Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

5
votes
3answers
3k views

How are server overload and DoS/DDos different?

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does ...
5
votes
2answers
3k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
5
votes
1answer
3k views

Can you be DDoS'ed even if you are behind a home router with no open ports?

I was wondering if someone can become a victim of a DDoS attack as home user when only his IP is known by the attackers but he is behind a router with no open ports or other known vulnerabilities? ...
5
votes
3answers
443 views

DoS by consuming all hosting trafic

Given a small website hosted on a small data plan, is it possible for someone to keep doing requesting for my website URL or just an image hosted on my website that will consume all my permitted ...
5
votes
3answers
821 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
5
votes
1answer
1k views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
5
votes
1answer
395 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
5
votes
3answers
3k views

My server is used for DDoS attacks

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user? What logs should I look to, is there any settings I can modify so such ...
5
votes
1answer
112 views

Is a ddos attack that makes ssh auth attempts a possible way for attackers to significantly impact your system?

I'm noticing on my digital ocean server, that I'm getting a high volume of auth attempts. I don't have any passwords since I use sshe key auth, so I'm not worried about a break in. But can a ...
5
votes
2answers
5k views

What approach would you choose to defend againt DDoS attacks from Nginx level?

I use Nginx compiled with the Naxsi module to protect against some vulnerabilities (SQL injection and cross-site scripting). Now I need to apply a layer of poor man's DDoS protection at this level. I ...
5
votes
1answer
555 views

How does a Distributed Denial Of Service Attack work

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do ...
5
votes
2answers
3k views

How to Secure a Stream from DDoSers?

I conduct a weekly live-stream using Google Hangouts that streams over YouTube. Recently, the stream has been attacked by DDoSers. In an attempt to thwart such attacks, I have tried to keep my IP ...
4
votes
6answers
929 views

Bot detecting by considering request inter-arrival time

If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time? When a user request for a page (page request), browser request for several ...
4
votes
4answers
3k views

How to mitigate SSL based DDoS attacks?

as you probably know the problem with SSL based DDoS attacks is, that the traffic cannot be analysed and filtered by a DDoS mitigation service provider such as Prolexic, Akamai, Radware, etc. without ...
4
votes
3answers
3k views

How will IPv6 affect DDoS mitigation techniques?

IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations? For example, ...
4
votes
4answers
7k views

Find out how my server is being used for DDOS attacks

I got an email from Amazon that my Amazon EC2 server is being used for DDoS attacks and they have closed all ports except SSH. This is tragical for me but I have not been able to find out how and ...
4
votes
4answers
5k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
3answers
468 views

How similar are bots regarding their HTTP GET request?

Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
4
votes
2answers
99 views

How do DoS attacks work on non-servers?

I understand how DoS/DDoS attacks work on servers. If I have not been misled, it is possible to DoS/DDoS a system that does not act as a server, but is still connected to the internet. How is this ...
4
votes
3answers
155 views

Where is the limit between an attacker and a victim (zombie) in a DDoS attack

Let's say that A is DDoSing B and I'm a member of his botnet. Who says that I'm not a real attacker but a victim? How you determine it?
4
votes
4answers
2k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
4
votes
1answer
160 views

Block this DDoS attack

since more than a week my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack, ovh don't care about it but this attack is killing my server with a high CPU load (permanent ...
4
votes
2answers
163 views

DDoS attack - where are packets dropped?

I'm researching into ddos attacks to get a better understanding. I've read lots from this community however one thing I couldn't get my head around is packet dropping. So lets say I've identified an ...
4
votes
1answer
924 views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
3
votes
4answers
2k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
3
votes
1answer
739 views

Are voluntary / manual DDoS illegal?

Since DDoS is simply a group of subjects coming together to send requests to a particular server, is it true to say that a voluntary DDoS is perfectly valid and legal in US? By that, I mean that a ...
3
votes
3answers
27k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
3
votes
1answer
311 views

Could Stock Exchange be shut down by HFT attack vector?

First of all, stock, not stack exchange. I just read this post on Krypt3ia. In short, it says that HFT attack vector in combination with DDoS is possible new nemesis for stock exchange IT systems. ...
3
votes
3answers
613 views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
3
votes
3answers
1k views

unknown MAC address in the LAN, DD-WRT router

I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
3
votes
1answer
80 views

How can CloudFlare save your website if the attacker knows the IP of the server?

I saw CloudFlare's services where you need to change the DNS of your domain name to their provided DNS address. The traffic coming as "mywebsite.com" goes through CloudFlare. What if I have a ...
3
votes
1answer
134 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
3
votes
2answers
404 views

If I send 4mbps of data to a friend with 4mbps connection, will I DDoS him?

Suppose my friend has a connection of 4mbps. If I just send him 4mpbs of random data with my server, wouldn't it block his connection? Even if the router has firewalls and closed ports, isn't enough ...
3
votes
1answer
1k views

Lots of failed outgoing sshd attempts. Am I hacked?

For the last two days I've been seeing lots of lines in my /var/log/auth.log that look like: sshd[xxxxx]: error: connect_to 0.gravatar.com port 80: failed sshd[xxxxx]: error: connect_to ...
3
votes
1answer
67 views

What's the best way to block all external proxy IP's which could be used for pivot points or as a DDOS Source?

At the simplest form - the question is to block external proxy due to an emergency situation due to which management have forced technical teams to get a solution to block all the external proxy or ...
3
votes
3answers
251 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
3
votes
1answer
143 views

DDoS Attack Protection

Recently I've been threatened with an IP Address DDoS attack. I was wondering in what ways and how could I stop this attack. I'd really like to be able to do this without my parents finding out.
3
votes
1answer
319 views

Is it possible to force client use TCP instead UDP for DNS queries?

Assume I am managing a firewall between DNS server and clients. Is there any way to force clients use TCP rather than UDP, so we can prevent DNS spoof types of DDoS attacks?
3
votes
2answers
3k views

Blocking incoming traffic from privileged port (< 1024) to mitigate DNS DDos Amplification attacks

Hope someone can clarify. As I understand, in a DNS DDos Amplification attacks Multiple DNS queries are sent to a vulnerable name server with the source IP spoofed to that of the target server. The ...
3
votes
1answer
89 views

DDoS Mitigation - Whitelist or Blacklist Incoming Ports?

For a network offering webservices, I have had recommendations to blacklist a couple of common incoming ports, such as UDP 53, to combat the increasing load from DDoS. I'm wondering if it makes more ...
3
votes
2answers
695 views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
2
votes
2answers
1k views

Am I allowed to DDoS my own server?

I have bought a server and used it to host some game servers or my website. Now I am visiting a computer security course and I would like to test some of the presented attacks. Am I allowed to, for ...
2
votes
2answers
3k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
2
votes
2answers
9k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
2
votes
2answers
484 views

Can an attacker slow down my server without compromising it?

We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now. Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...
2
votes
2answers
461 views

Will a DDOS attack prevent outbound traffic?

Imagine a scenario where there is a DDOS attack against a target - clients would be unable to connect to the target, but I would like to know if the target could initiate a connection to the outside, ...
2
votes
4answers
3k views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
2
votes
3answers
4k views

DDoS on LAN: How to Defend?

DDos on a wired network has to be extremely rare, since the intruder has to be physically connected to the network. However, let's say that it still managed to happen. How would you be able to defend ...
2
votes
2answers
4k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
2
votes
3answers
2k views

Can anyone DDOS my server with jmeter? Do they need a powerful server for that?

Is there a way to DDOS my web app through jMeter? Can anyone DDOS with a simple PC? I couldn't find any answer here. I would appreciate if anyone could help me out.