Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks
69
votes
12answers
15k views
Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?
I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a ...
31
votes
6answers
6k views
What techniques do advanced firewalls use to protect againt DoS/DDoS?
It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
19
votes
2answers
2k views
How can a Software application defend against DoS or DDoS?
Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
18
votes
6answers
2k views
Why do DDoS attacks cost a fortune to stop?
I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions:
Is this because they try to keep the servers accessible to real site ...
15
votes
4answers
593 views
Global Blackout is a myth?
In order to shut the Internet down, anonymous claimed that putting-down the
13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
15
votes
3answers
942 views
DNS Amplification DDOS attack
During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
14
votes
7answers
954 views
Would it be possible to overload a large part of the internet, and if so then how?
Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the ...
13
votes
7answers
1k views
DDoS - Impossible to stop?
Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet.
But ...
11
votes
3answers
804 views
Accessing a site (which is) under a DDoS
Lets say http://www.an-example-site.com is under DDoS attack. Alice, who does not have direct access to the hardware infrastructure, urgently wants some information which can be accessed through the ...
11
votes
1answer
713 views
How to make a report after a ddos attack? what information do I need to write on the report?
In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff.
What do you think I need to write down in my report?
Is there any ...
10
votes
2answers
1k views
Reject IP packets with an ICMP error, or just drop them?
Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
9
votes
1answer
974 views
Effects of DDoS attacks on memory use under Linux
Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
8
votes
5answers
665 views
What is a DoS Attack and how does it differ from a DDoS attack?
Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says :
In computing, a ...
8
votes
4answers
2k views
Looking for botnet IP address feeds to protect against DDoS
I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
8
votes
2answers
1k views
How to test against DDoS in a controlled enviroment?
Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
7
votes
5answers
704 views
I have a client that is worried about DDOS attacks on their site, and they want penetration testing. Will that help?
My client wants to look into hiring a third party to perform penetration tests on the website that we're developing for them. The website is just a simple 3-month contest site where people can upload ...
7
votes
5answers
6k views
How do I know if my computer is being used for a botnet-based DDoS attack?
A botnet is a collection of compromised computers, each of which is
known as a 'bot', connected to the Internet. When a computer is
compromised by an attacker, there is often code within the ...
7
votes
2answers
3k views
Understanding Layer 7 DoS
I recently read this article about how a lone hacker (The Jester) conducts, amongst various other things, his DoS attacks over layer 7 instead of layer 4. It also mentions at one point he was able to ...
6
votes
4answers
512 views
How is a ddos simulation any different from a real attack?
I asked a question earlier today on serverfault, but found out that there was also a security stack exchange. I had conflicting answers from there. The following is the link:
...
6
votes
1answer
2k views
High concentration of UDP traffic, good or bad?
Should a network have a high concentration of UDP traffic compared to TCP traffic bad for a network especially in the context of network security?
I'm looking at my organization's network protocol ...
6
votes
3answers
232 views
Lessen impact of DoS attack on cpu-expensive login?
This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
5
votes
3answers
919 views
How are server overload and DoS/DDos different?
I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does ...
5
votes
2answers
3k views
How can I detect/withstand DNS amplification attack?
I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
5
votes
1answer
160 views
Parabolic Denial Of Service — Would it work?
Would this DoS attack be effective:
Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets
...
5
votes
2answers
2k views
How can I identify open DNS resolvers in my network?
This article highlights how open DNS resolvers are being used to create DDOS attacks across the internet. How can I identify whether any of our DNS servers are open? If I find that we are running ...
5
votes
1answer
565 views
I'm having a DDoS attack, my hosting company is stupid, and I need to know what is hapening
So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours.
I'm on a shared port, so I'm ...
5
votes
4answers
4k views
How to trace a DDOS attack on a dedicated server and block it?
I have a dedicated server and I'm hosting a game, and the web page (using Apache) for account registering.
The server is being ddosed since 8 months ago till today. I've tried to talk with the server ...
5
votes
2answers
372 views
How to Secure a Stream from DDoSers?
