Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

6
votes
2answers
33k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
6
votes
2answers
9k views

How can I detect/withstand DNS amplification attack?

I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...
6
votes
1answer
211 views

Parabolic Denial Of Service — Would it work?

Would this DoS attack be effective: Attacker determines target (10.0.0.1) Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1 Servers reply to 10.0.0.1 with syn packets ...
6
votes
2answers
3k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
6
votes
2answers
1k views

Resource consumption attacks against algorithms

I am studying algorithm construction and weaknesses to resource consumption. One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability. The following quote was taken ...
6
votes
3answers
925 views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
5
votes
3answers
11k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
5
votes
3answers
3k views

How are server overload and DoS/DDos different?

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does ...
5
votes
2answers
750 views

UDP flood from my machine, or false positive?

The company that hosts my dedicated server has alerted me to what they think is malicious traffic coming from my machine. They supplied me with graphs showing a large amount of UDP traffic coming from ...
5
votes
2answers
3k views

How could a SYN flood affect a home router

I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router. The reason I'm interested is due to a Cisco document I read. ...
5
votes
3answers
443 views

DoS by consuming all hosting trafic

Given a small website hosted on a small data plan, is it possible for someone to keep doing requesting for my website URL or just an image hosted on my website that will consume all my permitted ...
5
votes
3answers
817 views

Is this a symptom of an attack (DoS/DDoS)?

I work for an e-commerce website in my country and this is the second time we suffer an attack. At least, looks like one. We have a search functionality in our website and the supposed attacker is ...
5
votes
1answer
395 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
5
votes
1answer
554 views

How does a Distributed Denial Of Service Attack work

Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do ...
5
votes
1answer
699 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
5
votes
2answers
893 views

How can the Android GraphicBuffer::unflatten() vulnerability (CVE-2015-1474) be exploited remotely?

I've been reading up-on DoS (denial-of-service) attacks within android and although I understand attacks like the below, which make use of regular programming functions etc. (Android Web Browser) ...
5
votes
2answers
499 views

Is there any protection against malicious devices on a CAN bus?

CAN (controller area network) is a bus used in all modern cars. You can read a lot of the cars information over this bus and I think (but I'm not too sure about this) that some critical control ...
4
votes
2answers
2k views

How to mitigate UDP flood attacks?

My friend linked me some website where you pay $5.00 / m and get access to a plethora of 'dos stresser' tools that offer udp flooding, and other malicious flooders. It's a web-based system and you ...
4
votes
1answer
2k views

Can this be a DoS Attack?

When I'm checking my log, I found like 15k events of " PAM service(sshd) ignoring max retries; 6 > 3 " I know this might be normal, and considered as Brute-Force attack, but can it be classified as ...
4
votes
3answers
19k views

Is it safe to ignore DoS attacks on my router?

There are several entries in my router's log file showing recent DoS attempts on some of its ports. They look like this: [DoS Attack: ACK Scan] from source: 213.61.245.234, port 80, Friday, November ...
4
votes
4answers
5k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
4
votes
2answers
288 views

What is this strange GET request (GET /A0A32579-2767) DoSed my apache?

I have apache behind nginx on my webserver. Today my apache stops answering to requests. Investigations shows this situation: Number of apache processes grows more that 500 but MaxChildren=256 in ...
4
votes
1answer
76 views

How to defend against a Spoofed-IP Blacklist DOS attack?

So I've implemented an IP Blacklist for the /login endpoint on my server. If any IP fails to login more than x number of attempts in x number of minutes the requesting IP is blacklisted for x number ...
4
votes
1answer
624 views

HTTP attack taking down PHP-FPM [closed]

Someone started attacking my site a few minutes ago and its caused PHP-FPM to max out all cores (4) on my vps and NGINX is now serving 502 to all users. I'm seeing a bunch of these requests with tons ...
4
votes
2answers
349 views

Prevent DOS against RSA authentication

In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
4
votes
1answer
375 views

What are the mitigating factors for CVE-2015-5364?

