6

tl;dr

sleep() costs my servers resources. Using it to delay response to the attacker might cost him/her time, but allows for DOS. Is it possible to keep him/her waiting without costs of mine?

Long

Assuming I can tell (or at least very well estimate) that data send to my via POST method is an attack.

First in a fit of anger I though I would be smart, just never answering the request and leave the attacker "waiting forever", therefore I thought I would use sleep(30).

Then I found out that this opens the door for the attacker (especially when using DDos that is more than 1 IP) to drive my server load through the roof because each "dangling" (i.e. sleeping) script costs me resources on my system.

Is there a way know way to delay a response at very little costs? (i.e. breaking of the TCP/IP connection without notice and keep attack in the dark/waiting)

Alternatively: In essence is there maybe even a strategy to reverse the resource costs?

Improve this question
4
  • If you can tell whether it is an attack or not in the POST data, how about using some conditional statements to not sleep but rather terminate connection and say after X attempts, IP gets banned and he needs to email you asking to unblock it manually?
    – Pranav Jituri
    Mar 10, 2014 at 7:37
  • 1
    @PranavJituri I only have some limited .htaccess style controll. But the suggestion seems good for when I have to deal with the problem in another setup where i can for instance use IP-tables and have some more root kind of control. In th current setup I am in shared hosting. Thanks .... You suggest "terminate connection", sounds great. Do you know if this can be done from inside a PHP script (lib_apachemod or fastcgi)?
    – humanityANDpeace
    Mar 10, 2014 at 8:05
  • I just started learning PHP so I don't have idea on the script thingy but you can surely try and search in google. But one thing I later realized in my comment that what if the attacker uses a proxy which is used by genuine users as well? Most likely, the genuine users would be affected due to this. Right?
    – Pranav Jituri
    Mar 10, 2014 at 10:11
  • @PranavJituri So it would seem to me. Proxy users hence would be blocked then. I sorting appart the attackers from legimate users is almost never 100% accurate.
    – humanityANDpeace
    Mar 12, 2014 at 9:38

1 Answer 1

Reset to default
3

sleep() won't slow down current generation brute force attacks all that much to begin with.

In general, bruteforce breakin attempts nowadays are executed via the same type of botnet used for DDoS attacks - so rather than a single source attempting one set of credentials after another, you'll be seeing hundreds or thousands of different sources attempting a single set without waiting for a response to one another. Whichever one scores a hit reports back, all the other zombies just shrug and move on.

If you have sufficient control over your server that you can tell your services to log bad login attempts to a file somewhere, you can set up something like fail2ban to handle blocking and unblocking attackers for you, but sleep() is going to be essentially useless against most modern breakin attempts while degrading performance for legitimate users who'll have to wait an extra second to get each new page.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .