New answers tagged denial-of-service
0
You can configure Apache mod_evasive module. This module provides a very basic function by keeping a hash table of IPs and pages requested and when a threshold level is exceeded on a target page or site it will “block” the IP with a 403 “Forbidden” error. For configuration details you read "How to Stop an Apache DDoS Attack with mod_evasive".
1
fail2ban is an easy-to-implement solution in these cases.
Add a block-all-dem-noobs.conf file to your filter.d directory, something like this
failregex = ^ -.*GET
Translation: a RegExp to find GET requests
Then create a new entry in your jail.conf, something like this
[block-all-dem-noobs]
enabled = true
port = http,https
filter = block-all-dem-noobs
...
3
fail2ban can be configured to do this. You can configure it to trigger on a regex match in a logfile and if it happens too many times per minute (not sure if it goes to second resolution but just multiply whatever you were thinking per second by 60) and it can drop the client IP into the iptables packet filter or whatever other action you want taken. Or you ...
6
So these are two quite different things, the first is a classification of protocol exploit, the second is a method sometimes employed by DDoSsers. I give examples of both.
Authentication Reflection
The classic example used to explain the concept of a reflection attack is the MIG in the middle.
How it should work
A military decides to implement a system ...
2
Snort isn't very good at keeping state over a longer period of time than a tcp session. Snort is very much signature based. What you want is more of a flow/heuristic based IDS. I run Snort AND the somewhat unknown and very under-rated Bro IDS:
http://bro.org
This provides MUCH better coverage and visibility into your network than Snort alone.
...
1
Web Application layer Firewall like Modsecurity and Application layer filter like snort ruleset are generally signature bases rule. These rulesets are very comprehensive and covers most of application layer attacks like XSS, SQL injection. Though these firewall have support to protect against DoS through session and user level counters but this not generally ...
8
That seems to be a NetGear log entry, there are two possibilities for this:
SYN Port Scan: Someone (very likely automated, by an infected machine) attempting to scan your machine. They send a SYN packet to you, then your machine responds with an ACK packet. In order to prevent a connection from being established, they send you an RST (Reset) packet. (More ...
7
There's a perfect illustration in this movie and an even better in that movie.
Spoiler alert (although if you have not seen these movies yet, then you must have spent the last three decades frozen in a glacier or whatev)
In the first movie, the bad guys simulate a terrorist attack (which can be thought of a massive DoS) so that the authorities apply their ...
2
I don't believe DoS attacks are traditionally utilized to gain access to the system per se. It is more of a tool utilized to confuse the system or flood the system with irrelevant requests and deny legitmate traffic access to the system. That can in turn facilitate the use of vulnerability exploits to actually gain access to the system.
Denial-of-Service ...
17
DoS attacks can be used in several ways as part of gaining access:
Overwhelming primary defenses. when you are conducting a DoS attack, the primary defense mechanisms get caught up in it too. They can be overwhelmed and as a result, they may: a) not respond appropriate b) can hang altogether c) the watchers watching them are distracted, or your efforts are ...
3
Even without the threat of DoS, unrestricted authentication attempts is a problem in its own right. A common way of restricting authentication attempts at the protocol level is to force a given IP into waiting exponentially longer after each failed authentication attempt.
A cool feature of SSL/TLS is that it allows clients to resume already established ...
1
You want to stop a possible DOS attack against the server, so why not put in an application layer aware firewall or a network IDS/IPS better still do both.
A Palo Alto firewall with the correct application layer rules would be able to identify the authentic traffic and forward it to the server while a Snort based IDS/IPS could be easily configured to drop ...
2
Check the username (or session identifier) first. If you don't have one in your handshake that is easily accessible, add one. Looking up an identifier is cheap. As long as you don't give away your identifiers, they won't have a large number of valid identifiers to throw at your login or hash function. If an identifier is being used repeatedly, lock it ...
2
You could switch to a faster algorithm. RSA is fine, but Elliptic Curve Diffie-Hellman is faster. Let's take my current machine, a laptop with an AMD A8-4555M CPU (1.6 GHz, not a very fast processor):
$ openssl speed rsa2048 ecdhp256
Doing 2048 bit private rsa's for 10s: 1468 2048 bit private RSA's in 9.99s
Doing 2048 bit public rsa's for 10s: 47384 2048 ...
0
On the accidental (those you control) side, you could have your clients perform a lessor resource extensive check (like just a ping) of the server first before starting the protocol related procedure and burning more resources. But you will never be able to totally stop some check by your clients - they have to be able to do something to start the connection ...
Top 50 recent answers are included
