SpamHaux attack using open Resolvers DNS :D –  Novice User Apr 12 '13 at 18:49
2  
@n00b if you can identify the IPs then the attack isn't very thoroughly distributed. The significant difference in a DOS and a DDOS is the distribution of the source of traffic. –  Sparr Apr 12 '13 at 18:53
add comment

Well, you can scale infrastructure to make it more difficult for a botnet to keep up enough traffic to disable the service, but ultimately, the only counter if a DDoS is using otherwise legit traffic to cause issues, all you can do is increase your bandwidth to be higher than theirs. If you can identify a source as rogue, then you can try to block the traffic from being processed by your server (which will reduce CPU and memory load) but you still have to deal with the traffic being flung which the Internet is going to deliver.

share|improve this answer
add comment

There are things you can do but you will never be 100% protected.

I was recommended Fail2Ban firewall for my site on this forum before and that helped. Basically one fail2ban detects similar activity x amount of times in its log files it bans that ip.

Blocking all non-used ports also helps.

share|improve this answer
add comment

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things.

In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into buying them. Jim is the nice guy in our story.

Let there be Bob. Bob is a disgruntled nihilist who hates Jim. Bob would go to great lengths to make Jim unhappy, e.g. disrupting Jim's business. Bob does not have many friends, but he is smart, in his own twisted way. One day, Bob spends some money to make the local newspaper publish an ad; the ad states, in big fonts and vivid colours, that Jim runs a great promotion at the occasion of his shop's tenth birthday: the first one hundred customers who enter the shop will receive a free iPad. In order to cover his tracks, Bob performs his dealings with the newspaper under the pseudonym of "bob" (which is his name, but spelled backwards).

The next day, of course, the poor Jim is submerged by people who want a free iPad. The crowd clogs Jim's shop but also a substantial part of the mall, which becomes full of disappointed persons who begin to understand that there is no such thing as a free iPad. Their negativeness makes them unlikely to buy anything else, and in any way they cannot move because of the press of the crowd, so business in the mall stops altogether. Jim becomes highly unpopular, with the ex-iPad-cravers, but also with his shopkeeper colleagues. Bob sniggers.

At this point, Jim contacts the mall manager Sarah. Sarah decides to handle the emergency by calling the firemen. The firemen come with their shining helmets, flashing trucks, screaming sirens and sharp axes, and soon convince the crowd to disperse. Then, Sarah calls her friend Gunther. Gunther is a son of German immigrants, a pure product of the US Melting Pot, but more importantly he is a FBI agent, in charge of the issue. Gunther is smart, in his own twisted way. He contacts the newspaper, and is first puzzled, but then has an intuitive revelation: ah-HA! "bob" is just "Bob" spelled backwards ! Gunther promptly proceeds to arrest Bob and send him meet his grim but legal fate before the county Judge.

Finally, in order to avoid further issues with other nihilists who would not be sufficiently deterred by the vision of Bob's dismembered corpse put on display in front of the mall, Sarah devises a mitigation measure: she hires Henry and Herbert, two mean-looking muscular young men, and posts them at the mall entries. Henry and Herbert are responsible for blocking access should a large number of people try to come in, beyond a given threshold. If a proto-Bob strikes again, this will allow the management of the problem on the outside, in the parking lot, where space is not lacking and crowd control much easier.


Morality: a DDoS cannot be prevented, but its consequences can be mitigated by putting proactive measures, and perpetrators might be deterred through the usual, historically-approved display of muscle from law enforcement agencies. If botnets become too easy to rent, predictable consequences include increased police involvement, proactive authentication of users at infrastructure level, shutting off of the most disreputable parts of the network (in particular Internet access for the less cooperative countries), and a heavy dose of disgruntlement and sadness at the loss of a past, more civilized age.

share|improve this answer
2  
That was an amazingly nice read, however a server is not a mall and having people do something isn't as expensive as machines doing it in cyberspace. Wouldn't it be possible for ISPs to block attacks on their end? Similar as to putting a police agent in front of everyone's home and asking where he's going? –  user2173629 Apr 5 '13 at 18:04
4  
That's the analogy. A DDoS attack is not qualitatively distinguishable from a normal user; the difference is just that the DDoS-ing requests are sent by someone who has no intention whatsoever of using the service in the "normal way" -- but intentions cannot be detected remotely, in particular by computers. –  Tom Leek Apr 5 '13 at 18:15
    
