Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

0
votes
0answers
27 views

Firewall best practice

I have to implement a firewall on a Mikrotik RouterBoard. What is a good way to do it? Here is my plan: Note: We are using an OpenVPN (bridge mode) server, a DHCP server, a PPPOE client, and an NTP ...
6
votes
1answer
84 views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
1
vote
2answers
44 views

Using pattern matching to make a port more secure

I am planning to make a web application deployed on a port more secure by detecting the pattern of the request an then comparing it with the patern next time that IP tries to connect.Any ways to move ...
2
votes
0answers
34 views

DoS stress test not working [closed]

First off I'd like to say this is my first post on StackExchange, so please let me know if there's anything wrong with it. Also, I don't know much about networking and I'm just making a simple java ...
1
vote
1answer
65 views

DOS safe alternative to delay response to an attacker with sleep()?

tl;dr sleep() costs my servers resources. Using it to delay response to the attacker might cost him/her time, but allows for DOS. Is it possible to keep him/her waiting without costs of mine? Long ...
8
votes
1answer
137 views

How to force “expensive calculation” when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. ...
0
votes
2answers
120 views

Can someone help? I'm getting Dossed!

So basically since a few days my internet started being very slow. I checked my router logs and guess what! In the log where it is a record of DoS attacks it showed something like |Description ...
2
votes
1answer
115 views

Does Windows 7 have built in wifi deauthentication attack protection?

I'm testing a wifi de-authentication attack and it looks like my Windows 7 client is not getting kicked off the network during the deauthentication. Any explanations as to why that might be? I've got ...
1
vote
1answer
131 views

How to prevent DHCP Starvation attack?

All this while, I assumed that switchport security is enough to prevent DHCP dos attack. If I set it maximum 1, there can be no more mac addresses packets. But, a friend told me that using the tool, ...
1
vote
0answers
129 views

Ping Of Death reconstruction against a Windows 95 virtual machine

For the sake of demonstration, I'm trying to perform a Ping Of Death sent from a Kali Linux virtual machine to a Windows 95 virtual machine (vmware) on a private network. I've set both vms correctly, ...
5
votes
3answers
484 views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
1
vote
1answer
208 views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
2
votes
3answers
262 views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
5
votes
2answers
144 views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
1
vote
0answers
82 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
1
vote
3answers
94 views

What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls?

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to ...
0
votes
1answer
57 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
-1
votes
2answers
117 views

Packet size and flood attacks

Do the attackers use small but a lot packets or big and some? e.g. 2 bytes or 512bytes? Also , can packet size affect the size/speed of the attack? Something more , how do the firewalls block dos ...
1
vote
1answer
136 views

How does a Distributed Denial Of Service Attack work

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do ...
3
votes
2answers
284 views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
0
votes
2answers
320 views

How to send GET/POST requests without header and agent information

I want to test our DOS prevention system against http requests that are not have header and agent information. Is there any tool I can do that. I tried siege with this command siege -c 3 -b -H ...
4
votes
2answers
207 views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
1
vote
1answer
133 views

How is DDoS different from DRDoS?

I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target. How is DRDoS different?
1
vote
1answer
252 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
0
votes
2answers
308 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
1
vote
1answer
109 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
1
vote
1answer
161 views

Possible DOS Attack? And solutions for it?

I don't know whether it's appropriate to post this question here but I desperately need help. I've been receiving ping requests from 18 different IP addresses so far. Some of them are local, some ...
2
votes
2answers
207 views

Why would Tor not be vulnerable to this easy-sounding attack?

I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple. Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given ...
2
votes
1answer
531 views

TCP syn attack prevention

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and ...
1
vote
2answers
6k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
1
vote
2answers
169 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
5
votes
7answers
2k views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
2
votes
5answers
922 views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
1
vote
1answer
145 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
-1
votes
1answer
182 views

If someone downloaded 600GB , can that be ddos attack [duplicate]

Last night some one exploit some vulnerability in my site and then upload php script in my images folder . I have the Amazon EC2 server with centos. Now the Hacker downloaded 600GB and increased my ...
3
votes
2answers
315 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
0
votes
1answer
89 views

Finding the method of attack [closed]

My server has been repeatedly attacked in the last few days. Here's the observations: The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
8
votes
2answers
508 views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
27
votes
3answers
1k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
0
votes
0answers
45 views

What Apache web server security pitfalls exist after a default installation? [duplicate]

Are there any crucial configuration changes that should be made to a fresh Apache web server install? If not, is the default installation of the web server relatively secure against exploits and DoS ...
0
votes
1answer
140 views

Preventing DoS in Ajax Calls

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not. We have this URL exposed : https://mydomain.com/validateId?id=<user ...
0
votes
3answers
537 views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
5
votes
3answers
3k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
2
votes
1answer
982 views

how does a reflection attack work?

I am trying to understand reflection attacks but unfortunately wikipedia is too vague. I understand that in such an attack the attacker tries to authenticate with the target but does so in such a way ...
2
votes
1answer
2k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
8
votes
1answer
2k views

How can I stop this DOS attack?

I have this entry appearing constantly in my router logs: [DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx] They just never stop. It doesn't seem to affect ...
15
votes
5answers
1k views

How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?

I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here. I ...
6
votes
3answers
440 views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
4
votes
2answers
233 views

Prevent DOS against RSA authentication

In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
3
votes
1answer
380 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...