Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

1
vote
1answer
610 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
7
votes
5answers
8k views

How To Protect Tomcat 7 Against Slowloris Attack

I'm using Apache Tomcat 7 to run my webapp on Linux. I scanned it by Acunetix and it's telling me that my webapp is vulnerable to "Slow HTTP Denial of Service Attack". How can I protect it? Acunetix ...
1
vote
1answer
232 views

Root/Naked domain and DDOS

Some services like Github has DDOS mitigation measures for their root/naked domain, but not other subdomain(s). What so special about the root domain concerning the DDOS attacks? [1] ...
1
vote
0answers
671 views

Akamai or Incapsula (or other) for CDN with DDoS Protection? [closed]

One of our clients is launching a new site and I've been tasked with making a short overview of the advantages/disadvantages of Akamai, Incapsula or other CDN providers who are strong with DDoS ...
1
vote
2answers
341 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
7
votes
1answer
831 views

Harden a server against mass SSH DoS attacks

How can a Linux server be protected against an attacker that tries to open a large number of SSH sessions (probably trying to brute force a password) that no ports remain to be able to legitimately ...
1
vote
2answers
84 views

Using pattern matching to make a port more secure

I am planning to make a web application deployed on a port more secure by detecting the pattern of the request an then comparing it with the patern next time that IP tries to connect.Any ways to move ...
2
votes
0answers
274 views

DoS stress test not working [closed]

First off I'd like to say this is my first post on StackExchange, so please let me know if there's anything wrong with it. Also, I don't know much about networking and I'm just making a simple java ...
8
votes
1answer
208 views

How to force “expensive calculation” when clients connect to my server?

Page 183 of Secrets & Lies on countering denial-of-service attacks: Some researchers have proposed defenses that force the client to perform an expensive calculation to make a connection. ...
4
votes
1answer
165 views

DOS safe alternative to delay response to an attacker with sleep()?

tl;dr sleep() costs my servers resources. Using it to delay response to the attacker might cost him/her time, but allows for DOS. Is it possible to keep him/her waiting without costs of mine? Long ...
0
votes
2answers
490 views

Can someone help? I'm getting Dossed!

So basically since a few days my internet started being very slow. I checked my router logs and guess what! In the log where it is a record of DoS attacks it showed something like |Description ...
1
vote
3answers
136 views

What are some good ways to prevent a malicious visitor from maxing out our customer's API maximum allowed service calls?

We run an API service. We gave our customer a package for max limit of 12000 API calls / day. He reported to us that a user has been on purposely visiting his web page 12,000 times a day in order to ...
2
votes
1answer
3k views

How to prevent DHCP Starvation attack?

All this while, I assumed that switchport security is enough to prevent DHCP dos attack. If I set it maximum 1, there can be no more mac addresses packets. But, a friend told me that using the tool, ...
-3
votes
2answers
205 views

Why would you want to initiate a DoS attack on a system you are testing?

What is the value of a DoS attack as part of a security assessment? this is the question asked to me in EC council's exam preparation, so need to know. not intending any attack
1
vote
0answers
1k views

Ping Of Death reconstruction against a Windows 95 virtual machine

For the sake of demonstration, I'm trying to perform a Ping Of Death sent from a Kali Linux virtual machine to a Windows 95 virtual machine (vmware) on a private network. I've set both vms correctly, ...
6
votes
3answers
2k views

First steps in preventing DOS attacks

My server is currently being attacked from another server. This is my log: root@my-server:/var/log# tail -f auth.log Feb 19 11:53:08 my-server sshd[3745]: Disconnecting: Too many authentication ...
1
vote
1answer
971 views

RESTful API URLs and Denial Of Service attacks

I overheard the following statement today: We shouldn't use /api (e.g. in a RESTful URL like /api/v1/users/get) in our RESTful URLs anymore because it makes it easier for people to Denial Of ...
8
votes
2answers
603 views

Zlib DEFLATE decompression bomb

Can you give me an example of a short data string that, when decompressed using Zlib's DEFLATE method, expands to something much much longer? More precisely: what is the nastiest decompression bomb ...
1
vote
0answers
435 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
2
votes
4answers
15k views

Tools for performing HTTP FLOOD attack?

I'm looking for tools which can perform HTTP FLOOD ATTACK . I seached a lot and this is the only tool I've found DoSHTTP. Does anyone know another tool? I want to test them on my localhost to find ...
0
votes
1answer
89 views

To what extend can a DOS attack succeed even if it was detected?

While reading DOS detection and prevention http://staffweb.cms.gre.ac.uk/~lg47/publications/LoukasOke-DoSSurveyComputerJournal.pdf I've asked myself: Even if a firewall detects a DOS attack and begins ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
7
votes
5answers
3k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
-1
votes
2answers
445 views

Packet size and flood attacks

Do the attackers use small but a lot packets or big and some? e.g. 2 bytes or 512bytes? Also , can packet size affect the size/speed of the attack? Something more , how do the firewalls block dos ...
4
votes
2answers
2k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
23
votes
3answers
5k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
7
votes
2answers
912 views

How dangerous is it to allow arbitrary webhook urls to post to?

