Questions tagged [ddos]
Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks
505
questions
2
votes
0
answers
291
views
How to stop a DDoS attack that brought down my ISP
I'm streamer and I guess I'm good target for DDOS'ers. Those bad people know my ISP (but they don't know my IP address - ISP changed that for me when the first attack happened). It's a small local ISP ...
2
votes
3
answers
385
views
How to secure an email subscription endpoint?
I have a simple static webpage that lets users sign-up for a newsletter. Once they enter their email address, it gets sent to a public endpoint (AWS Lambda). This lambda function forwards the email ...
2
votes
0
answers
202
views
What attack-methods for HTTP/L7-Attacks (Reflection and Co.) are you aware of [closed]
I know the following and would like to collect some more methods on how to attack websites and services via misused 3rd-party-applications:
Wordpress PingBack/xmlrpc (seen a lot and wildly used)
...
2
votes
0
answers
161
views
Rogue Containment on a wired network (mostly)
I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
2
votes
0
answers
560
views
CPU load of iptables to deny IPs during DDoS event [closed]
If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3.
If someone identifies this external IP address, ...
2
votes
5
answers
161
views
Does services provided by different companies for DDoS protection work well?
Is it necessary to use any DDoS service provided by different web hosting provider and other people?
We know, they are running their business to provide security to thousands of web property. They are ...
2
votes
0
answers
969
views
DoS stress test not working [closed]
First off I'd like to say this is my first post on StackExchange, so please let me know if there's anything wrong with it. Also, I don't know much about networking and I'm just making a simple java ...
2
votes
0
answers
317
views
Snort Parallelization Techniques and its effect on DDOS detection capability [closed]
I want to ask a query about snort parallelization.
1) Can snort detection rate remains same for all attacks after parallelisation?
2) As the parallelisation of netowrk traffic in each core is based ...
1
vote
1
answer
1k
views
Coding to detect DDOS [closed]
I need to code a program in order to detect a DDOS attack. I'm not sure what's better:
1) use TCPDUMP in order to listen to the interface
2) code my own way to listen to the interface (using C ...
1
vote
2
answers
3k
views
DDoS -- null route everything not approved
Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour ...
1
vote
2
answers
3k
views
How can someone DDoS me?
If I've not opened the port 80, how can someone DDoS me?
Is there a method or is it possible?
Someone said that it's possible, but I'm not so sure, that's why I'm asking here.
1
vote
3
answers
1k
views
How to Stop DDoS Attacks by simple function on web server?
I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong.
Option 1
From the basic understanding of the DDOS attacks is that the attacker ...
1
vote
3
answers
426
views
Can a person be non-DDoSable? [closed]
I have a friend who claims he cannot be DDoSed by a conventional web booter.
We have tested this with him multiple times.
The public IP given to us when he joins a server, I.e. client connection ...
1
vote
2
answers
180
views
Are high traffic apps and websites used in DDoS attacks?
Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
1
vote
2
answers
119
views
Is DDoS a specific type of ALDoS
In a very broad terminology:
I understand Application Layer Denial of Service (ALDoS) to be a 1 machine on 1 machine attack.
I understand Distributed Denial of Service DDoS (DDoS) to be a 2 or more ...
1
vote
1
answer
593
views
Server get flooded by Avast Secure DNS
My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
1
vote
2
answers
1k
views
Will a DDOS attack prevent outbound traffic?
Imagine a scenario where there is a DDOS attack against a target - clients would be unable to connect to the target, but I would like to know if the target could initiate a connection to the outside, ...
1
vote
2
answers
315
views
I don't understand how BIPS got hacked [closed]
http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html
In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
1
vote
1
answer
438
views
Botnet Attempting to Login to Website
Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
1
vote
1
answer
179
views
DDoS using websites instead of bots?
What if a ddos attacker hits public websites (google, amazon etc) with some requests but spoofed the souce ip to the victim's ip. Now the responses will be sent to the victim's ip.
Attacker can rotate ...
1
vote
1
answer
4k
views
What is Ingress filtering and how does it work?
I know that Ingress filtering is used to try and verify that a packet actually came from the ip address that it claims to have come from. But how is it possible to verify this when all you have is the ...
1
vote
1
answer
162
views
What if IoT devices are fabricated with random passwords?
Considering the Dyn DDOS attack which was possible because the IoT devices have poor default passwords, will it be a solution if the company who produces the devices might generate random default ...
1
vote
2
answers
2k
views
Is port in UDP flood necessary? HTTP flood-down because? UDP, SYN and ICMP flood methods
I have questions about DDoS attacks.
In flood scripts, the script sends UDP packets to "ip.address:random.port"
Why It doesn't use only the IP? Is port necessary?
If someone is HTTP flooding a ...
1
vote
1
answer
3k
views
Best option for DDoS protection on DigitalOcean server?
I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data.
Is there a CDN that mitigates the security risks that CloudFlare imposes?
If not, is ...
1
vote
1
answer
346
views
Dealing with a DDoS: horizontal vs vertical scaling?
I'm reading this paper about DDoS protection in AWS. One of the benefits of EC2 is that depending on the instance, it can scale for minimizing the effect of the attack.
In the paper there are two ...
1
vote
2
answers
246
views
Infected employee using office VPN was part of a DDoS attack
Recently, our office VPN was taken down by our ISP after discovering a DDoS attack. Apparently an employee connected to our VPN is infected. There were no logs at the time of the event.
Besides ...
1
vote
2
answers
492
views
Is this a DDOS attack?
I lost my internet connection for about 15 minutes and I checked my netgear router log and found these 3:
[DoS Attack: ACK Scan] from source: 114.77.184.189, port 44822, Tuesday, March 24,2015 19:...
1
vote
3
answers
4k
views
How does blacklisting an IP using a firewall protect against DDoS attacks?
I just read that to protecting a server against a DDoS attack involves blacklisting IP addresses.
What does the term blacklisting mean?
What does it mean for a firewall to drop a connection?
How does ...
1
vote
2
answers
134
views
unprivileged or privileged malware for botnets
For those malwares which are used to organize botnets to DDOS a website, they just need to send and receive HTTP packets. Do they need to be privileged?
If they dont need to be privileged, is it true ...
1
vote
1
answer
391
views
Why are Bogons preferred in DDos attacks?
I am currently reading literature that states that Bogons are commonly used by attackers when conducting DDos attacks. I did some searching for an explanation and all I could find was that "...
1
vote
1
answer
183
views
Does a DDOS attack on an application using CDN have to first bring down all the involved CDN servers to affect the application's availability?
CDN are said to absorb and mitigate the Denial of Service and DDOS attacks. Consider an application that uses a CDN provider to deliver its content. So if an attacker tries to bring down such an ...
1
vote
1
answer
218
views
What is the purpose of this attack?
The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE
Notes:
The requests come from more than 5733 unique IP addresses
~2 requests per ...
1
vote
3
answers
168
views
How can cloud service providers know that they are being used for launching a DoS?
Can cloud service providers like Amazon, Microsoft etc. detect that they are being used to launch a DoS/DDoS against any target? If yes, how?
I am guessing that if they attack a single machine, a ...
1
vote
1
answer
787
views
DDoS attacks targeting Android
I am currently studying some Android topics and I've been having difficulties finding answers regarding DDoS attacks.
My question is:
Are Android devices vulnerable to DDoS attacks or does Android ...
1
vote
2
answers
2k
views
How to avoid DDOS against Kerberos Authentication Server
I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server).
It is already done and working, but i started thinking about how to protect the ...
1
vote
1
answer
330
views
Is my website under attack?
I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs.
Note: In the log report, I replace the name of my website with example.com and my second ...
1
vote
1
answer
212
views
Is a private VPS without a domain name and http entry likely to get DDOS'd for more than 5 hours?
I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program ...
1
vote
1
answer
139
views
Making website queries and return a large amount of data, can it be exploited for DOS attack?
I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
1
vote
1
answer
2k
views
Layer7 DDoS Protection vs WAF, which should I use?
I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions;
...
1
vote
1
answer
198
views
Best methods to mitigate DDOS with changing IP sources
Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
1
vote
2
answers
158
views
Is the idea of a hosting provider with built-in DDoS protection plausible? [closed]
Any PaaS/shared hosting company which I came across offers its customers to protect their websites from DDoS via security-oriented CDNs such as CloudFlare or CloudFront which act as a proxy ...
1
vote
1
answer
412
views
Avoid strong password hashing functions aiding a DDoS attempt on oneself [duplicate]
While reading this question, it got me to thinking.
Let's say an attacker has some way to make all of their login attempts appear legitimate - enough IP addresses to never reuse them, different valid ...
1
vote
1
answer
217
views
UDP amplification: length(response_packet) < length(request_packet)
I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
1
vote
2
answers
2k
views
How fill up a gig interface bandwidth with hping3?
I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
1
vote
2
answers
304
views
Please help diagnose multiple incoming packets
We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information:
All the packet size is same (i.e. 40 bytes)
All ...
1
vote
1
answer
189
views
How link flooding DDoS attack remain undetected?
I read some explains or paper about link flooding DDoS attack, which is new relatively.
For example
"employs legitimate, low-density flows to flood a group of selected links. Therefore, these ...
1
vote
2
answers
305
views
Are HTTP calls from hundreds of ips in the same subnet malicious?
I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources.
I found by running a match in redis (where all requests from the last 24hrs ...
1
vote
2
answers
4k
views
DDOS attacks and multi-threading
Does a host create a separate thread for each TCP SYN request? Or it depends on the socket implementation for the host?
1
vote
2
answers
173
views
How can perpertrators of denial of service attacks, determine the impact their attack has had?
Although I know how a user could mitigate Dos attacks and detect their presence e.g. checking packets received and sent, comparing current CPU usage to normal, comparing network usage to normal etc.
...
1
vote
2
answers
189
views
Hosting multiple websites on the same server - Prevention from DoS
I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a ...