CVE-2015-5364 describes a UDP based DoS vulnerability in the Linux kernel that can be used to deny processing cycles to the host operating system and its applications. ...
4
votes
2answers
139 views

Deny attacker access to my router

I was experiencing very low connectivity on my wireless, so I checked the router logs. Here's what I saw: Jul 09 11:07:24 Per-source ACK Flood Attack Detect (ip=74.125.130.129) Packet Dropped Jul 09 ...
4
votes
1answer
204 views

DOS safe alternative to delay response to an attacker with sleep()?

tl;dr sleep() costs my servers resources. Using it to delay response to the attacker might cost him/her time, but allows for DOS. Is it possible to keep him/her waiting without costs of mine? Long ...
4
votes
1answer
172 views

HPKP-based persistent denial-of-service attack on web sites

HTTP Public Key Pinning (HPKP) is a standard that allows a HTTPS website to specify which certificates it trusts, and instruct the browser not to allow any connection to that site that's secured by ...
4
votes
0answers
145 views

What to do if I accidentally DoS a site? [closed]

A few weeks ago I was non-maliciously using a website with server-side calculations when curiosity got the better of me and I decided to mess with some GET request values. I expected the site to give ...
3
votes
2answers
920 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
3
votes
1answer
35 views

Are there any risks to matching user-supplied regex against user-supplied inputs?

I have an IRC bot written in python3 that parses user requests for search and replace. Is there any risk of DoS or other attack by doing this?
3
votes
5answers
5k views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
3
votes
4answers
687 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
3
votes
1answer
403 views

Could somebody explain connect loop DoS?

I'm trying to understand this vulnerability. How can I reproduce this?
3
votes
2answers
139 views

DoS attacks and bitcoin

I was wondering what the repercussions were if a Bitcoin exchange or website that holds bitcoins were to succumb to a DoS attack. In my understanding, all a denial-of-service attack does is deny ...
3
votes
1answer
481 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
3
votes
1answer
1k views

UDP Flood Attack false positive

Symantec keeps blocking traffic from the IP of my Comcast SMC Network gateway. It blocks traffic because it is detecting a UDP Flood Attack. According to the log the CPU usage is spiking to 100% when ...
3
votes
1answer
270 views

RSnake's Slow Loris tool

I was looking at RSnakes implementation of his Slow Loris done on perl which can be seen here. I set up a little server to listen to his packets, and at first found this GET / HTTP/1.1\r\nHost: ...
3
votes
1answer
103 views

SSL Based Denial of Services due to Message Digest

On a very high level, its known that SSL/TLS uses message digests to verify the integrity of the messages sent. However, the question I have in mind is : How does SSL ensure a DoS does not happen ...
3
votes
3answers
251 views

Denial of Service on SSL services

When the SSL handshake takes place, is there a point where the computational work done by the client is significantly less than the computational work done by the server? Could such an imbalance be ...
3
votes
1answer
56 views

What other attacks can be deployed using IP spoofing other than DoS(and DDoS) attacks ?

I want to know the other attacks which are associated with IP spoofing because, we're trying to implement Source Address Validation (SAVA) and wanted to where else can Source Address validation ...
3
votes
1answer
48 views

Netgear WNDR4300 crashes when port scanned

I have no idea what is going on here, I'm leaning towards an error in the firmware or some kind of protection they wont let you turn off. My router has 2 networks: a 2.4ghz and a 5ghz network. I see ...
3
votes
1answer
66 views

Reverse-proxy not a solution to DDOS attacks when hosted on PaaS?

We run our apps on Heroku and use Cloudflare as a CDN and to protect against DOS attacks. However, we recently experienced (a relatively minor) attack that managed to easily bypass Cloudflare by ...
3
votes
2answers
105 views

Content management url security

I manage a website that is a "bad magnet" for our competitors. I am using Incapsula CDN + WAF and I have internal proxy for caching. CMS/WP from its nature is very data consuming, I have check ...
3
votes
1answer
789 views

What is DDOS TCP KILL?

I've recently been introduced to Kali Linux's webkiller tool, located in the websploit category. It works on the concept of Tcpkill. I don't understand how the DoS attack with Tcpkill works. Can ...
3
votes
1answer
873 views

De-auth attack Reason codes and possible reaction

I am learning about Deauth attacks and how they work. I see that the Deauth frame has a reason code which indicates the reason for the deauth. I have tested the attack with aircrack-ng and this reason ...
3
votes
1answer
6k views

how does a sip flood attack work?

I understand that SIP is an application-level protocol that is used to setup/modify/end communication sessions for things like VOIP and instant messenger. I also understand that users can send request ...
3
votes
1answer
1k views

What type of attacks will a SMTP server face if it does not have ratelimiting while sending mails?

Assume a web site with some kind of mailer option, that doesn't implement any rate limiting: This enables users to send an unlimited amount of email per second. Will SMTP face possible DoS attacks ...
3
votes
2answers
689 views

How web application firewalls protect application from DDoS attacks?

How to protect a web application from DDoS by the implementation of Web Application firewalls? How effective is this method?