Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

-3
votes
2answers
202 views

Why would you want to initiate a DoS attack on a system you are testing?

What is the value of a DoS attack as part of a security assessment? this is the question asked to me in EC council's exam preparation, so need to know. not intending any attack
1
vote
0answers
1k views

Ping Of Death reconstruction against a Windows 95 virtual machine

For the sake of demonstration, I'm trying to perform a Ping Of Death sent from a Kali Linux virtual machine to a Windows 95 virtual machine (vmware) on a private network. I've set both vms correctly, ...
6
votes
3answers
2k views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
1
vote
1answer
895 views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
8
votes
2answers
572 views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
1
vote
0answers
424 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
2
votes
4answers
15k views

Tools for performing HTTP FLOOD attack?

I'm looking for tools which can perform HTTP FLOOD ATTACK . I seached a lot and this is the only tool I've found DoSHTTP. Does anyone know another tool? I want to test them on my localhost to find ...
0
votes
1answer
86 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
7
votes
5answers
2k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
-1
votes
2answers
433 views

Packet size and flood attacks

Do the attackers use small but a lot packets or big and some? e.g. 2 bytes or 512bytes? Also , can packet size affect the size/speed of the attack? Something more , how do the firewalls block dos ...
4
votes
2answers
2k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
23
votes
3answers
5k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
6
votes
2answers
855 views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
17
votes
1answer
23k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
1
vote
1answer
673 views

How is DDoS different from DRDoS?

I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target. How is DRDoS different?
1
vote
1answer
925 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
0
votes
2answers
763 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
1
vote
1answer
144 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
5
votes
3answers
20k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
7
votes
3answers
8k views

How can I block an IP, if I'm getting many http requests in a second?

If some one tried force burst attack on my website, how can I block them? Ideally, I want to block an IP if I have many http/Apache requests in a second.
1
vote
1answer
261 views

Possible DOS Attack? And solutions for it?

I don't know whether it's appropriate to post this question here but I desperately need help. I've been receiving ping requests from 18 different IP addresses so far. Some of them are local, some ...
2
votes
1answer
2k views

TCP syn attack prevention

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and ...
2
votes
2answers
241 views

Why would Tor not be vulnerable to this easy-sounding attack?

I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple. Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given ...
4
votes
2answers
25k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
1
vote
2answers
367 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
18
votes
5answers
2k views

How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?

I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here. I ...
3
votes
5answers
4k views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
1
vote
1answer
255 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
-1
votes
1answer
334 views

If someone downloaded 600GB , can that be ddos attack [duplicate]

Last night some one exploit some vulnerability in my site and then upload php script in my images folder . I have the Amazon EC2 server with centos. Now the Hacker downloaded 600GB and increased my ...
5
votes
3answers
8k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
3
votes
2answers
799 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
0
votes
1answer
115 views

Finding the method of attack [closed]

My server has been repeatedly attacked in the last few days. Here's the observations: The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
8
votes
2answers
1k views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
0
votes
3answers
1k views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
30
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
0
votes
1answer
326 views

Preventing DoS in Ajax Calls

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not. We have this URL exposed : https://mydomain.com/validateId?id=<user ...
3
votes
4answers
597 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
3
votes
1answer
357 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...
5
votes
1answer
3k views

how does a reflection attack work?

I am trying to understand reflection attacks but unfortunately wikipedia is too vague. I understand that in such an attack the attacker tries to authenticate with the target but does so in such a way ...
2
votes
2answers
5k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
2
votes
1answer
5k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
6
votes
3answers
726 views

Lessen impact of DoS attack on cpu-expensive login?

This is a follow-up to my previous question: Prevent DOS against RSA authentication. This question is also discusses a similar problem: Prevent denial of service attacks against slow hashing ...
4
votes
2answers
311 views

Prevent DOS against RSA authentication

In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
4
votes
1answer
625 views

Measuring SNR to detect jammers in Wi-Fi networks

I'm trying to figure out a way to detect a Wi-Fi 2.4 GHz signal Jammer. I am not looking into locating the location of the jammer but rather detect the jamming signal. How do i do so using only ...
5
votes
1answer
350 views

Are latency based Proof-of-Work systems capable of preventing DDoS attacks on popular hidden tor services (.onion websites)?

I was reading an interesting article found here: http://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-703.pdf It's titled "Lazy Susan: dumb waiting as proof of work". It suggested the following in section ...
1
vote
0answers
442 views

Is anything written in the book “Internet Denial of Service: Attack and Defense Mechanisms” c2004 still valid? [closed]

I was reading through some of this book on google: http://books.google.ca/books?id=qmdCs_Jf2AEC It is uploaded to a hungarian website here: http://denialofservice.uw.hu/index.html I was reading... ...
-4
votes
1answer
3k views

DoSing my Home Network with only a Public IP address [closed]

+--------------------------------------------------------+ | Client Host Name |.. IP Address ..|.... MAC Address ...| | Desktop-Home ....| 192.168.1.100 | 00:19:D1:EA:03:68 | | GT-S5380K ...
8
votes
1answer
2k views

Experience with a recent DDoS attack on Apache

I originally posted a question here since I was not familiar with an actual distributed denial of service attack (DDoS) on my server. I noticed that my server is very slow in responding to HTTP ...
5
votes
2answers
8k views

How can I detect/withstand DNS amplification attack?

I am a developer, and I am trying to get an insight into what could I do to enable my application to withstand a DNS amplification kind of attacks. Would such prevention methods help against DOS type ...