Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

2
votes
1answer
802 views

TCP syn attack prevention

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and ...
1
vote
2answers
9k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
1
vote
2answers
211 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
6
votes
5answers
3k views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
2
votes
5answers
1k views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
1
vote
1answer
172 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
-1
votes
1answer
221 views

If someone downloaded 600GB , can that be ddos attack [duplicate]

Last night some one exploit some vulnerability in my site and then upload php script in my images folder . I have the Amazon EC2 server with centos. Now the Hacker downloaded 600GB and increased my ...
3
votes
2answers
444 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
0
votes
1answer
102 views

Finding the method of attack [closed]

My server has been repeatedly attacked in the last few days. Here's the observations: The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
8
votes
2answers
619 views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
28
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
0
votes
1answer
177 views

Preventing DoS in Ajax Calls

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not. We have this URL exposed : https://mydomain.com/validateId?id=<user ...
0
votes
3answers
717 views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
5
votes
3answers
4k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
3
votes
1answer
1k views

how does a reflection attack work?

I am trying to understand reflection attacks but unfortunately wikipedia is too vague. I understand that in such an attack the attacker tries to authenticate with the target but does so in such a way ...
2
votes
1answer
3k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
8
votes
1answer
3k views

How can I stop this DOS attack?

I have this entry appearing constantly in my router logs: [DOS Attack] : 5 [RST Scan] packets detected in last 20 seconds, source ip [xx.xx.xx.xx] They just never stop. It doesn't seem to affect ...
15
votes
5answers
2k views

How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?

I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here. I ...
6
votes
3answers
473 views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
4
votes
2answers
247 views

Prevent DOS against RSA authentication

In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
4
votes
1answer
414 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
5
votes
1answer
262 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
1
vote
0answers
290 views

Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]

I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html I was reading... ...
-4
votes
1answer
1k views

DoSing my Home Network with only a Public IP address [closed]

+--------------------------------------------------------+ | Client Host Name |.. IP Address ..|.... MAC Address ...| | Desktop-Home ....| 192.168.1.100 | 00:19:D1:EA:03:68 | | GT-S5380K ...
1
vote
4answers
435 views

How a DOS TCP packet different from normal Packet?

a normal tcp packet shown in figure How a TCP packet that causes dos attack different from normal Tcp Packet?
2
votes
2answers
677 views

Does “loose source and record route” drop the source address?

Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur? It ...
2
votes
1answer
2k views

how does a sip flood attack work?

I understand that SIP is an application-level protocol that is used to setup/modify/end communication sessions for things like VOIP and instant messenger. I also understand that users can send request ...
1
vote
2answers
782 views

How to mitigate SIP Reflection Attacks?

SIP has a practical need to be widely available, but its services are prone to being spoofed as reflectors used in DDoS attacks. A freeswitch server I manage has seen heaps of registration requests ...
3
votes
1answer
185 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
21
votes
3answers
5k views

Preventing artificial latency or “Lag Hacking” in multiplayer games

There is an attack that some people have dubbed "lag hacking", and its gaining popularity in multiplayer games. There are at-least two ways of creating artificial latency. One method of introducing ...
10
votes
5answers
2k views

Apache/Linux server, DoS attack from own IP

I have an unusual problem I've been trying to diagnose for a while: It's about a Debian server running a custom compile of apache 2.2 with PHP, Red5, MySQL 5.5 (standard binary), sendmail (distro ...
1
vote
2answers
629 views

Secure against HTTP FLOOD ATTACK

What is the best way to defend your web site against HTTP FLOOD POST/GET ATTACK ?
3
votes
4answers
472 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
2
votes
4answers
7k views

Tools for performing HTTP FLOOD attack?

I'm looking for tools which can perform HTTP FLOOD ATTACK . I seached a lot and this is the only tool I've found DoSHTTP. Does anyone know another tool? I want to test them on my localhost to find ...
0
votes
2answers
225 views

Denial Of Service attack in asynchronous communication

Is Low rate DOS attack (unintended) possible through asynchronous communication? Consider this scenario: I have a client server application were there is a WAN communication between the client and ...
2
votes
3answers
1k views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
4
votes
3answers
12k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
2
votes
1answer
138 views

Reflection Attacks on Server

I was reading a research paper entitled "Steps to Defend Against DoS Attacks" when I came across this point: "A reflection attack on a server would require server-client-server communication, ...
15
votes
8answers
908 views

Bruteforce vs Denial of Service

I had a problem presented today which I found quite interesting. You have an application with a management panel. You know some of the accounts as they are standard. You want two things: You want ...
1
vote
1answer
116 views

How to know what's the type of an attack and from whom is sent?

I'm currently running a game server on a dedicated Windows 7 machine and it is being attacked. How do I know what kind of attack it is and from whom is sent? When he attacks, the RDP freezes and the ...
6
votes
2answers
564 views

Resource consumption attacks against algorithms

I am studying algorithm construction and weaknesses to resource consumption. One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability. The following quote was taken ...
2
votes
2answers
2k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
0
votes
1answer
164 views

DoS anomaly-based detection: simplest approach beside simple threshold

As I learned, there is this technique in which the number of bytes/packets/frames of aggregated traffic is being checked to see if they deviate from a normal behavior. Then the time slot of that ...
9
votes
1answer
14k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
1
vote
2answers
492 views

Securing anonymous accessible URL with a GUID segment?

In my problem there is an existing system that works as a alerting or clipping service that runs user defined searches and generates results lists. These are setup by authenticated users and this ...
6
votes
1answer
178 views

Parabolic Denial Of Service — Would it work?

Would this DoS attack be effective: Attacker determines target (10.0.0.1) Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1 Servers reply to 10.0.0.1 with syn packets ...
2
votes
2answers
811 views

Good steps to survive from denial-of-service attack (DoS attack)

I need to follow several steps to safe our Web Project from DoS attack. Is there any guideline / steps? EDIT : We have our own server where we are running several e-Commerce websites. Our server's ...
8
votes
1answer
1k views

Experience with a recent DDoS attack on Apache

I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
5
votes
5answers
1k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
11
votes
5answers
3k views

What is a DoS Attack and how does it differ from a DDoS attack?

Can some one explain to me the concept of Dos Attacks for web applications ? Also what is the distinction between Dos and Distributed Dos ( ie DDos) attacks ? Wikipedia says : In computing, a ...