Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

2
votes
2answers
3k views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
1
vote
6answers
475 views

DDOS slow-http attack prevention

I am often getting DDOS attack from multiple IPs with simple HEAD requests. There are around 30 unique IPs creating such attacks. 201.230.167.68 - [05/Jan/2014:00:19:19 +0530] "HEAD / HTTP/1.1" 301 ...
-1
votes
2answers
122 views

I don't understand how BIPS got hacked [closed]

http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
0
votes
1answer
1k views

What is the difference between SYN cookie, SYN cache, and SYN proxy?

I am trying to understand some techniques regarding SYN flood prevention and there are three terms I couldn't find a clear explanation of. The terms that are confusing me are: SYN Proxy SYN Cache ...
1
vote
1answer
339 views

How is DDoS different from DRDoS?

I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target. How is DRDoS different?
2
votes
1answer
629 views

What is Open Resolver Project and how does it solve DNS reflection attacks?

What is Open Resolver Project and how does it give a solution for DNS reflection attack? I also read that Open Resolver Project follows BCP38. What is BCP38?
0
votes
1answer
2k views

What methods are there of protecting a VPS from DDOS attacks? [duplicate]

I was just wondering what would be the best way to stop a VPS from being attacked, bandwidth would be a problem in this case so methods that reduce the amount of incoming attacks and stop sending ...
1
vote
1answer
121 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
2
votes
3answers
964 views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
0
votes
1answer
329 views

Preventing DDoS from faked IP address [duplicate]

According to this answer, it's possible to send a network packet with a forged source IP address. So, what methods a server administrator can take to prevent/block a countless requests from faked IP ...
1
vote
1answer
634 views

Orbit Downloader botnet program removal [solved]

Recently (shortly after midnight on 10/8/2013) I installed and ran Orbit Downloader. After learning that the latest version (4.1.1.8) has a botnet-like module included I immediately stopped the ...
0
votes
4answers
253 views

What can a zombie computer feasibly install and run?

I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known ...
6
votes
4answers
677 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
2
votes
2answers
156 views

Which IP / Client is being Ddosed?

I currently have some Vps's and shared hosting plans with a few hosting providers. Recently one of my shared hosting accounts was suspended due to a denial of service attack. I understood why they had ...
5
votes
2answers
1k views

Does a DDoS attack have other purposes beyond a lack of availability? [duplicate]

I'm currently researching DDoS attacks for an article I'm writing and apart from the obvious lack of availability of the target host and their services, is there anything else a DDoS can help ...
1
vote
1answer
131 views

What are the hardwares used to protect against a DDoS attack on Network layer

What hardware is used to prevent a DDoS attack on a network layer? This question is for my project which I am doing. I have a game server and I need to simulate an attack - an SYN flood. So what ...
0
votes
1answer
107 views

Finding the method of attack [closed]

My server has been repeatedly attacked in the last few days. Here's the observations: The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
3
votes
1answer
471 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
-4
votes
2answers
105 views

Analysing server (VPS) before hosting a government website [closed]

Hosting a government website would definitely increase reputation, but it would also bring higher chances of the hosting server getting attacked by DDoS attacks. It's a cPanel based VPS. What basic ...
1
vote
2answers
2k views

DDoS — null route everything not approved

Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour ...
0
votes
2answers
764 views

A DDOS attack by uploading a few hundred large files - whats stopping anybody?

I am new to the IT Security field and am essentially a developer as opposed to a networking person hence the question may be a dumb one I am writing a REST service exposed to the internet which ...
3
votes
4answers
4k views

Find out how my server is being used for DDOS attacks

I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and ...
0
votes
3answers
943 views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
5
votes
5answers
5k views

Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?

I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports. If the all the DNS response go to a Authoritative ...
6
votes
3answers
536 views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
-2
votes
1answer
368 views

Spoofed DDoS mitigation / DNS amplification mitigation [duplicate]

Recently my server has been attacked multiple times, after looking at my firewall I've come to the conclusion that the IP's are spoofed. (10,000+ IP's connect at once) I'm running Win server 2012 x64 ...
5
votes
1answer
292 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
1
vote
0answers
336 views

Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]

I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html I was reading... ...
-4
votes
1answer
2k views

DoSing my Home Network with only a Public IP address [closed]

+--------------------------------------------------------+ | Client Host Name |.. IP Address ..|.... MAC Address ...| | Desktop-Home ....| 192.168.1.100 | 00:19:D1:EA:03:68 | | GT-S5380K ...
2
votes
3answers
14k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
1
vote
1answer
135 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
22
votes
7answers
15k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
6
votes
5answers
2k views

I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?

My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
18
votes
3answers
6k views

DNS Amplification DDOS attack

During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
15
votes
7answers
1k views

Would it be possible to overload a large part of the internet, and if so then how?

Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
4
votes
3answers
2k views

How will IPv6 affect DDoS mitigation techniques?

IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations? For example, ...
0
votes
1answer
565 views

DDoS prevention (LOIC doesn't do the job anymore) [closed]

We are about to launch a important webservice. We must test it for DDoS. From other questions/answers here I learned about LOIC. Downloaded, tried, but my apache refuses it. What other ready made ...
2
votes
0answers
194 views

Snort Parallelization Techniques and its effect on DDOS detection capability

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
2
votes
3answers
1k views

Why is it easy to detect network layer DDoS attacks?

I have seen numerous research papers that claim it is "easy to detect network layer DDoS attacks" without saying why. Usually these research papers focus on detection or prevention of application ...
0
votes
3answers
157 views

DDOS protection for instant messenger server

I developed an instant messenger which uses TCP ports for its communication, and hosted the server application on a VPS account from some hosting company, but the first day I got attacked by a ...
1
vote
2answers
994 views

How to mitigate SIP Reflection Attacks?

SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks. A freeswitch server I manage has seen heaps of registration requests ...
5
votes
2answers
2k views

How to Secure a Stream from DDoSers?

I conduct a weekly live-stream using Google Hangouts that streams over YouTube. Recently, the stream has been attacked by DDoSers. In an attempt to thwart such attacks, I have tried to keep my IP ...
7
votes
6answers
1k views

how to mitigate a DDoS from botnet on your website that comes from random IPs

I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website. If there was a consistent URL it was hitting then it would be fairly simple, and ...
4
votes
3answers
131 views

Where is the limit between an attacker and a victim (zombie) in a DDoS attack

Let's say that A is DDoSing B and I'm a member of his botnet. Who says that I'm not a real attacker but a victim? How you determine it?
3
votes
3answers
824 views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
4
votes
6answers
642 views

Bot detecting by considering request inter-arrival time

If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time? When a user request for a page (page request), browser request for several ...
3
votes
3answers
335 views

How similar are bots regarding their HTTP GET request?

Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
4
votes
1answer
646 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
8
votes
3answers
18k views

How can I identify open DNS resolvers in my network?

This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
2
votes
3answers
2k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...