New answers tagged

1

After having a client's site go down because of this exact problem, we introduced a somewhat simplistic solution that helped dramatically minimise the effect of such attacks. As phyrfox said in his answer, a FULLTEXT index is a very effective tool for both performance and counter DoS. As we were already tracking visitors for statistic information, we went ...


2

You can mitigate both of these issues by creating a FULLTEXT index. In other words, instead of having the database system read the entire table and scan every character in every field, the system builds an index that can be quickly searched while discarding common words/letters. Your attacker can search for "e" as fast as they want, and the index will answer ...


0

There are a few things that come into mind with regards to DoS via what you described. The first is network based, the second is query based (what is the maximum cut off). The first network based: This will depend on the design or your network. E.g., is there load balancing configured somewhere, do you have multiple providers, do you have filtering in place, ...


0

You can just run this code: location.assign("http://www.myapp.com/test/"); I tried (on Chrome), and it reloads the page even if it gets passed the URL you are already on. And of course you can also use any of the tips @mcgyver5 suggests for loading resources with JavaScript.


1

Can you create a bunch of Iframes that each have a src of www.myapp.com/test/5? or a programmatically create a bunch of <img src="www.myapp.com/test/5"> Those iframes might end up being a ddos of the browser instead of the server but the img ones might work. then there is ajax which you should be able to simply call in an endless loop and send ...


0

Very unlikely to happen, but possible: If some programmers mishandle an unchecked warning throwing a ClassCastException by casting some unsigned integer values into signed integer that could easily allow an attacker to bypass Integer.MIN_VALUE and Integer.MAX_VALUE into an integer overflow attack.


1

Analyze the packets, to find the source port number. Use this port number in a tool like cports, to obtain process id. You can track the process name and its respective executable from the pid in task manager. Check if that process is one, which you have initiated, or is it doing any thing useful to your work. If not then kill that process. Moreover, if that ...


2

a pcap would be useful PROVIDED whatever process is responsible for generating the packets isn't also protected by any sort of application that is intercepting system calls. I.e. most good viruses typically use a loader that prevents the OS from reporting packets or processes generated by specific processes.


0

I would suggest also setting your firewall rules to reject rather than drop One temporary, fix if you need to keep your iptables NAT rules is: linux:~# sysctl -w net.netfilter.nf_conntrack_max=131072 I say temporary, because raising the nf_conntrack_max doesn't guarantee, things will get smoothly from now on. However on many not so heavily traffic ...


1

Any attack that denies service to users is by definition a denial of service attack, yes. As tlng05 pointed out though, the usual convention is for this to refer to attacks that exhaust resource such as network bandwidth, processor capacity etc.


0

Security of a database system, or any system for that matter, is about more than simply which type you use. Who has access, is remote access possible, can root login remotely, is there a web interface, and if so, is it secure against injection attacks? There's hundreds of factors. You could try asking a more specific question.


2

ICANN has a good article on this. Read it. But because you seem to only be under attack from a specific ISP, I can tell you some more. Most people have dynamic IP addresses. This means that their IP changes after at most 24 hours. So everything you banned more than 24 hours ago shouldn't be banned any more because for every given IP banned more thin 24 ...



Top 50 recent answers are included