Tag Info

Hot answers tagged

52

My answer pokes at the original question. What makes you think that they don't get caught? The CIA and DoD found Osama bin Laden. Typical means include OSINT, TECHINT, and HUMINT. Forensics can be done on Tor. Secure deletion tools such as sdelete, BCWipe, and DBAN are not perfect. Encryption tools such as GPG and Truecrypt are not perfect. Online ...


40

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


36

From some experience with law enforcement and forensics, I can say one of the biggest issues is that ISPs really don't want to have to track users. Once they get beyond a certain level of management they lose 'common carrier' status and become liable for an awful lot of what their customers may do. Also, many countries do not want to pass on information to ...


27

One of the most important aspects of an attack like this is covering your tracks. There are lots of different ways to do this, as it depends on the technology. To address your specific questions: When they DDoS: If the flood was coming from their own machines, then it would be fairly easy to track them. The problem lies in the fact that they aren't using ...


26

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


24

Those are really two different, though similar, attacks. "Regular" DoS is based on trying crash the server/firewall, through some kind of bug or vulnerability. E.g. the well known SYN Flood attacks. The protection against these, are of course specific to the flaw (e.g. SYN cookies), and secure coding/design in general. However, DDoS simply attempts to ...


23

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


22

My experience of DoS and DDoS attacks is based from being a Cisco engineer for an ISP and later as a Security Manager for a very large Global. Based on this experience has shown to effectively deal with large scale and complex attacks requires a good partnership between the organisation under attack and their ISP or DDoS mitigation partner (Yes there are now ...


20

Anonymous tries to talk people into supporting their DDoS actions by installing a tool on their computer. It has a botnet-mode which allows the leaders to define the target for all the drowns. In other words: Anonymous uses social engineering instead of technical vulnerabilities to distribute their botnet client. This tool just generates a lot of direct ...


19

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


18

In addition to the answers that have already been given, another reason it is so hard to catch anonymous is because anonymous can be anyone, literally. I mean this in two ways. First, hackers can use a combination of malware, spyware, and bots to access and use/loop through other peoples computers anywhere in the world; thus, making any computer, ...


18

Sorry not to have a good link, but my thought is you want to cover: What happened? When did it happen, and for how long did it continue? Who did it and how? What was affected - what sites, what servers, how many servers, what part of the business? What customers? Root Cause Analysis What was the impact? Damage to servers Damage/exposure of ...


16

There are NUMEROUS ways for a hacker to cover their tracks.. Here is one very generalized example: A hacker can compromise a third party machine and use it to do attacks on the hackers behalf. Because the system is compromised, the hacker can delete/modify logs. A hacker can also piggyback machines, such as, log into machine A, from machine A log into ...


16

I think you seek the use of a packet generator and a corresponding number of systems generating packets to match the load you seek. Use random valid IP addresses for the packet source addresses and you should find yourself quite annoyed when it comes time to filter. You can do all of that without ever sending a bit across your ISP's link. If you get DDOS'd ...


16

It's because if you shut a server down, you can't use it for revenue. Imagine having a real shop: if you close it during the day, you can't sell anything and offer your services. It's as simple as that. To improve my answer, it costs a lot to fight because it's pretty much impossible to defend yourself against such attacks, since the attacker can use a very ...


15

Many operators (most I hope) use back-door network connections, such as a modem through a terminal server at the site. There are lots of variations on this theme, but that's the easiest way to do it, and has the advantage of giving you access to your network if there's a network or hardware problem affecting your connectivity. Another option is working with ...


15

No, it is not possible, in theory or practice. A well enough distributed DDoS attack is indistinguishable from legitimate traffic. Consider the "slashdot" or "reddit" or "digg" effects, where actual legitimate traffic takes down network services on the target website. Simply posting a link to the target website on slashdot is an effective DDoS in many ...


15

Despite what others are saying, yes you can. Many major corporates have very effective solutions, and even the recent Spamhaus battle, which used DNS DDoS at a scale that hasn't been seen previously was covered rapidly once CloudFlare were brought on board. The solutions I have tested are very effective at transferring DDoS traffic, even when it is a ...


15

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


15

Well I responded to some posts above that had incorrect information, but I figured I should just post my own response to better explain. Anonymous is made up of basically 2 subgroups: Skiddies (script kiddies) and newbies who have only the most basic security knowledge, and just sit in their IRC and basically be the pwns for the attack. These are the ...


15

First we need to understand what exactly you're asking. Every time someone sends a packet on the Internet it consumes some of the potential bandwidth of the Internet. Just like when a car drives down a road, no other car can drive in that same spot, so you have one less available spot on the road. If we continue that comparison, a single site sending out ...


14

It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...


13

A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories: Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time) Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid ...


13

Have a dedicated router or firewall to do the filtering. The reason your CPU is being stressed is that the software firewall on your system is attempting to handle way more packets that your system can tolerate. Having a hardware router or firewall drop packets before they hit your computer should do the trick. Of course, there IS a limit even to dedicated ...


12

I usually vote for sending back an ICMP error for UDP and a RST packet for TCP. It does make debugging issues so much easier. And it prevents annoying timeouts: Mail and IRC servers often attempt to do an ident query or check that the client is not an open proxy. If it is done at the out-most firewall there will be no relevant information disclosed. ...


12

Ignoring the part about DDoS for now, since this should mostly be stopped either at the network, or by the server infrastructure (I include IIS/Apache/other webserver in that)... I think it's also important to understand that DoS (at the application layer, and not distributed) can still be further seen as a few different types of attacks, judging by the ...


12

It's this simple: If the DDoS attack causes you to shut down, whether by the damage it does directly or by your response to it, then the attacker succeeds. If an attack succeeds, it will be performed every time the attacker wants to succeed. The way to reduce DDoS attacks is to make sure they fail. If a DDoS attack doesn't take the site down, there's no ...


12

Simple DoS-attacks use up the bandwidth. But more sophisticated attacks use up other resources such as CPU time and memory. A SYN flood is targeted at using up memory, (and in some cases CPU-time on hardware firewalls). For an attacker, however, it is easier to flood a victim with SYN-packets, if the victim has a huge bandwidth. How is a TCP connection ...


12

If your customer is concerned about DDoS then a standard Pen. test isn't the route to go. Leaving aside the question of whether it's a valid concern, one approach would be to look at doing load testing on the site. There are companies who will perform load testing to see how much traffic the site/server can handle before becoming unavailable. This would ...



Only top voted, non community-wiki answers of a minimum length are eligible