Denial of Service is a family of attacks that attempt to force a target to use up resources (CPU time, memory, bandwidth etc) through flood a target with useless packets, connections or tasks
54
votes
13answers
7k views
Why do sites implement locking after 3 failed password attempts?
I know the reasoning behind not letting infinite password attempts -- brute force attempts is not a meatspace weakness, but a problem with computer security -- but where did they get the number 3 ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
6
votes
2answers
298 views
Resource consumption attacks against algorithms
I am studying algorithm construction and weaknesses to resource consumption. One vulnerability that really caught my eye was the Apache Range Header DoS Vulnerability. The following quote was taken ...
40
votes
4answers
3k views
I think I accidentally DoS'd a website. What should I do?
I was browsing a website, and stumbled across a sample scheme for password-protecting web pages. The owner of the website specifically had a page that invited people to attempt to hack it.
I wanted ...
5
votes
6answers
840 views
Prevent denial of service attacks against slow hashing functions?
I've been thinking about bcrypt recently, and what I wonder is if there's a way to deal with the inherent (D)DoS problems with slow hashing functions. Namely, if I set up bcrypt so my machine takes ...
34
votes
5answers
1k views
Why is application crash considered insecure?
If an application crashes, the program stops and there is nothing anyone can do about it, other than starting the program again.
Crash is a bad behaviour in general and should be avoided, but why are ...
14
votes
8answers
566 views
Bruteforce vs Denial of Service
I had a problem presented today which I found quite interesting.
You have an application with a management panel. You know some of the accounts as they are standard. You want two things:
You want ...
4
votes
2answers
93 views
Prevent DOS against RSA authentication
In my current setup, the clients are bundled with the server's public key. The client encrypts a nonce and sends it to the server which uses its own nonce and the nonce received from the client to set ...
4
votes
3answers
2k views
Can I trust the source IP of an HTTP request?
As far as I've understood, if you try to issue a HTTP request with a spoofed IP address, then the TCP handshake fails, so it's not possible to complete the HTTP request, because the SYN/ACK from the ...
1
vote
2answers
533 views
What approaches are to detect DoS attack in IDS/Firewall?
First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
10
votes
4answers
420 views
What lessons about Denial of Service can we learn from Egypt's “experiment”?
Internet service was widely disrupted in Egypt starting Jan 27th at about 22:15 UTC, in the space of about 20 minutes:
How Egypt Killed the Internet. Service was largely restored 5 1/2 days later on ...
4
votes
4answers
532 views
How does CAPTCHA mitigate DDoS attacks?
This seems like an easy question, but I've failed to find an answer.
One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
3
votes
4answers
235 views
How can I constrain or limit 3rd party Javascript (*.js) files that can DOS my site?
Many website owners integrate Google analytics, various Facebook or Twitter social media javascript plug ins into their web pages. The problem is that this trust seems to be "all or nothing", meaning ...
2
votes
1answer
523 views
UDP Flood Attack false positive
Symantec keeps blocking traffic from the IP of my Comcast SMC Network gateway. It blocks traffic because it is detecting a UDP Flood Attack. According to the log the CPU usage is spiking to 100% when ...
1
vote
3answers
2k views
What is HTTP GET/POST Flooding Attack?
I want to know what is HTTP GET/POST flood attack and what are their major differences and mitigation strategies ?
I searched a lot but I really can't find some good articles nor examples about this ...
