Tag Info

Hot answers tagged

51

Recently, at the OWASP AppSec 2010 conference in Orange County, Bill Cheswick from AT&T talked at length about this issue. In brief, there's insufficient research. In long, here are some of his ideas for less painful account locking: Don't count duplicate password attempts (they probably thought they mistyped it) Make the password hint about the ...


46

First off, let me say this: I respect the ethics of anyone who would ask this kind of question (rather than just closing their eyes, walking away, and forgetting the whole thing). My compliments to you. Ultimately, this is a matter of personal ethics, so it is hard to give advice. You need to do what you feel is right. That said, your suggestion to try ...


32

The real reason why such policies are in place is because they are in place by default. That's how things go in Active Directory: Passwords expire after 42 days. When changing his password, the (non-admin) user cannot reuse one of his 24 previous passwords. User cannot change his password twice within the same 24-hour frame. So you will encounter such ...


31

DoS attacks can be used in several ways as part of gaining access: Overwhelming primary defenses. when you are conducting a DoS attack, the primary defense mechanisms get caught up in it too. They can be overwhelmed and as a result, they may: a) not respond appropriate b) can hang altogether c) the watchers watching them are distracted, or your efforts are ...


29

Any website that complies with PCI Data Security Standards has to adhere to sections 8.5.13 (Limit repeated access attempts by locking out the user ID after not more than six attempts) 8.5.14 (Set the lockout duration to thirty minutes or until administrator enables the user ID). This is unfortunately why a lot of sites accepting credit cards have ...


29

Disclaimer: I'm not an IT guru nor a security expert. First, I agree with @D.W. that it can't hurt to contact the site owner and explain what happened. (For all you know, the 509 responses may be totally unrelated to your haywire script.) Second, in the future, it's a simple matter to include your email address or other contact info in the User-Agent ...


23

Typically it is used in combination with a password history policy, eg “you can't re-use any of your last 12 passwords”. Without a minimum-change-period it would be possible to circumvent this by changing your password 12 times in a row, back to the original. It is IMO of pretty doubtful value.


21

The question is a bit vague, the short answer is Yes clicking on links could DoS your site. A for a more in-depth answer you would need to look at what those links are doing. For example if every time you clicked a link it ran some monstrous database query that used all your CPU power or Disk IO, or if the links played a video that would quickly saturate ...


20

Anonymous tries to talk people into supporting their DDoS actions by installing a tool on their computer. It has a botnet-mode which allows the leaders to define the target for all the drowns. In other words: Anonymous uses social engineering instead of technical vulnerabilities to distribute their botnet client. This tool just generates a lot of direct ...


19

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


18

My experience is lock out mechanisms are diminishing in popularity (at least for web apps). Instead of locking accounts out after a series of failed attempts, you begin to ask for additional information for successful authentication.


15

There's always an "Abuse" email address on the whois of a netblock for reporting misuse of an IP address. You can use http://whois.domaintools.com/ to do a whois lookup to get the address. Is it worth your time? That's your call. Will it lead to anything? Nothing you'll ever see. But many of the sites I fix come from people who were first alerted of the ...


15

There are 13 root name server addresses, each corresponding to a separate root name server system. The name server systems are not single machines - rather a collection of physical servers connected together as a distributed system. Each collection of servers is geographically distributed (a technique known as multihoming) such that a natural disaster is ...


15

There are a couple of things you can do to prevent DOS/DDOS. First I would recommend using an autoban firewall. I've been using Fail2Ban for some time now. Most of my problems with DDOS/DOS attacks to SSH,FTP,BIND and etc were solved. What fail2ban actually does is it's scanning a log file and when a regex pattern matches X times it bans the person. With a ...


15

There's a perfect illustration in this movie and an even better in that movie. Spoiler alert (although if you have not seen these movies yet, then you must have spent the last three decades frozen in a glacier or whatev) In the first movie, the bad guys simulate a terrorist attack (which can be thought of a massive DoS) so that the authorities apply their ...