I conduct a weekly live-stream using Google Hangouts that streams over YouTube. Recently, the stream has been attacked by DDoSers. In an attempt to thwart such attacks, I have tried to keep my IP ...
4
votes
4answers
493 views
How does CAPTCHA mitigate DDoS attacks?
This seems like an easy question, but I've failed to find an answer.
One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
4
votes
6answers
262 views
Bot detecting by considering request inter-arrival time
If there are some chances to detect a bot by considering the users page viewing time, is it possible to measure this time?
When a user request for a page (page request), browser request for several ...
4
votes
5answers
817 views
SYN Flooding issue
I recently purchased a server with "DDoS protection" and a 1gbps uplink.
What I can't figure out, is that I'm suffering from SYN floods. Isn't the large amount of bandwidth available to me supposed ...
4
votes
8answers
5k views
How to simulate DDoS attacks from the Internet?
The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do ...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
4
votes
5answers
131 views
Why can we not block DNS Amplification attack by blocking UDP packets or DNS response packet?
I mean if the attacker tries to ask all the open DNS resolver respond to a web server. The web server can just block its UDP ports.
If the all the DNS response go to a Authoritative ...
4
votes
4answers
1k views
mitigating anonymous DOS (tor combined with pyloris)
I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources.
As a counter measure to Rsnake (Robert Hansen) slowloris.py ...
4
votes
4answers
1k views
Using SYN cookies to perform a DOS attack
In my software security class, we had this question:
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
4answers
769 views
Block all BotNets and TOR addresses from accessing our site
I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
4
votes
1answer
122 views
Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?
I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf
It's titled "Lazy Susan: dumb waiting as proof of work".
It suggested the following in section ...
4
votes
3answers
89 views
Where is the limit between an attacker and a victim (zombie) in a DDoS attack
Let's say that A is DDoSing B and I'm a member of his botnet. Who says that I'm not a real attacker but a victim? How you determine it?
4
votes
4answers
924 views
what is a good public available iptables script for ddos mitigation?
what is a good public available iptables script for ddos mitigation?
4
votes
1answer
328 views
Creating a DDoS attack using DirectConnect
I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
3
votes
6answers
350 views
how to mitigate a DDoS from botnet on your website that comes from random IPs
I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website.
If there was a consistent URL it was hitting then it would be fairly simple, and ...
3
votes
1answer
202 views
Could Stock Exchange be shut down by HFT attack vector?
First of all, stock, not stack exchange.
I just read this post on Krypt3ia. In short, it says that HFT attack vector in combination with DDoS is possible new nemesis for stock exchange IT systems. ...
3
votes
3answers
291 views
Is this a symptom of an attack (DoS/DDoS)?
I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one.
We have a search functionality in our website and the supposed attacker is ...
3
votes
3answers
241 views
How will IPv6 affect DDoS mitigation techniques?
IPv6 introduces a much larger address space than IPv4 and with it there are many new techniques in creating and mitigating DDoS attacks. What are some examples of risks and mitigations?
For example, ...
3
votes
3answers
170 views
How similar are bots regarding their HTTP GET request?
Lets assume a botnet is attacking a website by HTTP GET flooding. To find the bots, the only way seems to be finding the similarities of the HTTP GET requests considering the URL and header fields, ...
3
votes
1answer
853 views
My server is used for DDoS attacks
I have webserver (centos + cpanel), and one of the clients used my server for DDoS-ing, how can I identify that client/user?
What logs should I look to, is there any settings I can modify so such ...
3
votes
3answers
374 views
unknown MAC address in the LAN, DD-WRT router
I am using a linksys router with DD-WRT firmware with a WiBro internet connection, the ISP uses a hub with multiple user connected to it. The issue is that an unidentified MAC address seems to pop up ...
2
votes
4answers
518 views
Spider Attack from several search engines at once
Hello my server is getting hit by spiders from bingbot, google, yahoo, yandex, and some place in the UK all at the same time crashing it.
While I have no reason to think any one person did this, it ...
