Hot answers tagged denial-of-service
50
It crashed because some input was not processed correctly. An attacker may try to find the code path that leads to the faulty procedure and attempt to execute arbitrary code through potential vulnerabilities.
Crashes may give an attacker valuable information about the system and its internal details.
Crashes may create temporary vulnerabilities or leave ...
49
Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue.
In brief, there's insufficient research.
In long, here are some of his ideas for less painful account locking:
Don't count duplicate password attempts (they probably thought they mistyped it)
Make the password hint about the ...
38
First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing). My compliments to you.
Ultimately, this is a matter of personal ethics, so it is hard to give advice. You need to do what you feel is right.
That said, your suggestion to try ...
24
Any website that complies with PCI Data Security Standards has to adhere to sections
8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts)
8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID).
This is unfortunately why a lot of sites accepting credit cards have ...
24
Disclaimer: I'm not an IT guru nor a security expert.
First, I agree with @D.W. that it can't hurt to contact the site owner and explain what happened. (For all you know, the 509 responses may be totally unrelated to your haywire script.)
Second, in the future, it's a simple matter to include your email address or other contact info in the User-Agent ...
18
There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult.
Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...
17
Anonymous tries to talk people into supporting their DDoS actions by installing a tool on their computer. It has a botnet-mode which allows the leaders to define the target for all the drowns. In other words: Anonymous uses social engineering instead of technical vulnerabilities to distribute their botnet client.
This tool just generates a lot of direct ...
17
DoS attacks can be used in several ways as part of gaining access:
Overwhelming primary defenses. when you are conducting a DoS attack, the primary defense mechanisms get caught up in it too. They can be overwhelmed and as a result, they may: a) not respond appropriate b) can hang altogether c) the watchers watching them are distracted, or your efforts are ...
15
There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address.
You can use http://whois.domaintools.com/ to do a whois lookup to get the address.
Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...
14
There are a couple of things you can do to prevent DOS/DDOS.
First I would recommend using an autoban firewall. I've been using Fail2Ban for some time now. Most of my problems with DDOS/DOS attacks to SSH,FTP,BIND and etc were solved. What fail2ban actually does is it's scanning a log file and when a regex pattern matches X times it bans the person. With a ...
13
It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...
13
There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...
12
We are reminded that testing a 24x7 infrastructure is a Very Hard Problem.
Testing helps
Door locks that depend on internet-access, large enterprise products that depend on unidentified network resources. If you can't disable part of your environment to see what else breaks, you really have no idea.
Obviously, door locks shouldn't depend on internet ...
12
Wouldn't be surprised if it came from the baseball "Three strikes" rule rather than anything technical.
One justification (for alphanumerics passwords anyway) is
Typically a failed attempt is either a mis-type or a CAPS on/off issue. So you try to log on and get rejected (1), try again because you think you mis-typed (2) and then realize the CAPS key is ...
12
For a simple solution I would say to implement an exponentially increasing delay per user per IP address.
Required delay between attempts 1 and 2 from IP a.b.c.d for user x: 1 seconds
...attempts 2 and 3: 2 seconds
...attempts 3 and 4: 4 seconds
...
...attempts 7 and 8: 1 minute 4 seconds
That way an adversary can't DoS access from an IP address or an ...
11
If this http://www.refref.org/p/refref.html is the DOS i did some research.
mysql> select version();
+-----------+
| version() |
+-----------+
| 5.5.9 |
+-----------+
1 row in set (0.01 sec)
mysql> select benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f);
^CCtrl-C -- sending "KILL QUERY 193" to server ...
Ctrl-C -- query ...
11
If the owner invited people to hack the site, then he accepts such things as DoS. It is possible that he configured the server to limit brute-force attempts by instituting rate-limiting. If he did, then you did not exceed the limit for his pipe, just the limit he gave you.
Either way, no need to write an apology.
11
bcrypt is slow, which definitely increases the risk of an easy DoS attack, but there are a number of ways you could rate-limit clients before they get to the bcrypt step:
Keep track of IP addresses and ignore anyone trying to log in too quickly (maybe start out by pausing for certain amount of time before authenticating, then work your way up to a ...
11
Have a dedicated router or firewall to do the filtering.
The reason your CPU is being stressed is that the software firewall on your system is attempting to handle way more packets that your system can tolerate.
Having a hardware router or firewall drop packets before they hit your computer should do the trick. Of course, there IS a limit even to dedicated ...
10
I agree with the OP. If you think about what the lockout protects you against, there is no difference between 3 or 20 attempts (or 100, for that matter).
All you achieve with these lockouts, apart from punishing forgetful users, is to prevent a brute-force attack.
You can also user it to trigger a warning that an attack is on-going, but that isn't the ...
10
Detection
The goal of a reflected DNS attack is to send large volumes of network traffic at a host in order to cause legitimate traffic to be dropped. It is chosen when the attacker doesn't control enough bandwidth himself to exceed the target's bandwidth. It is largely irrelevant whether the target is running a DNS server or not as the damage is usually ...
10
A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories:
Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time)
Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid ...
10
Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001.
UPDATE
Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...
10
That seems to be a NetGear log entry, there are two possibilities for this:
SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...
9
Denial of Service is a broad term, describing attacks that "make a computer resource unavailable to its intended users" (Wikipedia). Overloading a server is a form of DoS, but there are many other forms. You might be able to achieve the same goal by using up the server's maximum number of possible concurrent connections, not overloading the server, but using ...
9
"SSL exhaustion" is a mean looking expression for a more generic attack known as "not playing nice". In broad terms, it goes like this: a server is offering a network service, which, on the server, is not free: when a client comes, the server must invest some of its precious CPU cycles into responding to that client. The "attacker" is then someone who mimics ...
9
You can try to build Faraday cages; this would require the WiFi access point and the authorized clients to be inside the cage, while the vindicative attacker would be on the outside. The Faraday cage should be a mesh with rings substantially smaller than the wavelength of the signal which is to block (radio-astronomers would recommend a factor of 10): 5 GHz ...
8
I believe I'm late to this debate, but I hope I have something useful to add here.
The account lockout policy (with the number of consecutive invalid attempts usually in the range of single digits for most organizations) was not devised solely against automated brute force attacks.
It is more of a protection against password guessing by human attackers, ...
8
There are two aspects to this.
The first, as you mention, is preventing brute-force attacks.
For this purpose, really any number of tries should do - 3, 5, 20, 2000... with a proper password policy (length+complexity+...) giving a large enough keyspace, any kind of throttling (X number of tries per hour) will ensure that bruteforcing the entire space ...
8
This is a perfectly fine and viable form of DOS attack.
In your example I would construct such an attack like, say I XSS inject a very popular online page with a lot of hidden traffic to my target page, it could eventually DOS the target page causing a variation of the slashdot effect. This is a form of layer 7 DOS attack.
There is very many examples of ...
Only top voted, non community-wiki answers of a minimum length are eligible
