Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

6
votes
1answer
6k views

High concentration of UDP traffic, good or bad?

Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security? I'm looking at my organization's network protocol ...
6
votes
3answers
1k views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
5
votes
5answers
2k views

SYN Flooding issue

I recently purchased a server with "DDoS protection" and a 1gbps uplink. What I can't figure out, is that I'm suffering from SYN floods. Isn't the large amount of bandwidth available to me supposed ...
5
votes
3answers
3k views

How are server overload and DoS/DDos different?

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does ...
5
votes
2answers
4k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
5
votes
1answer
4k views

Can you be DDoS'ed even if you are behind a home router with no open ports?

I was wondering if someone can become a victim of a DDoS attack as home user when only his IP is known by the attackers but he is behind a router with no open ports or other known vulnerabilities? ...
5
votes
3answers
4k views

How will IPv6 affect DDoS mitigation techniques?

IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations? For example, ...
5
votes
3answers
966 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
5
votes
3answers
450 views

DoS by consuming all hosting trafic

Given a small website hosted on a small data plan, is it possible for someone to keep doing requesting for my website URL or just an image hosted on my website that will consume all my permitted ...
5
votes
1answer
1k views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
4answers
904 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
5
votes
1answer
423 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
5
votes
3answers
4k views

My server is used for DDoS attacks

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user? What logs should I look to, is there any settings I can modify so such ...
5
votes
1answer
298 views

Is a ddos attack that makes ssh auth attempts a possible way for attackers to significantly impact your system?

I'm noticing on my digital ocean server, that I'm getting a high volume of auth attempts. I don't have any passwords since I use sshe key auth, so I'm not worried about a break in. But can a ...
5
votes
2answers
5k views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
5
votes
4answers
2k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
5
votes
1answer
590 views

How does a Distributed Denial Of Service Attack work

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do ...
5
votes
2answers
3k views

How to Secure a Stream from DDoSers?

I conduct a weekly live-stream using Google Hangouts that streams over YouTube. Recently, the stream has been attacked by DDoSers. In an attempt to thwart such attacks, I have tried to keep my IP ...
4
votes
6answers
1k views

Bot detecting by considering request inter-arrival time

If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time? When a user request for a page (page request), browser request for several ...
4
votes
4answers
7k views

Find out how my server is being used for DDOS attacks

I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and ...
4
votes
1answer
1k views

How is DDoS different from DRDoS?

I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target. How is DRDoS different?
4
votes
4answers
6k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
1answer
139 views

How can CloudFlare save your website if the attacker knows the IP of the server?

I saw CloudFlare's services where you need to change the DNS of your domain name to their provided DNS address. The traffic coming as "mywebsite.com" goes through CloudFlare. What if I have a ...
4
votes
1answer
2k views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
4
votes
3answers
496 views

How similar are bots regarding their HTTP GET request?

Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
4
votes
1answer
276 views

Can a Cisco ASA 5505 block this DDoS attack?

Since more than a week ago, my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load ...
4
votes
2answers
109 views

How do DoS attacks work on non-servers?

I understand how DoS/DDoS attacks work on servers. If I have not been misled, it is possible to DoS/DDoS a system that does not act as a server, but is still connected to the internet. How is this ...
4
votes
3answers
160 views

Where is the limit between an attacker and a victim (zombie) in a DDoS attack

Let's say that A is DDoSing B and I'm a member of his botnet. Who says that I'm not a real attacker but a victim? How you determine it?
4
votes
2answers
240 views

DDoS attack - where are packets dropped?

I'm researching into ddos attacks to get a better understanding. I've read lots from this community however one thing I couldn't get my head around is packet dropping. So lets say I've identified an ...
4
votes
1answer
954 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
4
votes
2answers
1k views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
3
votes
3answers
4k views

How to send GET/POST requests without header and agent information

I want to test our DOS prevention system against http requests that are not have header and agent information. Is there any tool I can do that. I tried siege with this command siege -c 3 -b -H ...
3
votes
4answers
2k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
3
votes
2answers
4k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
3
votes
3answers
30k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
3
votes
1answer
779 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
3
votes
4answers
3k views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
3
votes
1answer
319 views

Could Stock Exchange be shut down by HFT attack vector?

First of all, stock, not stack exchange. I just read this post on Krypt3ia. In short, it says that HFT attack vector in combination with DDoS is possible new nemesis for stock exchange IT systems. ...
3
votes
3answers
1k views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
3
votes
1answer
46 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
3
votes
1answer
57 views

In house mitigation for a volumetric DDoS attack

Can a volumetric DDoS attack be mitigated by some in house defense or does the defense always need to be on the cloud? If yes, then why?
3
votes
3answers
1k views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
3
votes
2answers
4k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
3
votes
1answer
158 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
3
votes
1answer
102 views

What's the best way to block all external proxy IP's which could be used for pivot points or as a DDOS Source?

At the simplest form - the question is to block external proxy due to an emergency situation due to which management have forced technical teams to get a solution to block all the external proxy or ...
3
votes
3answers
256 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
3
votes
1answer
167 views

DDoS Attack Protection

Recently I've been threatened with an IP Address DDoS attack. I was wondering in what ways and how could I stop this attack. I'd really like to be able to do this without my parents finding out.
3
votes
1answer
583 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
3
votes
2answers
68 views

Should HSTS header be sent on an error response?

We need to configure our loadbalancer to send the HSTS header and we are debating whether or not to send the header on HTTP 4xx/5xx responses. Our main concern is application layer DDos attacks. We ...
3
votes
2answers
4k views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...