Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks
5
votes
3answers
184 views
How to block an IP, if getting many http requests in a second
If some one tried force burst attack on my website, how can I block them?
I mean, I want to block an IP if I have many http/Apache requests in a second.
Thanks in advance.
2
votes
1answer
114 views
how does a reflection attack work?
I am trying to understand reflection attacks but unfortunately wikipedia is too vague. I understand that in such an attack the attacker tries to authenticate with the target but does so in such a way ...
1
vote
1answer
196 views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
6
votes
1answer
268 views
How can I stop this DOS attack?
I have this entry appearing constantly in my router logs:
[DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx]
They just never stop. It doesn't seem to affect ...
7
votes
3answers
595 views
How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?
I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here.
I ...
6
votes
3answers
232 views
Lessen impact of DoS attack on cpu-expensive login?
This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
4
votes
2answers
90 views
Prevent DOS against RSA authentication
In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
3
votes
1answer
163 views
Measuring SNR to detect jammers in Wi-Fi networks
I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into
locating the location of the jammer but rather detect the jamming signal. How do i do so using
only ...
4
votes
1answer
122 views
Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?
I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf
It's titled "Lazy Susan: dumb waiting as proof of work".
It suggested the following in section ...
1
vote
0answers
79 views
Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]
I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC
It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html
I was reading... ...
-4
votes
1answer
193 views
DoSing my Home Network with only a Public IP address [closed]
+--------------------------------------------------------+
| Client Host Name |.. IP Address ..|.... MAC Address ...|
| Desktop-Home ....| 192.168.1.100 | 00:19:D1:EA:03:68 |
| GT-S5380K ...
1
vote
4answers
122 views
How a DOS TCP packet different from normal Packet?
a normal tcp packet shown in figure
How a TCP packet that causes dos attack different from normal Tcp Packet?
33
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
2
votes
2answers
100 views
Does “loose source and record route” drop the source address?
Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur?
It ...
3
votes
1answer
127 views
how does a sip flood attack work?
I understand that SIP is an application-level protocol that is used to setup/modify/end communication sessions for things like VOIP and instant messenger. I also understand that users can send request ...
1
vote
2answers
165 views
How to mitigate SIP Reflection Attacks?
SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks.
A freeswitch server I manage has seen heaps of registration requests ...
1
vote
1answer
55 views
Why should an IKE responder change the cookie secret 'frequently'?
IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses:
Two expected attacks against IKE are state and CPU ...
19
votes
3answers
722 views
Preventing artificial latency or “Lag Hacking” in multiplayer games
There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
8
votes
5answers
526 views
Apache/Linux server, DoS attack from own IP
I have an unusual problem I've been trying to diagnose for a while:
It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
1
vote
2answers
219 views
Secure against HTTP FLOOD ATTACK
What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
3
votes
4answers
226 views
How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
2
votes
3answers
634 views
Tools for performing HTTP FLOOD attack?
I'a looking for tools which can perform HTTP FLOOD ATTACK .
I seached a lot and this is the only tool I've found DoSHTTP.
Does anyone know another tool ?
I want to test them on my localhost to ...
0
votes
2answers
110 views
Denial Of Service attack in asynchronous communication
Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario:
I have a client server application were there is a WAN communication between the client and ...
1
vote
3answers
403 views
Disadvantages of HTTP GET/POST Flooding Attack?
I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work.
Now I want to find out what are the disadvantages of them.
1
vote
3answers
1k views
What is HTTP GET/POST Flooding Attack?
I want to know what is HTTP GET/POST flood attack and what are their major differences and mitigation strategies ?
I searched a lot but I really can't find some good articles nor examples about this ...
2
votes
1answer
110 views
Reflection Attacks on Server
I was reading a research paper entitled "Steps to Defend Against DoS Attacks" when I came across this point:
"A reflection attack on a server would require server-client-server
communication, ...
14
votes
8answers
552 views
Bruteforce vs Denial of Service
I had a problem presented today which I found quite interesting.
You have an application with a management panel. You know some of the accounts as they are standard. You want two things:
You want ...
1
vote
1answer
106 views
How to know what's the type of an attack and from whom is sent?
I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked.
How do I know what kind of attack it is and from whom is sent?
When he attacks, the RDP freezes and the ...
5
votes
2answers
289 views
Resource consumption attacks against algorithms
I am studying algorithm construction and weaknesses to resource consumption. One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability. The following quote was taken ...
1
vote
2answers
456 views
What approaches are to detect DoS attack in IDS/Firewall?
First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
0
votes
1answer
108 views
DoS anomaly-based detection: simplest approach beside simple threshold
As I learned, there is this technique in which the number of bytes/packets/frames of aggregated traffic is being checked to see if they deviate from a normal behavior. Then the time slot of that ...
5
votes
1answer
4k views
TCP Peer unexpectedly shrunk window messages in dmesg log
We get quite few messages like these in our dmesg log on various servers.
TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired)
TCP: ...
0
votes
2answers
223 views
Securing anonymous accessible URL with a GUID segment?
In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
5
votes
1answer
160 views
Parabolic Denial Of Service — Would it work?
Would this DoS attack be effective:
Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets
...
1
vote
2answers
264 views
Good steps to survive from denial-of-service attack (DoS attack)
I need to follow several steps to safe our Web Project from DoS attack.
Is there any guideline / steps?
EDIT : We have our own server where we are running several e-Commerce websites. Our server's ...
6
votes
1answer
611 views
Experience with a recent DDoS attack on Apache
I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
4
votes
4answers
493 views
How does CAPTCHA mitigate DDoS attacks?
This seems like an easy question, but I've failed to find an answer.
One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
8
votes
5answers
665 views
What is a DoS Attack and how does it differ from a DDoS attack?
Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says :
In computing, a ...
2
votes
2answers
185 views
Can an attacker slow down my server without compromising it?
We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now.
Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
12
votes
3answers
537 views
Should you care about DoS attacks if your server is using bcrypt?
(I just asked this question on "cryptography SE" and was suggested to ask it here instead)
EDIT I just realized my question is mostly a dupe of: Prevent denial of service attacks against slow hashing ...
15
votes
4answers
593 views
Global Blackout is a myth?
In order to shut the Internet down, anonymous claimed that putting-down the
13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
3
votes
1answer
68 views
SSL Based Denial of Services due to Message Digest
On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent.
However, the question I have in mind is :
How does SSL ensure a DoS does not happen ...
4
votes
4answers
1k views
mitigating anonymous DOS (tor combined with pyloris)
I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources.
As a counter measure to Rsnake (Robert Hansen) slowloris.py ...
9
votes
1answer
332 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
-3
votes
1answer
138 views
Why would you want to initiate a DoS attack on a system you are testing?
What is the value of a DoS attack as part of a security assessment? this is the question asked to me in EC council's exam preparation, so need to know. not intending any attack
5
votes
4answers
507 views
How can one defend against DoS attacks at the physical layer?
Of course, there's always the odd issue of old microwaves and wireless telephone handsets interfering with Wi-Fi performance. And, in many areas, there's a fair chance that you're going to have to ...
0
votes
3answers
277 views
Is it possible to “close” a port by dos'ing it?
If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?
2
votes
3answers
173 views
Denial of Service on SSL services
When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server?
Could such an imbalance be ...
1
vote
1answer
145 views
Is a multitenant web app built on Apache Cassandra more resilient against DoS attacks?
Imagine a multitenant web app that stores data in a Apache Cassandra cluster, with fairly many nodes.
Now assume that:
Mallory launches a DoS attack against one tenant. (Perhaps that tenant is a ...
