Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

5
votes
3answers
415 views

DoS by consuming all hosting trafic

Given a small website hosted on a small data plan, is it possible for someone to keep doing requesting for my website URL or just an image hosted on my website that will consume all my permitted ...
5
votes
3answers
677 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
5
votes
1answer
331 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
4
votes
3answers
7k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
4
votes
1answer
1k views

Can this be a DoS Attack?

When I'm checking my log, I found like 15k events of " PAM service(sshd) ignoring max retries; 6 > 3 " I know this might be normal, and considered as Brute-Force attack, but can it be classified as ...
4
votes
2answers
206 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
4
votes
2answers
2k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
4
votes
4answers
4k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
1answer
429 views

How does a Distributed Denial Of Service Attack work

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do ...
4
votes
2answers
296 views

Prevent DOS against RSA authentication

In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
4
votes
1answer
584 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
4
votes
1answer
139 views

DOS safe alternative to delay response to an attacker with sleep()?

tl;dr sleep() costs my servers resources. Using it to delay response to the attacker might cost him/her time, but allows for DOS. Is it possible to keep him/her waiting without costs of mine? Long ...
4
votes
1answer
39 views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
4
votes
0answers
101 views

What to do if I accidentally DoS a site? [closed]

A few weeks ago I was non-maliciously using a website with server-side calculations when curiosity got the better of me and I decided to mess with some GET request values. I expected the site to give ...
3
votes
2answers
741 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
3
votes
2answers
22k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
3
votes
5answers
3k views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
3
votes
4answers
567 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
3
votes
1answer
335 views

Could somebody explain connect loop DoS?

I'm trying to understand this vulnerability. How can I reproduce this?
3
votes
2answers
88 views

Is radio burst transmission really “jam resistant”?

Quoted from here: Certain military communication systems are based on the jam-resistant burst transmission of binary telegrams which consist of orthogonal spread-spectrum waveforms (BOK). To ...
3
votes
2answers
96 views

DoS attacks and bitcoin

I was wondering what the repercussions were if a Bitcoin exchange or website that holds bitcoins were to succumb to a DoS attack. In my understanding, all a denial-of-service attack does is deny ...
3
votes
3answers
8k views

Is it safe to ignore DoS attacks on my router?

There are several entries in my router's log file showing recent DoS attempts on some of its ports. They look like this: [DoS Attack: ACK Scan] from source: 213.61.245.234, port 80, Friday, November ...
3
votes
1answer
318 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
3
votes
1answer
73 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: ...
3
votes
1answer
303 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
3
votes
2answers
173 views

What is this strange GET request (GET /A0A32579-2767) DoSed my apache?

I have apache behind nginx on my webserver. Today my apache stops answering to requests. Investigations shows this situation: Number of apache processes grows more that 500 but MaxChildren=256 in ...
3
votes
1answer
96 views

SSL Based Denial of Services due to Message Digest

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen ...
3
votes
2answers
87 views

Content management url security

I manage a website that is a "bad magnet" for our competitors. I am using Incapsula CDN + WAF and I have internal proxy for caching. CMS/WP from its nature is very data consuming, I have check ...
3
votes
1answer
552 views

What is DDOS TCP KILL?

I've recently been introduced to Kali Linux's webkiller tool, located in the websploit category. It works on the concept of Tcpkill. I don't understand how the DoS attack with Tcpkill works. Can ...
3
votes
1answer
452 views

De-auth attack Reason codes and possible reaction

I am learning about Deauth attacks and how they work. I see that the Deauth frame has a reason code which indicates the reason for the deauth. I have tested the attack with aircrack-ng and this reason ...
3
votes
1answer
462 views

What type of attacks will a SMTP server face if it does not have ratelimiting while sending mails?

Assume a web site with some kind of mailer option, that doesn't implement any rate limiting: This enables users to send an unlimited amount of email per second. Will SMTP face possible DoS attacks ...
3
votes
2answers
210 views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?
2
votes
4answers
13k views

Tools for performing HTTP FLOOD attack?

I'm looking for tools which can perform HTTP FLOOD ATTACK . I seached a lot and this is the only tool I've found DoSHTTP. Does anyone know another tool? I want to test them on my localhost to find ...
2
votes
2answers
240 views

Why would Tor not be vulnerable to this easy-sounding attack?

I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple. Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given ...
2
votes
2answers
4k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
2
votes
5answers
10k views

Google: “Unusual traffic from your computer network”

I often happen to receive the message: "Unusual traffic from your computer network" while googling in Russian speaking countries. Google explains this with: You may see "Our systems have ...
2
votes
3answers
1k views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
2
votes
2answers
1k views

Good steps to survive from denial-of-service attack (DoS attack)

I need to follow several steps to safe our Web Project from DoS attack. Is there any guideline / steps? EDIT : We have our own server where we are running several e-Commerce websites. Our server's ...
2
votes
2answers
387 views

Can an attacker slow down my server without compromising it?

We have a Linux server with WHM/cPanel which has been running without problems for almost 3 years now. Yesterday, the server became unresponsive (it was definitely there though) for around an hour. ...
2
votes
4answers
2k views

How to detect bots clicking a link?

I own a url shortening service. I want to deliver only legitimate statistics to my clients. There are possible scenarios that a particular user writes a script to automatically open the shortened URL, ...
2
votes
2answers
1k views

Does “loose source and record route” drop the source address?

Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur? It ...
2
votes
1answer
936 views

UDP Flood Attack false positive

Symantec keeps blocking traffic from the IP of my Comcast SMC Network gateway. It blocks traffic because it is detecting a UDP Flood Attack. According to the log the CPU usage is spiking to 100% when ...
2
votes
3answers
64 views

Security considerations in concurrent applications

I have been building a network application with a Client/Server model, where a central server handles multiple client threads. I did my best to ensure that no matter what context the program is run ...
2
votes
2answers
202 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
2
votes
2answers
95 views

Preventing a Computational DoS Attack in Public Key Cryptosystems

I'm designing a server which accepts anonymous messages using ECIES: as in, anonymous users send the server an ephemeral EC public key, and the server uses ECDH to derive a shared secret, and some KDF ...
2
votes
3answers
239 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
2
votes
1answer
2k views

How do I protect my Windows computer against the IPV6 flood attack shown in this video

In the DefCon video "Three Generations of DoS Attacks (with Audience Participation, as Victims)", the speaker demonstrates how it is possible to crash a variety of devices by flooding them with IPV6 ...
2
votes
1answer
80 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
2
votes
3answers
142 views

Is opening a new mysql connection for each query potentially unsafe?

I am doing some unit testing and noticed that if I click (or have multiple people clicking) the same filter very very fast (very precise I know;) eventually I get a "The connection is already open." ...
2
votes
1answer
202 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...