Tag Info

Hot answers tagged

50

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue. In brief, there's insufficient research. In long, here are some of his ideas for less painful account locking: Don't count duplicate password attempts (they probably thought they mistyped it) Make the password hint about the ...


45

First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing). My compliments to you. Ultimately, this is a matter of personal ethics, so it is hard to give advice. You need to do what you feel is right. That said, your suggestion to try ...


31

The real reason why such policies are in place is because they are in place by default. That's how things go in Active Directory: Passwords expire after 42 days. When changing his password, the (non-admin) user cannot reuse one of his 24 previous passwords. User cannot change his password twice within the same 24-hour frame. So you will encounter such ...


29

Disclaimer: I'm not an IT guru nor a security expert. First, I agree with @D.W. that it can't hurt to contact the site owner and explain what happened. (For all you know, the 509 responses may be totally unrelated to your haywire script.) Second, in the future, it's a simple matter to include your email address or other contact info in the User-Agent ...


29

DoS attacks can be used in several ways as part of gaining access: Overwhelming primary defenses. when you are conducting a DoS attack, the primary defense mechanisms get caught up in it too. They can be overwhelmed and as a result, they may: a) not respond appropriate b) can hang altogether c) the watchers watching them are distracted, or your efforts are ...


27

Any website that complies with PCI Data Security Standards has to adhere to sections 8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts) 8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID). This is unfortunately why a lot of sites accepting credit cards have ...


22

Typically it is used in combination with a password history policy, eg “you can't re-use any of your last 12 passwords”. Without a minimum-change-period it would be possible to circumvent this by changing your password 12 times in a row, back to the original. It is IMO of pretty doubtful value.


20

Anonymous tries to talk people into supporting their DDoS actions by installing a tool on their computer. It has a botnet-mode which allows the leaders to define the target for all the drowns. In other words: Anonymous uses social engineering instead of technical vulnerabilities to distribute their botnet client. This tool just generates a lot of direct ...


19

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


15

There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address. You can use http://whois.domaintools.com/ to do a whois lookup to get the address. Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...


15

There's a perfect illustration in this movie and an even better in that movie. Spoiler alert (although if you have not seen these movies yet, then you must have spent the last three decades frozen in a glacier or whatev) In the first movie, the bad guys simulate a terrorist attack (which can be thought of a massive DoS) so that the authorities apply their ...


14

There are a couple of things you can do to prevent DOS/DDOS. First I would recommend using an autoban firewall. I've been using Fail2Ban for some time now. Most of my problems with DDOS/DOS attacks to SSH,FTP,BIND and etc were solved. What fail2ban actually does is it's scanning a log file and when a regex pattern matches X times it bans the person. With a ...


14

It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...


14

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


13

If this http://www.refref.org/p/refref.html is the DOS i did some research. mysql> select version(); +-----------+ | version() | +-----------+ | 5.5.9 | +-----------+ 1 row in set (0.01 sec) mysql> select benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f); ^CCtrl-C -- sending "KILL QUERY 193" to server ... Ctrl-C -- query ...


13

We are reminded that testing a 24x7 infrastructure is a Very Hard Problem. Testing helps Door locks that depend on internet-access, large enterprise products that depend on unidentified network resources. If you can't disable part of your environment to see what else breaks, you really have no idea. Obviously, door locks shouldn't depend on internet ...


13

Wouldn't be surprised if it came from the baseball "Three strikes" rule rather than anything technical. One justification (for alphanumerics passwords anyway) is Typically a failed attempt is either a mis-type or a CAPS on/off issue. So you try to log on and get rejected (1), try again because you think you mis-typed (2) and then realize the CAPS key is ...


13

If the owner invited people to hack the site, then he accepts such things as DoS. It is possible that he configured the server to limit brute-force attempts by instituting rate-limiting. If he did, then you did not exceed the limit for his pipe, just the limit he gave you. Either way, no need to write an apology.


13

Have a dedicated router or firewall to do the filtering. The reason your CPU is being stressed is that the software firewall on your system is attempting to handle way more packets that your system can tolerate. Having a hardware router or firewall drop packets before they hit your computer should do the trick. Of course, there IS a limit even to dedicated ...


13

For a simple solution I would say to implement an exponentially increasing delay per user per IP address. Required delay between attempts 1 and 2 from IP a.b.c.d for user x: 1 seconds ...attempts 2 and 3: 2 seconds ...attempts 3 and 4: 4 seconds ... ...attempts 7 and 8: 1 minute 4 seconds That way an adversary can't DoS access from an IP address or an ...


12

bcrypt is slow, which definitely increases the risk of an easy DoS attack, but there are a number of ways you could rate-limit clients before they get to the bcrypt step: Keep track of IP addresses and ignore anyone trying to log in too quickly (maybe start out by pausing for certain amount of time before authenticating, then work your way up to a ...


11

I agree with the OP. If you think about what the lockout protects you against, there is no difference between 3 or 20 attempts (or 100, for that matter). All you achieve with these lockouts, apart from punishing forgetful users, is to prevent a brute-force attack. You can also user it to trigger a warning that an attack is on-going, but that isn't the ...


11

A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories: Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time) Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid ...


10

This is a perfectly fine and viable form of DOS attack. In your example I would construct such an attack like, say I XSS inject a very popular online page with a lot of hidden traffic to my target page, it could eventually DOS the target page causing a variation of the slashdot effect. This is a form of layer 7 DOS attack. There is very many examples of ...


10

Detection The goal of a reflected DNS attack is to send large volumes of network traffic at a host in order to cause legitimate traffic to be dropped. It is chosen when the attacker doesn't control enough bandwidth himself to exceed the target's bandwidth. It is largely irrelevant whether the target is running a DNS server or not as the damage is usually ...


10

sarepta: To start off, I am the author of PyLoris, so I have done a good amount of research into this. In fact, the attack you have envisioned is one that I specifically coded to when developing PyLoris--the current version even comes bundled with an helper app tor_switcher.py which routes the attack through multiple Tor exit nodes. The only good way of ...


10

Yes, it works. it's often called a reflection DDoS attack. Variants include sending DNS queries off with the (spoofed) address of the target in them. That's a DNS reflection or DNS amplification attack. Vern Paxson wrote a paper about reflection attacks and possible defenses in 2001. UPDATE Cloudflare blog entry about DNS Amplification DDoS, and follow-up ...


10

When an HTTP client (say, a Web browser) talks to an HTTP server (a Web server), it sends requests which can be of several types, the two main being GET and POST. A GET request is what is used for "normal links", including images; such requests are meant to retrieve a static piece of data, the URL pointing to that piece of data. When you enter a URL in the ...


10

That seems to be a NetGear log entry, there are two possibilities for this: SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...


9

Some more technical specifics on network flooding DDoS. As mentioned in the other answers, usually a "botnet" is used to deliver the DDoS attack. Let's have a look at this: A number of end-user systems get infected and (parallel to their normal functioning) become part of the "botnet". They are controlled by "bot agents" which in turn are controlled by the ...



Only top voted, non community-wiki answers of a minimum length are eligible