Questions tagged [ddos]

Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

Filter by
Sorted by
Tagged with
2 votes
0 answers
291 views

How to stop a DDoS attack that brought down my ISP

I'm streamer and I guess I'm good target for DDOS'ers. Those bad people know my ISP (but they don't know my IP address - ISP changed that for me when the first attack happened). It's a small local ISP ...
CospriMalice's user avatar
2 votes
3 answers
385 views

How to secure an email subscription endpoint?

I have a simple static webpage that lets users sign-up for a newsletter. Once they enter their email address, it gets sent to a public endpoint (AWS Lambda). This lambda function forwards the email ...
Saul's user avatar
  • 21
2 votes
0 answers
202 views

What attack-methods for HTTP/L7-Attacks (Reflection and Co.) are you aware of [closed]

I know the following and would like to collect some more methods on how to attack websites and services via misused 3rd-party-applications: Wordpress PingBack/xmlrpc (seen a lot and wildly used) ...
that guy from over there's user avatar
2 votes
0 answers
161 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
Charles's user avatar
  • 258
2 votes
0 answers
560 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
Wadih M.'s user avatar
  • 1,132
2 votes
5 answers
161 views

Does services provided by different companies for DDoS protection work well?

Is it necessary to use any DDoS service provided by different web hosting provider and other people? We know, they are running their business to provide security to thousands of web property. They are ...
Nab's user avatar
  • 29
2 votes
0 answers
969 views

DoS stress test not working [closed]

First off I'd like to say this is my first post on StackExchange, so please let me know if there's anything wrong with it. Also, I don't know much about networking and I'm just making a simple java ...
user19262's user avatar
2 votes
0 answers
317 views

Snort Parallelization Techniques and its effect on DDOS detection capability [closed]

I want to ask a query about snort parallelization. 1) Can snort detection rate remains same for all attacks after parallelisation? 2) As the parallelisation of netowrk traffic in each core is based ...
Amtul's user avatar
  • 21
1 vote
1 answer
1k views

Coding to detect DDOS [closed]

I need to code a program in order to detect a DDOS attack. I'm not sure what's better: 1) use TCPDUMP in order to listen to the interface 2) code my own way to listen to the interface (using C ...
Paulo's user avatar
  • 119
1 vote
2 answers
3k views

DDoS -- null route everything not approved

Is it possible to create a route on your internet router which routes traffic unknown to null. So you basically dont even let traffic route into your firewall unless its approved? Can this help detour ...
Jon_Little-Sec Engineer's user avatar
1 vote
2 answers
3k views

How can someone DDoS me?

If I've not opened the port 80, how can someone DDoS me? Is there a method or is it possible? Someone said that it's possible, but I'm not so sure, that's why I'm asking here.
James Dake's user avatar
1 vote
3 answers
1k views

How to Stop DDoS Attacks by simple function on web server?

I have an overview ideas of the preventing ddos attacks, in a simple way. Please clarify me, if my thinking is wrong. Option 1 From the basic understanding of the DDOS attacks is that the attacker ...
Cin Sb Sangpi's user avatar
1 vote
3 answers
426 views

Can a person be non-DDoSable? [closed]

I have a friend who claims he cannot be DDoSed by a conventional web booter. We have tested this with him multiple times. The public IP given to us when he joins a server, I.e. client connection ...
user141344's user avatar
1 vote
2 answers
180 views

Are high traffic apps and websites used in DDoS attacks?

Isn't it very simple for one rogue programmer in a big institution to add a small code change in the application/website thereby sending unintended HTTP DDoS attacks? Like is it possible for Tiktok/...
Vishwa Mithra's user avatar
1 vote
2 answers
119 views

Is DDoS a specific type of ALDoS

In a very broad terminology: I understand Application Layer Denial of Service (ALDoS) to be a 1 machine on 1 machine attack. I understand Distributed Denial of Service DDoS (DDoS) to be a 2 or more ...
Arcticooling's user avatar
1 vote
1 answer
593 views

Server get flooded by Avast Secure DNS

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the ...
JazZ's user avatar
  • 121
1 vote
2 answers
1k views

Will a DDOS attack prevent outbound traffic?

