Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

2
votes
2answers
3k views

IPTables DDoS protection working with per client IP address counter AND UDP

I am looking to protect LAMP server with a software, which will detect above average number of requests from single IP numbers (in this case DNS queries), and add these hosts to IPTables deny chain. ...
2
votes
2answers
2k views

DDoS Protection for DNS providers

Zerigo, our DNS provider has reported to have been under heavy DDOS attack in the last 24 hours or so. Considering the distributed nature of DNS, and their architecture consisting of 5 main DNS ...
2
votes
1answer
127 views

Types of attacks outside of AppSec and Vendor-Specific Systems?

I'm reading up on the OWASP Top 10 for helping me defend my web app against common "app sec"-type attacks (SQL Injection, CSRF, etc.). And in a recent question I was prompted to not only use OWASP Top ...
2
votes
4answers
1k views

Spider Attack from several search engines at once

Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it. While I have no reason to think any one person did this, it ...
0
votes
2answers
96 views

Looking for information about CVE-2006-6876 vulnerability

In order to study vulnerabilities of a SIP server and the impacts of DOS attacks on the QoS of VoIP service, I have found this vulnerability which can be exploited to cause DoS on SIP server. But I ...
-2
votes
1answer
708 views

Linux tools to choose suitable Cisco ASA 5500

I have a linux webhosting server which affects a high DDOS. I want to use Cisco ASA 5500 Series Adaptive Security Appliances to protect the linux server from this DDOS. I know there are many factors ...
4
votes
5answers
1k views

SYN Flooding issue

I recently purchased a server with "DDoS protection" and a 1gbps uplink. What I can't figure out, is that I'm suffering from SYN floods. Isn't the large amount of bandwidth available to me supposed ...
7
votes
5answers
10k views

How to trace a DDOS attack on a dedicated server and block it?

I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering. The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
2
votes
2answers
1k views

Protection against DDoS when using proxies

We're trying to protect some sites that are primarily located in Asia using distributed caching. These sites commonly come under DDOS attacks. We are using fail2ban, but still have two problems: ...
20
votes
6answers
3k views

Why do DDoS attacks cost a fortune to stop?

I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions: Is this because they try to keep the servers accessible to real site ...
1
vote
2answers
6k views

How to conduct DDoS attack practically? [duplicate]

Possible Duplicate: How to simulate DDoS attacks from the Internet? I want to conduct a DDoS attack. Can anyone please tell how can i conduct it? What are the latest DDos attacks? What are ...
6
votes
4answers
3k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
4
votes
4answers
3k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
5
votes
2answers
6k views

How can I detect/withstand DNS amplification attack?

I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
11
votes
6answers
27k views

How do I know if my computer is being used for a botnet-based DDoS attack?

A botnet is a collection of compromised computers, each of which is known as a 'bot', connected to the Internet. When a computer is compromised by an attacker, there is often code within the ...
9
votes
2answers
6k views

Understanding Layer 7 DoS

I recently read this article about how a lone hacker (The Jester) conducts, amongst various other things, his DoS attacks over layer 7 instead of layer 4. It also mentions at one point he was able to ...
10
votes
1answer
2k views

Effects of DDoS attacks on memory use under Linux

Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
5
votes
3answers
556 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
2
votes
1answer
2k views

How should I configure a Citrix Netscaler to protect against HTTP, TCP, or UDP flood attacks?

I have a Citrix Netscaler and want to configure the appliance appropriately so that it can protect my hosts from a DDOS. Is this something I can do here, or must I take action on the host itself?
1
vote
2answers
2k views

How much does it cost to protect your website against DDOS, by tier?

Cross-posted to Quora Today several financial institutes in Israel (banks, stock exchange) were DDOSed. They decided to block all foreign IPs as a first aid measure. While I agree that it was ...
4
votes
2answers
2k views

My server is used for DDoS attacks

I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user? What logs should I look to, is there any settings I can modify so such ...
6
votes
4answers
786 views

How is a ddos simulation any different from a real attack?

I asked a question earlier today on serverfault, but found out that there was also a security stack exchange. I had conflicting answers from there. The following is the link: ...
2
votes
2answers
4k views

what is the Akamai Name Server i see at some big companies

I have played with DNS a lot lately, and i have found that some big companies's web sites uses the Akamai NS as the Name Server for thier WWW servers, for example: $>nslookup > www.redhat.com ...
5
votes
3answers
2k views

How are server overload and DoS/DDos different?

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does ...
5
votes
1answer
824 views

I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
17
votes
5answers
14k views

How to simulate DDoS attacks from the Internet?

The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
13
votes
3answers
2k views

Accessing a site (which is) under a DDoS

Lets say http://www.an-example-site.com is under DDoS attack. Alice, who does not have direct access to the hardware infrastructure, urgently wants some information which can be accessed through the ...
3
votes
1answer
235 views

Could Stock Exchange be shut down by HFT attack vector?

First of all, stock, not stack exchange. I just read this post on Krypt3ia. In short, it says that HFT attack vector in combination with DDoS is possible new nemesis for stock exchange IT systems. ...
10
votes
4answers
5k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
22
votes
3answers
4k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
4
votes
4answers
2k views

what is a good public available iptables script for ddos mitigation?

what is a good public available iptables script for ddos mitigation?
13
votes
2answers
4k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
6
votes
1answer
4k views

High concentration of UDP traffic, good or bad?

Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security? I'm looking at my organization's network protocol ...
12
votes
1answer
999 views

How to make a report after a ddos attack? what information do I need to write on the report?

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff. What do you think I need to write down in my report? Is there any ...
84
votes
12answers
23k views

Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?

I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a ...
11
votes
2answers
2k views

How to test against DDoS in a controlled enviroment?

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
24
votes
2answers
2k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
39
votes
6answers
12k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...