So I've implemented an IP Blacklist for the
/login endpoint on my server.
If any IP fails to login more than
x number of attempts in
x number of minutes the requesting IP is blacklisted for
x number of minutes.
That goes a long way in mitigating any brute-force attacks attempting to determine a users password by adding large delays to the mix when too many failed
/login requests are received by any given IP.
But there's a scenario where this could be problematic, and actually be an instrument for an attacker to launch a DOS attack agains my legitimate user, like so:
- Blackhat wants to DOS LegitUser's website
- LegitUser has a server with the IP
- LegitUser's server needs to communicate with my system in order to remain online.
- Blackhat finds out what LegitUser's server IP is
- Blackhat uses a proxy server as an IP-Spoofing machine to send a large number of purposely unsuccessful
/loginattempts to my system, knowing that these failed attempts will get the requesting IP (which has been spoofed to be
- Blackhat doesn't care if he receives a response from my system for the purposely unsuccessful
/loginrequests because the point of this attack is not to brute-force any credentials, it's to trick my system into believing that the IP
220.127.116.11has exceeded its allotted login failures for any given timeframe.
- The result is that the IP
18.104.22.168is blacklisted by my system. But, this IP does not belong to Blackhat, it belongs to LegitUser, who has played no role in this attack at all.
- The result of the blacklisting of the IP
22.214.171.124is that the website served from that host is now offline, because it depends on my system to remain online.
How could I go about protecting against this?