Suppose I only allow TCP traffic to my server, and reject the packet immediately as the session starts (I dislike the source IP), will that prevent a DDOS? (I'm thinking the bandwidth won't be consumed, and I won't affect other sessions) –  makerofthings7 Apr 5 '13 at 18:35
    
@makerofthings - Your ISP is still trying to send all other traffic to you, and you still have to perform some cursory inspection of the packet to determine it's a rotten egg. It's a losing game; a coordinated DDoS attacker can add zombies more easily than you can reduce the time/effort needed to reject their packets. –  KeithS Apr 5 '13 at 19:10
9  
""bob" (which is his name, but spelled backwards)" <-- Nice. –  root Apr 5 '13 at 20:07
show 1 more comment

Despite what others are saying, yes you can.

Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board.

The solutions I have tested are very effective at transferring DDoS traffic, even when it is a mirror of real, valid traffic. For some of these tests, cutover was sub-millisecond and had almost no measurable effect on legitimate traffic.

These work by dynamic rerouting protocols, and in principle could work anywhere. The reason they are only used by large corporates is they cost a lot.

A sensible fix is for all ISPs is to fleet outbound traffic and share filter lists-this could prevent DDoS attacks entirely. It would just require users and companies to demand it off their ISPs and move from any who didn't provide this service. Eventually any ISP that didn't provide it would just be blacklisted.

share|improve this answer
    
"at a scale that hasn't been seen previously" do you have a prove for this? cloudflare/spamhaus - sources doesnt count :) for me this biggist attakk* - meme smells like a well done scoop by cloudflare. –  that guy from over there Sep 11 '13 at 7:35
    
Various ISPs also confirmed this was considerably larger than any previous attack. I might get a chance to google for their comments later. –  Rory Alsop Sep 11 '13 at 11:38
add comment

I guess with a p2p-only architecture it might be possible... But it would require many changes in how computers behave, and it would involve sluggishness for many small websites. It's a good question.

When you have a network architecture that allows centralization, it will always allow DDOS. To be able to prevent those, you would need the whole internet infrastructure to become DDOS aware, meaning, all request to a certain IP would be filtered out when a bottleneck is detected. It would be really expensive to implement such feature because routers are designed to be fast, and would require a "DDOS containment mode" that would check packet target addresses, which would be slow. The website would still end up unresponsive or unreachable, but not crashing.

Another way would be to enable website to have some sort of mirror/broadcast system to repeat content. Broadcast means the content is automatically repeated by routers. But it would require to not change often, which would be a severe requirement, and not many website could afford it since it's expensive.

Honestly I don't really consider DDOS like an attack or a security problem. Botnets are.

share|improve this answer
add comment

There are in principle ways to stop a DDOS:

  • The simplest way is to just throw more resources at it. Good luck trying to take down amazon.com or google.com. Combine a round-robin DNS entry with tons of cloud servers and it get's really hard to DDOS you.

  • Not everyone can afford such immense resources, but that's what services like CloudFlare are for. If you become their customer, they provide the resources (proxies, bandwidth), and as soon as you need it, allocate it to you. It's like an insurance, a lot of people share the investment, and you benefit from it when needed.

  • DDOS traffic often is distinguishable from legitimate traffic.:

    • For example, if it comes in as HTTP requests, you could temporarily block port 80, but your HTTPS and email servers would still be reachable. Of course this means a partial shutdown, but better than a complete loss of services.
    • This is just hearsay, but I've been told that there are specialized switches that can do deep packet inspection with incredible bandwidth, by using FPGAs. They can be used to filter HTTP requests that don't have a proper User-Agent, or TCP packets that look suspicious.
  • Last but not least, a lot more could be done with cooperation from your ISP, or the backbone providers. If the attack is geographically concentrated, temporarily stop routing data from that region to your servers. I assume these kind of strategies will have to be used more widely in future.

    (In Tom Leek's analogy: Imagine Bob made his free iPad offer only to black / Chinese / caucasian / ... people. Now hire a racist security guard. You'll stop the onstorm of fake customers, but at a price, namely that you'll anger some legitimate customers. (Needless to say, please don't do that in reality.))

  • Just for completeness, if you know who is attacking you, you can retaliate. Either legally by calling the authorities, or by paying them back in their own coin and attacking their servers (but please dont!).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.