I am building a Ruby on Rails API that posts to webhooks that the API user can create, whenever a resource that he manages is created, updated or destroyed, using the HTTParty gem. This got me ...
17
votes
1answer
24k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
1
vote
1answer
752 views

How is DDoS different from DRDoS?

I understand DDoS is a DoS assault from multiple sources, where a coordinated stream of requests is launched against a target. How is DRDoS different?
1
vote
1answer
973 views

Security implications of adding all domains to CORS (i.e. Access-Control-Allow-Origin: *) [duplicate]

I am curious of what all the security implications are if I set the following two HTTP response CORS headers; Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false The only ...
0
votes
2answers
783 views

How can I stop this attack on my router?

After enabling system log on my Asus DSL-N10E router, I've got this message: DoS: Tcp SYN With Data Attack source=217.74.166.73 What does it mean? Is it a real danger on my network security? And ...
1
vote
1answer
145 views

What types of hacking attacks happen alongside a DOS or DDOS attack? [closed]

I'm trying to find some good material on this topic for a paper I'm trying to write for class. Any and all help is very much appreciated.
6
votes
3answers
20k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
1
vote
1answer
263 views

Possible DOS Attack? And solutions for it?

I don't know whether it's appropriate to post this question here but I desperately need help. I've been receiving ping requests from 18 different IP addresses so far. Some of them are local, some ...
2
votes
1answer
2k views

TCP syn attack prevention

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and ...
2
votes
2answers
243 views

Why would Tor not be vulnerable to this easy-sounding attack?

I'm thinking of this attack on Tor, which I'm sure won't work, as it is much too simple. Mr. Blackhat sets up lots of intermediate nodes. However, whenever TCP connections come in, they are given ...
4
votes
2answers
26k views

nf_conntrack: table full, dropping packet

I see a lot of these messages in /var/log/messages of my Linux server kernel: nf_conntrack: table full, dropping packet. kernel: __ratelimit: 15812 callbacks suppresse while my server is under DoS ...
1
vote
2answers
377 views

Can older or custom web browsers override the same origin policy?

I totally understand the basis of origin policy and the reasoning why all modern browsers have put this policy into place. My question I guess is, do older browsers support this, and if they don't, ...
18
votes
5answers
2k views

How can a DoS attack be used as part of the 'Gaining Access' phase of a hack?

I'm doing some revision for an exam and I've made a note to look at how DoS attacks can be used to gain access to a system. I can't find anything online but I found a reference to the fact here. I ...
3
votes
5answers
4k views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
1
vote
1answer
257 views

Which cloud providers can be used for the simulation of DDoS attacks? [closed]

Cloud providers have a great infrastructure to perform DDoS simulations. You can get thousands of virtual machines with different IP addresses, fully customizable with the tools you need for testing. ...
5
votes
3answers
8k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
3
votes
2answers
811 views

What to do when GSM/Wifi is jammed and ethernet cables are cut?

So.. There are household alarm systems (to defend against burglars) which send SMS/e-mail alerts if an intruder has been detected or an alert is trigged. However, Mobile networks can be jammed, and ...
0
votes
1answer
118 views

Finding the method of attack [closed]

My server has been repeatedly attacked in the last few days. Here's the observations: The ISP server traffic monitor shows the incoming traffic goes up to 300Mbps (with no outgoing traffic), and ...
8
votes
2answers
1k views

Slowloris attack?

Could someone analyze this info? We got information that slowloris attack took place. They say (hosting stuff) they have implemented mod_antiloris, is that enough btw? Feel free to share your opinion ...
0
votes
3answers
1k views

SSL vs TLS, which is less vulnerable to DOS attacks?

When I learned TLS does not allow a connection to be created until it is has finished a secure handshake, i figured that would make it better for preventing DoS attacks. However, all I seem to find ...
30
votes
3answers
2k views

Is there a security reason for a site to limit the number of times a user can change their password?

Is there a security reason to disallow a user to change their password as frequently as they want? I have found this security policy in a site and I am not sure why it is enforcing it. One reason I ...
0
votes
1answer
337 views

Preventing DoS in Ajax Calls

We have Ajax call to validate the UserID on create page so that user there only can know if their chosen ID is available or not. We have this URL exposed : https://mydomain.com/validateId?id=<user ...
3
votes
4answers
611 views

How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?

Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
3
votes
1answer
365 views

Why should an IKE responder change the cookie secret 'frequently'?

IKEv2 has the concept of a COOKIE mode, to attempt to prevent state exhaustion from floods of initiation requests from non-existent IP addresses: Two expected attacks against IKE are state and CPU ...