Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks

learn more… | top users | synonyms (1)

6
votes
4answers
2k views

Is this type of ARP poisoning attack possible?

I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets. Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
5
votes
3answers
2k views

How are server overload and DoS/DDos different?

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does ...
9
votes
2answers
2k views

How to defend against SSL-Exhaustion attacks?

The problem of SSL-Exhaustion attacks is well known for years, but nobody really cared until THC released their exploit-tool recently. THC talks about counter measurements in their release: No real ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
9
votes
4answers
873 views

Combat Apache Killer

Three days ago, KingCope released a simple Perl script to DoS Apache, aptly named Apache Killer. This script launches about 50 threads to request Partial Content from the server with optional GZIP ...
22
votes
3answers
4k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
11
votes
4answers
468 views

What lessons about Denial of Service can we learn from Egypt's “experiment”?

Internet service was widely disrupted in Egypt starting Jan 27th at about 22:15 UTC, in the space of about 20 minutes: How Egypt Killed the Internet. Service was largely restored 5 1/2 days later on ...
15
votes
4answers
3k views

Protection against account lockout DoS

Any ideas on how to protect against the following scenario? Company x uses active directory for authentication of it's employees. The company has multiple authentication points that are semi-public ...
67
votes
13answers
16k views

Why do sites implement locking after 3 failed password attempts?

I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...