Tag Info

New answers tagged

0

Your solution will depend on how variable the places the authorization system (AD, ldap, ...) is accessed from are. Is the application you mention the only one to use the authentication service? If yes: the throttling will work fine.You may have users which are surprised by the slowness of the application (as perceived by them) but this may not matter ...


0

I read that this MIC is derived from the PSK (e.g. WPA2 key). Does this mean that these frames are still spoofable from inside the network (i.e. if you own the PSK)? Or does it defend against insider de-auth attacks as well? If you have the AP's MAC address, SSID and WiFi password then you have everything you need to impersonate an AP running ...


3

Based on the screenshot and data you present, you are not on the receiving end of a smurf attack. This exploit is nostalgic for me -- back in the day, I used to hang out on IRC with TFreak and was playing with the smurf exploit when it was first created. The smurf exploit simply would issue ICMP to a broadcast IP. Now, back in these days CIDR didn't ...


19

The ICMP packets coming back were in response to your host sending out UDP packets to other hosts who don't have port 2054 open. It was not a smurf of any sort, unless someone remotely compelled your PC to send out those packets. Regardless, it would take a lot more than a few dozen small packets on the local subnet to noticeably slow your connectivity. ...


0

In general there are three things you can do to mitigate a flood of packets. Ensure that your server does not need excessive resources to handle incoming packets. A decent server can easily respond to 1 Gbit/s of echo requests. But if an incoming UDP packet from an unconfirmed source address will start a computation which need significant amount of memory ...


5

Your explanation is fine! I think I understand your question. DDoS Mitigation works generally by placing a mitigation device/system upstream from your internet connection. You can contract a DDoS mitigation service like Prolexic for these services, or you can go with a cloud provider that already includes DDoS mitigation from whatever vendor. It is ...


2

I'm not sure why it'd be any more difficult to implement than locking the account, or why load balance rs would have any effect. Both approaches require centralized co-ordination about what to do (lock vs delay). I think the main reason is that it's strange behavior, and makes your website look like it's broken (I don't think this is simply patience). ...


4

To turn your attack scenario through 90 degrees; consider the attacker who, instead of using a list of passwords against a single user, instead uses a single password against a list of users. Imagine I (as the attacker) don't care which account I get access to, I simply want access to any account (say, a bank account). Instead of trying to brute force a ...


3

Drawbacks I see from this approach are: More complicated to implement, especially over a scalable platform, cross thread. May not be effective across load balanced servers. Users may need to be patient. For the above reasons it is not widely implemented.



Top 50 recent answers are included