Botnet Attempting to Login to Website

Question

Our server has recently become a target of what appears to be a botnet attack. The first indication was an insane amount of traffic to one of our client's websites - so heavy that the server entirely stopped responding. I believe we had somewhere near 200 queued requests on the server when I checked on it.

I've concluded that it is a botnet because each IP sends at most 3 requests. These requests seem to be targeting login/registration pages. Originally they were brute forcing user info pages (/user/lkjasd) to see if the user existed, and then trying to login as them if not.

My initial response was to set some RewriteRules for that VHost that detected all of the login/registration/user pages and send 403's immediately (only administrators login on this site, and that is rare). This has taken the load off our server because of the quick response, so all of our sites are back up.

However, I am now 3 days into that solution, and the attacks have not slowed. They've cut out most of the login/registration attacks, and now are sending GET and POST requests to my homepage, with the referer set as /user/login. I'm assuming this is an attempt to hijack a session or trick the site into thinking they just logged in.

Obviously I can't setup a RewriteRule to 403 on the homepage, so how else can I defend against this? The traffic isn't unbearable, but it makes me uneasy just letting them run, and I'm a bit nervous about my bandwidth bill at the end of the month.

Answer 1

A DDoS attack is near impossible to prevent or stop at a local level.

I strongly encourage the use of a service like CloudFlare which is aimed at mitigating DDoS attacks. Another alternative is coordinating with your ISP to drop DDoS like traffic.

The recent Spamhaus DDoS attack demonstrates how effective a service like CloudFlare can be in mitigating large scale DDoS attacks. While the amount of bandwidth being thrown at the target is enough to almost overwhelm even individual Internet Exchange Points, the target site remained accessible throughout the attack.

Edit: Reading your question again, it appears that your login page only needs to be accessible to a few administrators. In that case, requiring a VPN to access the login page might do the trick. My previous point still stands though, if a determined enough attacker is willing to expand resources on your site, you can only mitigate attacks through a service like CloudFlare.