Tag Info

New answers tagged

1

Add a basic system monitor and check for dropped packets vs resends: a hacker will have multiple resent packets (0x06) a person being lagged by outside forces will have congested packets (0x08) Here's another concept: A person eating lag will get targeted by a hacker with lagger/dropper tools, standard hacker tools indeed. A hacker sending out lag will ...


0

You haven't provided enough to go by therefore I will ask the following question, what is it of yours that is being affected is it just the domain. Or for example, do you have solely your DNS servers for another server hosted by your provider, or do you have say a webserver and other servers hosted by them. There is a big difference in that kind of question: ...


-1

You should only need to switch DNS providers. The registrar is simply a service used to register your domain. This is a different function from DNS resolution. When a user attempts to access your machines, it must query a DNS server to resolve your IP address. Therefore, DNS resolution is a critical part of how fast people reach your service.


1

Throttling is used when lockout is not an option. This particularly happens when under an imperative need to avoid involving support operations (new startups with high user count), giving security more weight than business continuity, compliance or safety reasons (the lockout may endanger someone's safety).


7

"Throttling" and "temporary lockout" are exactly the same thing. It is likely, however, that your dev team misunderstood the concepts, and assumed you meant "throttling" like most of the other answers here did (with the exception of @R15, though that is less an answer and more of important considerations). The important point that they are missing is ...


1

The main difference is that an "account lockout" is based on user accounts and throttling login attempts can also be done by limiting attempts per client. Throttling login attempts per client helps for example if a single malicious client does not target a specific account but tries a different account name on every attempt (or until the account is locked). ...


2

Something else to consider is that the average permissible attempt rate (imposed by either throttling or lockout) should in theory be tied back to the effective cover time of the users' passwords. That is the throttling/lockout should be sufficient to prevent a brute-force attack via the web interface from being successful before the user next changes their ...


18

A) Yep you got it. Same in that they both result from a failed login attempt(s), though they differ in things like logging, the resulting UX implementation, and when one is used. If a user is temporarily locked out, this is email-worthy. You should send an email or text-message to them notifying them that enough failed attempts were made to warrant a ...


1

One packet every 15 seconds does not constitute a DoS attack. You say this is a basic Netgear router. These routers are usually advertised as having special firmware features to protect you from "Internet threats"; what they actually have is an ordinary NAT router configured to log anomalies in the most alarming language possible. The log entries you're ...


3

Looking up these IP addresses in Google give the following results: 31.13.91.117 => related to Facebook 88.221.82.74 => related to Akamai Given the fact that Akamai is a content provider (CDN) which has reportedly been having Facebook as a customer, it seems that this might not be a real DOS attack, and that your router's protection is exaggerating. Is ...


1

I cant add a comment at the moment or I would, but I would look into the port 49152 open. There is a known vulnerability within baseboard management controllers that allows admin passwords to be gained pretty easily. http://arstechnica.com/security/2014/06/at-least-32000-servers-broadcast-admin-passwords-in-the-clear-advisory-warns/ At the moment the nmap ...



Top 50 recent answers are included