Imagine a scenario where there is a DDOS attack against a target - clients would be unable to connect to the target, but I would like to know if the target could initiate a connection to the outside, ...
user2813274's user avatar
  • 2,071
1 vote
2 answers
315 views

I don't understand how BIPS got hacked [closed]

http://www.networkworld.com/news/2013/112513-bitcoin-robbery-276352.html In this story we can see BIPS got hacked, but I don't get how it was hacked when it was offline because of the DDoS.
Johny's user avatar
  • 21
1 vote
1 answer
438 views

Botnet Attempting to Login to Website

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely ...
jwegner's user avatar
  • 411
1 vote
1 answer
179 views

DDoS using websites instead of bots?

What if a ddos attacker hits public websites (google, amazon etc) with some requests but spoofed the souce ip to the victim's ip. Now the responses will be sent to the victim's ip. Attacker can rotate ...
Mani Bharathy's user avatar
1 vote
1 answer
4k views

What is Ingress filtering and how does it work?

I know that Ingress filtering is used to try and verify that a packet actually came from the ip address that it claims to have come from. But how is it possible to verify this when all you have is the ...
user3685285's user avatar
1 vote
1 answer
162 views

What if IoT devices are fabricated with random passwords?

Considering the Dyn DDOS attack which was possible because the IoT devices have poor default passwords, will it be a solution if the company who produces the devices might generate random default ...
Vini7's user avatar
  • 659
1 vote
2 answers
2k views

Is port in UDP flood necessary? HTTP flood-down because? UDP, SYN and ICMP flood methods

I have questions about DDoS attacks. In flood scripts, the script sends UDP packets to "ip.address:random.port" Why It doesn't use only the IP? Is port necessary? If someone is HTTP flooding a ...
imafunnypanda's user avatar
1 vote
1 answer
3k views

Best option for DDoS protection on DigitalOcean server?

I would not like to use CloudFlare since they effectively act as a man in the middle and handle unencrypted data. Is there a CDN that mitigates the security risks that CloudFlare imposes? If not, is ...
Jay Welsh's user avatar
  • 425
1 vote
1 answer
346 views

Dealing with a DDoS: horizontal vs vertical scaling?

I'm reading this paper about DDoS protection in AWS. One of the benefits of EC2 is that depending on the instance, it can scale for minimizing the effect of the attack. In the paper there are two ...
user avatar
1 vote
2 answers
246 views

Infected employee using office VPN was part of a DDoS attack

Recently, our office VPN was taken down by our ISP after discovering a DDoS attack. Apparently an employee connected to our VPN is infected. There were no logs at the time of the event. Besides ...
Julian J's user avatar
1 vote
2 answers
492 views

Is this a DDOS attack?

I lost my internet connection for about 15 minutes and I checked my netgear router log and found these 3: [DoS Attack: ACK Scan] from source: 114.77.184.189, port 44822, Tuesday, March 24,2015 19:...
Jxrgen's user avatar
  • 11
1 vote
3 answers
4k views

How does blacklisting an IP using a firewall protect against DDoS attacks?

I just read that to protecting a server against a DDoS attack involves blacklisting IP addresses. What does the term blacklisting mean? What does it mean for a firewall to drop a connection? How does ...
sushil chhetri's user avatar
1 vote
2 answers
134 views

unprivileged or privileged malware for botnets

For those malwares which are used to organize botnets to DDOS a website, they just need to send and receive HTTP packets. Do they need to be privileged? If they dont need to be privileged, is it true ...
RandyTek's user avatar
  • 141
1 vote
1 answer
391 views

Why are Bogons preferred in DDos attacks?

I am currently reading literature that states that Bogons are commonly used by attackers when conducting DDos attacks. I did some searching for an explanation and all I could find was that "...
rlon134's user avatar
  • 75
1 vote
1 answer
183 views

Does a DDOS attack on an application using CDN have to first bring down all the involved CDN servers to affect the application's availability?

CDN are said to absorb and mitigate the Denial of Service and DDOS attacks. Consider an application that uses a CDN provider to deliver its content. So if an attacker tries to bring down such an ...
adi's user avatar
  • 11
1 vote
1 answer
218 views

What is the purpose of this attack?

The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE Notes: The requests come from more than 5733 unique IP addresses ~2 requests per ...
Jack Palkens's user avatar
1 vote
3 answers
168 views

How can cloud service providers know that they are being used for launching a DoS?

Can cloud service providers like Amazon, Microsoft etc. detect that they are being used to launch a DoS/DDoS against any target? If yes, how? I am guessing that if they attack a single machine, a ...
Limit's user avatar
  • 3,266
1 vote
1 answer
787 views

DDoS attacks targeting Android

I am currently studying some Android topics and I've been having difficulties finding answers regarding DDoS attacks. My question is: Are Android devices vulnerable to DDoS attacks or does Android ...
GilCol's user avatar
  • 113
1 vote
2 answers
2k views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
Snox's user avatar
  • 191
1 vote
1 answer
330 views

Is my website under attack?

I have a web server. I was investigting why my nginx is keep crashing. I noticed a few other issues in my logs. Note: In the log report, I replace the name of my website with example.com and my second ...
martiz's user avatar
  • 11
1 vote
1 answer
212 views

Is a private VPS without a domain name and http entry likely to get DDOS'd for more than 5 hours?

I have written lots of client-side code but with no server-side experience, and I am planning to get a VPS for a new project. The VPS will receive encrypted data directly from a distributed program ...
Sherry869's user avatar
  • 145
1 vote
1 answer
139 views

Making website queries and return a large amount of data, can it be exploited for DOS attack?

I am testing a website (bug bounty website) and found an endpoint like replycomment?cmt_id[]=1. When open on browser, this endpoint let me reply to comment with id 1 by fetching this comment into a ...
trieulieuf9's user avatar
1 vote
1 answer
2k views

Layer7 DDoS Protection vs WAF, which should I use?

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions; ...
banker's user avatar
  • 113
1 vote
1 answer
198 views

Best methods to mitigate DDOS with changing IP sources

Source ip addresses can be spoofed. And because of IPv6 it is not enough to keep a look-up table of ip addresses that are excluded from visiting a website, because with ipv6 there are now enough ip ...
user1709076's user avatar
1 vote
2 answers
158 views

Is the idea of a hosting provider with built-in DDoS protection plausible? [closed]

Any PaaS/shared hosting company which I came across offers its customers to protect their websites from DDoS via security-oriented CDNs such as CloudFlare or CloudFront which act as a proxy ...
Semo's user avatar
  • 13
1 vote
1 answer
412 views

Avoid strong password hashing functions aiding a DDoS attempt on oneself [duplicate]

While reading this question, it got me to thinking. Let's say an attacker has some way to make all of their login attempts appear legitimate - enough IP addresses to never reuse them, different valid ...
Adam Barnes's user avatar
1 vote
1 answer
217 views

UDP amplification: length(response_packet) < length(request_packet)

I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
CharlieBucket's user avatar
1 vote
2 answers
2k views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
N00000000000000000p's user avatar
1 vote
2 answers
304 views

Please help diagnose multiple incoming packets

We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information: All the packet size is same (i.e. 40 bytes) All ...
Nick's user avatar
  • 13
1 vote
1 answer
189 views

How link flooding DDoS attack remain undetected?

I read some explains or paper about link flooding DDoS attack, which is new relatively. For example "employs legitimate, low-density flows to flood a group of selected links. Therefore, these ...
TJCLK's user avatar
  • 838
1 vote
2 answers
305 views

Are HTTP calls from hundreds of ips in the same subnet malicious?

I've been getting hit everyday with 50-100M calls to my API and I'm trying to identify the subnets that are the sources. I found by running a match in redis (where all requests from the last 24hrs ...
Jonathan's user avatar
  • 121
1 vote
2 answers
4k views

DDOS attacks and multi-threading

Does a host create a separate thread for each TCP SYN request? Or it depends on the socket implementation for the host?
Rads's user avatar
  • 125
1 vote
2 answers
173 views

How can perpertrators of denial of service attacks, determine the impact their attack has had?

Although I know how a user could mitigate Dos attacks and detect their presence e.g. checking packets received and sent, comparing current CPU usage to normal, comparing network usage to normal etc. ...
information's user avatar
1 vote
2 answers
189 views

Hosting multiple websites on the same server - Prevention from DoS

I have an server which contains around 4 instances hosted on it. I am aware that if a DoS attack happens on one of the instances it will take down all the other instances too. How to prevent such a ...
Anonymous Platypus's user avatar

1
4 5
6
7 8
11