18

Lets say http://www.an-example-site.com is under DDoS attack. Alice, who does not have direct access to the hardware infrastructure, urgently wants some information which can be accessed through the site only.

In such a situation, what are the choices Alice have?

4
  • 7
    Alice must disable her botnet that initiated the ddos
    – Woot4Moo
    Aug 28, 2011 at 16:12
  • 4
    Is Alice just a random person or is she an admin of that site? Aug 28, 2011 at 16:12
  • 1
    Are there any external firewalls that do not have IP addresses registered to an-example-site connected to the network (that Alice might use to VPN to the internal side of the network for access to the site)?
    – iivel
    Aug 28, 2011 at 16:15
  • @Hendrik A user of the site
    – check123
    Aug 28, 2011 at 17:07

4 Answers 4

17

Many operators (most I hope) use back-door network connections, such as a modem through a terminal server at the site. There are lots of variations on this theme, but that's the easiest way to do it, and has the advantage of giving you access to your network if there's a network or hardware problem affecting your connectivity.

Another option is working with your ISP to shut down all traffic except traffic coming from your particular netblock or IP address; that's a simple change, and most tier-1 ISP's will be able to help you with this under emergency circumstances.

There are also commercial cleaning services like Verisign's DDoS prevention product that can divert all of the traffic, remove the DDoS traffic in particular, and send the result back to your network. This can be done via DNS or (better) BGP.

Finally, not all DDoS attacks are just packet cannons. If you're being attacked with something like an SSL resource exhaustion attack or one of a bunch of similar high-level attacks, your SSH connection into your webserver may still work just fine. Then again, it may not, if it's that server itself that's overloaded and spinning at 100% CPU. A solution to this problem is to get an SSL offload device and put it in front of your server(s). Planning a high-availability site like this takes some thought, but you will definitely get better results.

1
  • 2
    "Packet cannons" lol, I'll have to remember that one
    – TheLQ
    Aug 31, 2011 at 17:10
6

If Alice is just a user of information on the site, she doesn't have any alternatives unless the site administrators have prepared other access methods.

Check out David's answer here for one solution - the mitigation partner. This requires an upstream entity, such as the ISP, to reroute DDoS traffic (as Steve Dispensa said)

An alternative may be to provide important users with secondary routes to access the website

Yet another could be to limit access to connections from pre-approved IP addresses and drop all other traffic at the perimeter router.

4

The simplest solution would be to find a cached version of the page she's trying to access.

Assuming Alice doesn't need to login to find the information.

0

Apparently Google cache got new assignment to help Internet users in distress :


enter image description here

Even Twitter users can benefit from this forgotten feature.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .