Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

0
votes
2answers
70 views

How hackers implemented DDoS attack with 602 Gbps?

Everybody's heard about DDoS attack with 602Gbps Bandwidth that crashed BBC site, But is really Botnets and hacked servers can implements an attack in this scale ?
0
votes
0answers
43 views

Wordpress pingback attack

I am getting Wordpress pingback attach on my server. I tried to put if condition on nginx to block deny all requests that contains "Wordpress" in the header. It works fine but still nginx get millions ...
0
votes
2answers
65 views

Preventing a web-page from getting hit from another server

A DDoS attack may result from a website attempting to access the resource of another website. For instance, example.com (attacker) is trying to access resources on example.net (victim). The ...
3
votes
1answer
75 views

How can CloudFlare save your website if the attacker knows the IP of the server?

I saw CloudFlare's services where you need to change the DNS of your domain name to their provided DNS address. The traffic coming as "mywebsite.com" goes through CloudFlare. What if I have a ...
3
votes
0answers
79 views

DDoS Mitigation - Whitelist or Blacklist Incoming Ports?

For a network offering webservices, I have had recommendations to blacklist a couple of common incoming ports, such as UDP 53, to combat the increasing load from DDoS. I'm wondering if it makes more ...
2
votes
0answers
60 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
1
vote
0answers
29 views

How to find which domain in my VPS triggered a DDoS attack with WP xmlrpc

Today, my data center suspended my VPS for DDoS attack reasons. They say one of my clients, that has WordPress website, started a DDOS attack to another websites using xmlrpc. But I don't know which ...
1
vote
1answer
71 views

What is an Origin Error Attack?

Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one. From The Forrester Wave™: DDoS Services Providers, Q3 2015 ...
11
votes
2answers
148 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS ...
0
votes
3answers
110 views

Where can I get a list of “bad” IP addresses that are likely to be used by attackers or spammers?

Is there an open source project or a list of "bad" IP addresses or ranges that are likely to be used by attackers or spammers? UPDATE: ideally I want it to be a service call so I can call it using ...
3
votes
1answer
63 views

What's the best way to block all external proxy IP's which could be used for pivot points or as a DDOS Source?

At the simplest form - the question is to block external proxy due to an emergency situation due to which management have forced technical teams to get a solution to block all the external proxy or ...
1
vote
1answer
57 views

What is the role of IP spoofing in DDoS attacks?

I've read that IP spoofing is often used in denial of service attacks, and I've also just recently read about ingress filtering, which attempts to use blacklisting to filter out spoofed IP addresses ...
0
votes
1answer
44 views

Why is a DNS Amplification attack considered a DDoS attack?

My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victims. The DNS responds to this IP address with a ...
1
vote
1answer
94 views

Must an attacker using a Smurf attack be on the same network as the victim?

I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
0
votes
0answers
178 views

What are the most popular DNS amplification attack tools for Windows and Linux?

I would like to test my edge-router firewall rules against some DNS amplification attack traffic. I could run some DNS lookup utility in an endless loop, but maybe there are some dedicated utilities ...
1
vote
2answers
53 views

How can perpertrators of denial of service attacks, determine the impact their attack has had?

Although I know how a user could mitigate Dos attacks and detect their presence e.g. checking packets received and sent, comparing current CPU usage to normal, comparing network usage to normal etc. ...
0
votes
1answer
40 views

Additional Protection Against DDoS

We have subscribed to an upstream ISP's protection service to protect against DDoS. I am thinking of developing a incident procedure in case my ISP's DDoS mitigation fails (highly unlikely right?). ...
1
vote
2answers
91 views

What danger can come from D-DoS over VPN

Every time I use VPN, I get a message to notify me to be sure that my PC is 'healthy' from pots infections. Also I've read in this article to stay away from that. My question, what damage could ...
1
vote
3answers
164 views

Why does an overload of requests give one root access all of a sudden?

There's this saying that using a DDOS-attack, people first attack a server using millions of concurrent requests and by doing that they miraculously gain access to the server. How does this work? Why ...
4
votes
1answer
147 views

Block this DDoS attack

since more than a week my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack, ovh don't care about it but this attack is killing my server with a high CPU load (permanent ...
3
votes
1answer
143 views

DDoS Attack Protection

Recently I've been threatened with an IP Address DDoS attack. I was wondering in what ways and how could I stop this attack. I'd really like to be able to do this without my parents finding out.
32
votes
2answers
645 views

Digging into DDoS attacks (includes hostile IP's from multiple honeypots)

I have been tracing a series of DDoS attempts, and am wondering if anyone else has seen anything like them. I've downloaded the following Powershell script which scrapes Terminal Server (RDP) Event ...
0
votes
0answers
49 views

Deny IP spoof from on ASA destination

on Cisco ASA I am seeing lost of logs like following (127.108.61.90) to 190.93.249.93 on interface inside (127.30.171.61) to 190.93.249.93 on interface inside (127.105.54.108) to 190.93.248.93 on ...
3
votes
3answers
591 views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
3
votes
1answer
133 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
1
vote
2answers
220 views

How can someone DDoS me?

If I've not opened the port 80, how can someone DDoS me? Is there a method or is it possible? Someone said that it's possible, but I'm not so sure, that's why I'm asking here.
4
votes
2answers
98 views

How do DoS attacks work on non-servers?

I understand how DoS/DDoS attacks work on servers. If I have not been misled, it is possible to DoS/DDoS a system that does not act as a server, but is still connected to the internet. How is this ...
1
vote
0answers
30 views

iptable ip_conntrack_max testing

I was trying to understand how ip_conntrack_max works so i have created two VM and set ip_conntrack_max to 10000 I used hping to open 10000 udp connection on VM using following command hping --udp ...
1
vote
2answers
249 views

TSource Engine Query DDoS attack

My gaming machine is under DDoS attack and when I used Wireshark I found the following string "TSource Engine Query" in all UDP packets coming from random IP's. I found using Google that some gaming ...
5
votes
1answer
109 views

Is a ddos attack that makes ssh auth attempts a possible way for attackers to significantly impact your system?

I'm noticing on my digital ocean server, that I'm getting a high volume of auth attempts. I don't have any passwords since I use sshe key auth, so I'm not worried about a break in. But can a ...
1
vote
3answers
187 views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
13
votes
1answer
292 views

Siri DDoS over FM Radio

A few days ago I was driving home and suddenly Siri started to talk by herself in reply to a command I never gave. As you can imagine I have the "hey siri..." feature active, so I can make calls ...
0
votes
0answers
28 views

Options to protect an outbound initiated connection IP?

Consider a service that has 3 separate organizations in a SaaS model. The end user(#1) connects to the first provider(#2) and then initiates a function from within the #2 that connects directly to ...
3
votes
1answer
314 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
1
vote
2answers
111 views

Protecting server from bogus HTTP Requests

What would be the recommended approach to block those typical bogus HTTP requests that the server gets bombarded with? Also has this attack/nuisance been named yet or is it generalized as Bot ...
2
votes
2answers
160 views

2 External IPs to prevent DDoS?

In my home network I currently have a Hitron cgnm-2250 acting as a modem/router combo with an IP Passthrough option enabled for a 2nd router connected to it (ddwrt nighthawk x6 r8000). I already have ...
0
votes
0answers
37 views

Behaviour of DNS query packet

When the configured name server resolver is not reachable, the query packet will retransmitted after certain t times (in windows, every 1 seconds until 8 seconds,max). The behaviour of the legitimate ...
2
votes
2answers
78 views

Website Visited by Unresolved Ip

My Website is flooded with unknown visiters Awstats says that my website getting thousands of hits in few seconds. I am using robots.txt and .htaccess, but the problem stays there. Please help me ...
1
vote
1answer
81 views

kernel: Intrusion disconnecting me

I've read about it a little but I'm concerned. It never happened before and for last 5 hours my router gets kernel: Intrusion alerts similar to these: As soon as the kernel: Intrusion is detected, ...
4
votes
2answers
159 views

DDoS attack - where are packets dropped?

I'm researching into ddos attacks to get a better understanding. I've read lots from this community however one thing I couldn't get my head around is packet dropping. So lets say I've identified an ...
1
vote
5answers
83 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
-1
votes
1answer
2k views

dns reflection attack vs dns amplification attack

Over the past few weeks I have hard the discussion of a DNS reflection attack and a DNS amplification attack. Is there truly a difference between the two or are people just using 2 different names ...
1
vote
1answer
104 views

Different types of DDoS attacks [closed]

What is behavior of UDP flood, TCP SYN flood, Ping of Death and Smurf attack?
1
vote
0answers
47 views

Machine compromised [closed]

Recently, one of our GUI based jump box (ec2-instance) used for deployment to other ec2-machines got compromised, and was used for DDOS attack to other sites. Amazon reported abuse for the same. On ...
1
vote
5answers
223 views

DDOS Server Attacks & Domain Names

I'm currently with a web hosting account whose servers seem to be constantly down due to DDOS attacks. I check my analytics daily and I'm seeing a major surge in fake traffic for several of my URLs ...
26
votes
5answers
3k views

DDOS - security or operational risk?

The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one. Also I was ...
1
vote
2answers
91 views

Infected employee using office VPN was part of a DDoS attack

Recently, our office VPN was taken down by our ISP after discovering a DDoS attack. Apparently an employee connected to our VPN is infected. There were no logs at the time of the event. Besides ...
0
votes
1answer
159 views

DDoS attacks targeting Android

I am currently studying some Android topics and I've been having difficulties finding answers regarding DDoS attacks. My question is: Are Android devices vulnerable to DDoS attacks or does Android ...
1
vote
0answers
14 views

Probabilistic packet marking content ID field

For Above image: All routers are using PPM. What will be the content ID field if 1) R1 = mark packet, R2= Mark packet, R3 = Not mark the packet. 2) R1 = Not mark packet, R2= Mark packet, R3 = Not ...
0
votes
2answers
124 views

Hijack attacked SSL/TLS-connections?

I think we all heard the news that China used unencrypted HTTP-connections to drive DDoS attacks on targeted websites. Now within the last few months we've learned about three new attacks ...