Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

4
votes
4answers
1k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
4
votes
1answer
574 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
3
votes
1answer
345 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
3
votes
1answer
228 views

Could Stock Exchange be shut down by HFT attack vector?

First of all, stock, not stack exchange. I just read this post on Krypt3ia. In short, it says that HFT attack vector in combination with DDoS is possible new nemesis for stock exchange IT systems. ...
3
votes
4answers
3k views

Find out how my server is being used for DDOS attacks

I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and ...
3
votes
3answers
304 views

How similar are bots regarding their HTTP GET request?

Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
3
votes
2answers
2k views

My server is used for DDoS attacks

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user? What logs should I look to, is there any settings I can modify so such ...
3
votes
3answers
743 views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
3
votes
2answers
224 views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...
2
votes
2answers
2k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
2
votes
4answers
1k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
2
votes
2answers
267 views

Can an attacker slow down my server without compromising it?

We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now. Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...
2
votes
3answers
11k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
2
votes
3answers
1k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
3k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
2
votes
3answers
667 views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
2
votes
2answers
3k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
2
votes
2answers
149 views

Which IP / Client is being Ddosed?

I currently have some Vps's and shared hosting plans with a few hosting providers. Recently one of my shared hosting accounts was suspended due to a denial of service attack. I understood why they had ...
2
votes
2answers
1k views

Protection against DDoS when using proxies

We're trying to protect some sites that are primarily located in Asia using distributed caching. These sites commonly come under DDOS attacks. We are using fail2ban, but still have two problems: ...
2
votes
2answers
540 views

Outbound DDOS attack from a centos server

We run a mail server (postfix/dovecot/centos 6.4). The hardware is based on a supermicro chasis with IPMI features. It also runs a web interface for accesisng mails(Apache web server ) Recently our ...
2
votes
3answers
502 views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
2
votes
1answer
541 views

What is Open Resolver Project and how does it solve DNS reflection attacks?

What is Open Resolver Project and how does it give a solution for DNS reflection attack? I also read that Open Resolver Project follows BCP38. What is BCP38?
2
votes
3answers
221 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
2
votes
1answer
166 views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
2
votes
2answers
2k views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
2
votes
3answers
1k views

Why is it easy to detect network layer DDoS attacks?

I have seen numerous research papers that claim it is "easy to detect network layer DDoS attacks" without saying why. Usually these research papers focus on detection or prevention of application ...
2
votes
1answer
122 views

Types of attacks outside of AppSec and Vendor-Specific Systems?

I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
2
votes
1answer
1k views

How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks?

I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS. Is this something I can do here, or must I take action on the host itself?
2
votes
0answers
81 views

DoS stress test not working [closed]

First off I'd like to say this is my first post on StackExchange, so please let me know if there's anything wrong with it. Also, I don't know much about networking and I'm just making a simple java ...
2
votes
0answers
190 views

Snort Parallelization Techniques and its effect on DDOS detection capability

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
1
vote
2answers
1k views

DDoS — null route everything not approved

Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour ...
1
vote
1answer
204 views

How is DDoS different from DRDoS?

I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target. How is DRDoS different?
1
vote
2answers
2k views

How much does it cost to protect your website against DDOS, by tier?

Cross-posted to Quora Today several financial institutes in Israel (banks, stock exchange) were DDOSed. They decided to block all foreign IPs as a first aid measure. While I agree that it was ...
1
vote
1answer
128 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
1
vote
3answers
283 views

Strange Apache access logs

A site of ours has been targeted by some kind of strange attack and I am trying to work out exactly how it has happening. Basically, the strangest thing is that the logs seem to correspond to entirely ...
1
vote
6answers
258 views

DDOS slow-http attack prevention

I am often getting DDOS attack from multiple IPs with simple HEAD requests. There are around 30 unique IPs creating such attacks. 201.230.167.68 - [05/Jan/2014:00:19:19 +0530] "HEAD / HTTP/1.1" 301 ...
1
vote
1answer
69 views

Root/Naked domain and DDOS

Some services like Github has DDOS mitigation measures for their root/naked domain, but not other subdomain(s). What so special about the root domain concerning the DDOS attacks? [1] ...
1
vote
3answers
198 views

Can anyone DDOS my server with jmeter? Do they need a powerful server for that?

Is there a way to DDOS my web app through jMeter? Can anyone DDOS with a simple PC? I couldn't find any answer here. I would appreciate if anyone could help me out.
1
vote
1answer
75 views

DNS zone size overload?

Is it possible to DOS DNS by creating custom dns zones with lots of text records in them so that the size of the DNS zone is in the order for example 100 Gigabyes, and then query all the dns records ...
1
vote
1answer
120 views

What are the hardwares used to protect against a DDoS attack on Network layer

What hardware is used to prevent a DDoS attack on a network layer? This question is for my project which I am doing. I have a game server and I need to simulate an attack - an SYN flood. So what ...
1
vote
2answers
774 views

How to mitigate SIP Reflection Attacks?

SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks. A freeswitch server I manage has seen heaps of registration requests ...
1
vote
2answers
6k views

How to conduct DDoS attack practically? [duplicate]

Possible Duplicate: How to simulate DDoS attacks from the Internet? I want to conduct a DDoS attack. Can anyone please tell how can i conduct it? What are the latest DDos attacks? What are ...
1
vote
2answers
141 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
1
vote
1answer
550 views

How to prevent DHCP Starvation attack?

All this while, I assumed that switchport security is enough to prevent DHCP dos attack. If I set it maximum 1, there can be no more mac addresses packets. But, a friend told me that using the tool, ...
1
vote
3answers
109 views

What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls?

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to ...
1
vote
1answer
172 views

How does a Distributed Denial Of Service Attack work

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do ...
1
vote
1answer
115 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
1
vote
0answers
131 views

Akamai or Incapsula (or other) for CDN with DDoS Protection? [closed]

One of our clients is launching a new site and I've been tasked with making a short overview of the advantages/disadvantages of Akamai, Incapsula or other CDN providers who are strong with DDoS ...
1
vote
1answer
545 views

Orbit Downloader botnet program removal [solved]

Recently (shortly after midnight on 10/8/2013) I installed and ran Orbit Downloader. After learning that the latest version (4.1.1.8) has a botnet-like module included I immediately stopped the ...
1
vote
0answers
289 views

Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]

I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html I was reading... ...