14

It is a myth. It used to be 13 servers yeah, and quite some years ago a hacker group almost succeeded in taking down all 13 of them. In the end, a few of the root DNS servers survived and the Internet was saved. Since then, the addresses have been changed from unicast to anycast and instead of 13 servers there are now 100s. Read more at ...


13

For a simple solution I would say to implement an exponentially increasing delay per user per IP address. Required delay between attempts 1 and 2 from IP a.b.c.d for user x: 1 seconds ...attempts 2 and 3: 2 seconds ...attempts 3 and 4: 4 seconds ... ...attempts 7 and 8: 1 minute 4 seconds That way an adversary can't DoS access from an IP address or an ...


13

Wouldn't be surprised if it came from the baseball "Three strikes" rule rather than anything technical. One justification (for alphanumerics passwords anyway) is Typically a failed attempt is either a mis-type or a CAPS on/off issue. So you try to log on and get rejected (1), try again because you think you mis-typed (2) and then realize the CAPS key is ...


13

A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories: Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time) Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid ...


13

If the owner invited people to hack the site, then he accepts such things as DoS. It is possible that he configured the server to limit brute-force attempts by instituting rate-limiting. If he did, then you did not exceed the limit for his pipe, just the limit he gave you. Either way, no need to write an apology.


13

If this http://www.refref.org/p/refref.html is the DOS i did some research. mysql> select version(); +-----------+ | version() | +-----------+ | 5.5.9 | +-----------+ 1 row in set (0.01 sec) mysql> select benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f); ^CCtrl-C -- sending "KILL QUERY 193" to server ... Ctrl-C -- query ...


13

bcrypt is slow, which definitely increases the risk of an easy DoS attack, but there are a number of ways you could rate-limit clients before they get to the bcrypt step: Keep track of IP addresses and ignore anyone trying to log in too quickly (maybe start out by pausing for certain amount of time before authenticating, then work your way up to a ...


13

We are reminded that testing a 24x7 infrastructure is a Very Hard Problem. Testing helps Door locks that depend on internet-access, large enterprise products that depend on unidentified network resources. If you can't disable part of your environment to see what else breaks, you really have no idea. Obviously, door locks shouldn't depend on internet ...


13

Have a dedicated router or firewall to do the filtering. The reason your CPU is being stressed is that the software firewall on your system is attempting to handle way more packets that your system can tolerate. Having a hardware router or firewall drop packets before they hit your computer should do the trick. Of course, there IS a limit even to dedicated ...


12

I agree with the OP. If you think about what the lockout protects you against, there is no difference between 3 or 20 attempts (or 100, for that matter). All you achieve with these lockouts, apart from punishing forgetful users, is to prevent a brute-force attack. You can also user it to trigger a warning that an attack is on-going, but that isn't the ...


11

This normally occurs when a client decides to reduce its TCP window size, without the server expecting it. This can be the case when fragmentation is an issue, or when the client is using an embedded device with very little NIC buffer memory. This is a completely normal behaviour, and you're likely to see quite a few such packets in your log. The messages ...


11

When an HTTP client (say, a Web browser) talks to an HTTP server (a Web server), it sends requests which can be of several types, the two main being GET and POST. A GET request is what is used for "normal links", including images; such requests are meant to retrieve a static piece of data, the URL pointing to that piece of data. When you enter a URL in the ...


10

This is a perfectly fine and viable form of DOS attack. In your example I would construct such an attack like, say I XSS inject a very popular online page with a lot of hidden traffic to my target page, it could eventually DOS the target page causing a variation of the slashdot effect. This is a form of layer 7 DOS attack. There is very many examples of ...


10

One possibility is to consider using client puzzles. The basic idea is to force the client to do a significant amount of work, and prove it has done so, before you will accept a username/password pair and try to validate it. Here is an overview of the approach. The server generates a random puzzle, and sends the puzzle to the client. The server generates ...


10

A captcha prevents an attacker from performing more database-intensive operations that may cause a DoS via CPU or memory exhaustion. However, this is only the case when the CPU and memory consumption caused by generating the captcha image must be less than that of the normal page request. One way to ensure this is to use an off-site captcha service, such as ...



Only top voted, non community-wiki answers of a minimum length are eligible