3

I manage a website that is a "bad magnet" for our competitors.
I am using Incapsula CDN + WAF and I have internal proxy for caching.

CMS/WP from its nature is very data consuming, I have check that, and on every page there can be more than 80 queries to the mysql just to render a single page that is not cached.

The problem is that with jmeter or a simple script you can request a page that is not cached every millisecond, this will query the database 8,000,000 times in one minute and remove the site after less than very short time.
Since all the caching systems / proxies are based on url, asking random url that is not cached is very simple. http://www.example.com/?random=256966512564216456 .
This is how I actually made my site go down in the staging environment.

Is there any http proxy / security product that knows how to deal with these kind of attacks?

My system is WordPress installed on nginX on CENTOS.

Thanks

1

Contact Incapsula's support, they will help you set up a rule that prevent scripts/headless browsers from requesting random URLs. it can be easily done using their system

0

This problem can be dealt with a couple of layers.

  • First of all, WordPress is slow, but it shouldn't cause your site to go down. Consider reviewing your WordPress installation. Consider reviewing your static content to ensure it is cached, as well as using a WordPress caching plugin. Additionally, check to make sure that your install is caching PHP execution using PHP-APC.
  • WAFs are extremely slow (and make the application slower). Consider separate hardware to run your WAF. Which brings me to the next suggestion.
  • Cloudflare addresses many of these problems. Cloudflare transparently caches content, and is distributed by their own CDN. Additionally, Cloudflare has mod_security built in, and it can be used with your own rulesets. If an adversary is DDoS'ing your server with random requests, then Cloudflare will prompt these nodes with a CAPTCHA and add its IP address to a blacklist.
  • This is not answering my question, cloudflare does not support random url defense. the question is not about how to make wordpress fast, its about how to secure random url. thanks – SexyMF Feb 9 '15 at 6:38
  • @SexyMF cloudflare blocks bots from exploiting the DoS vulnerability that has been introduced to wordpress instance. It 100% solves the symptoms of your weakness, but not the underlying problem. The DoS vulnerability should be completely and totally addressed by the first bullet point. – rook Feb 9 '15 at 14:14
  • You can use Incapsula to block random urls if you can white-list the requests your site should be getting. Incapsula's WAF is superior to the mod_security CloudFlare is using. – YSY Apr 27 '15 at 13:25
  • In re to your 2nd point. Incapsula is a cloud-based WAF, operating on top of a CDN. Both it and CF were repeatedly pentested, this is the most recent comparison. slideshare.net/zeroscience/cloudflare-vs-incapsula-round-2 – Igal Zeifman Jul 19 '15 at 6:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.