Questions tagged [ddos]

Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

Filter by
Sorted by
Tagged with
4
votes
2answers
108 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
2
votes
2answers
100 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
-5
votes
3answers
77 views

What are the steps necessary to perform a Denial of Service (DoS) attack, assuming i have someones IP? [closed]

How do I run a successful DoS attack? This is one of the most simple attacks out there, and yet I have no idea how to perform one. From what I understand, when you send a network IP packets of bytes,...
0
votes
1answer
90 views

How do attackers hit a website with thousands of similar but distinct IP addresses?

I have a website that is being hit with invalid URL requests by thousands of distinct IP addresses, never the same one used twice. Most of them are in a few ranges of IP addresses and often just go ...
1
vote
1answer
37 views

UDP amplification: length(response_packet) < length(request_packet)

I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
0
votes
0answers
30 views

Fundamental difference in security research in Cloud platform VM and normal machine

I am trying to study the effects of various network based attacks in an Openstack Cloud environment that I have setup with few machines. However, what would be the fundamental difference between a VM ...
-1
votes
4answers
136 views

DDoS implication on your network?

DDoS attack can be used to infiltrate your network for attackers to try to exploit the machines in the inner network ? Or it just attack that meant to disrupt the daily operation of a Network.
0
votes
1answer
68 views

Is it possible to DDos a http wan filterd router? [closed]

Like the service is there but it's just filterd enabled for lan access only .. what will happen ?
0
votes
1answer
208 views

My router is getting port scan attacks [duplicate]

My internet suddenly cut out yesterday, i checked the router and it looked like nothing is wrong. I looked at the logs and i see this 2019-08-18 12:50:39 Security Warning Detect UDP port scan ...
3
votes
2answers
133 views

How do I prevent traffic on my site from a source other than Cloudflare?

I use Google Cloud Platform to serve the site I manage. I have one load balancer there, which controls the movement to several virtual machines. When I came across the problem of DDOS attacks on ...
1
vote
1answer
39 views

Rate limiting API with PBKDF2 challenge?

Assume I have a public API endpoint which I'd like to protect against abuse. I'd like to implement a solution that ensures that the client spends some computational time before allowing the request to ...
0
votes
0answers
113 views

Unkown attack on linux server wordpress website

I have a WordPress site. Recently under a serious DDoS attack. For this WordPress site I use nginx, varnish and apache in the backend. A part of access log shows this: 24.41.213.36 - - [23/Jun/...
-3
votes
2answers
86 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
1
vote
1answer
90 views

Why is GRE tunneling is needed when having a BGP based solution against DDoS?

I understand that GRE tunneling is very handy when sending the data back to the client after scrubbing because it's designed to ensure that the data is sent reliably by initiating a private point-to-...
1
vote
3answers
142 views

What can be done against DDoS attacks when I just have only small number of “known” clients reaching a server?

Description of the Situation: Let's say 1000 "known" clients/workers are collecting time-sensitive data from the field and sending to a server. Therefore, we need to secure the server from DDoS ...
4
votes
2answers
271 views

Why were hyperlink auditing pings used for DDoS attacks and not any other requests?

A few days ago this new story has been published: Researchers have found that the HTML feature called hyperlink auditing, or pings, is being used to perform DDoS attacks against various sites. This ...
-1
votes
1answer
118 views

Cloud based solution to prevent DDoS attack on multiplayer game server?

I built an architecture below: How does it work (and if it's possible) Assuming your game server currently runs on Node 1 and then Node 1 gets a successful DDoS attack. Your cloud system has ...
0
votes
1answer
146 views

519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack?

This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting ...
5
votes
1answer
220 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
2
votes
1answer
344 views

Thousands of 28000 “no pg_hba.conf entry for host” logs from Postgres - is this an attack?

Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format: sql_error_code = ...
4
votes
4answers
462 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
0
votes
0answers
27 views

Which metrics can be considered in the context of DDoS-similarity analysis?

What data should be collected if i want to bind two different DDoS-attacks? In example i want to build a model, which will calculate the similarity of two DDoS-attacks. The basic metrics should be: ...
0
votes
1answer
298 views

How did facebook DDoS me?

About 1 day ago my router was being DDoS by some people and one of the ip addreses was Facebook's. Can anyone explain this? [DoS Attack: ACK Scan] from source: 31.13.65.50, port 443, Saturday, ...
2
votes
4answers
1k views

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood attack?

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood (SYN Reflection) attack?
1
vote
1answer
104 views

How does IP traceback works? [closed]

In part prompted by the difficulties in determining the true origins of DDOS attacks featuring spoofed IP addresses, researchers have attempted to develop the concept of IP traceback: determining ...
1
vote
1answer
69 views

Blockchain + shared unused bandwidth as the proxy front = ddos mitigated?

Pentesting the new webapp that we have developed before having an external source have a go at it and give us a risk assessment. Now we have come to the portion right at the end; DDOS. For the most ...
0
votes
1answer
180 views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
1
vote
2answers
165 views

Please help diagnose multiple incoming packets

We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information: All the packet size is same (i.e. 40 bytes) All ...
0
votes
2answers
190 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
7
votes
1answer
286 views

Do major ISPs still ignore IP spoofing?

I was reading this question: Why don't ISPs filter on source address to prevent spoofing? and based on those answers, ISPs ignore it because of the overhead of checking for spoofing. But that ...
1
vote
1answer
78 views

How link flooding DDoS attack remain undetected?

I read some explains or paper about link flooding DDoS attack, which is new relatively. For example "employs legitimate, low-density flows to flood a group of selected links. Therefore, these ...
1
vote
1answer
412 views

Nginx: mod-security rule for http slow DoS attack

The only related rule in mod-security for slow DoS is modsecurity_crs_11_slow_dos_protection, and it's for Apache only. Is there a rule for Nginx?
3
votes
1answer
120 views

Firewall Showing 1,000's Of Strange GET Parameters Being Sent To Login Page?

So I woke up today, and checked my Firewall Events on CloudFlare for my website like I do normally. Most of the time I'll just see thousands of failed SQL injection attempts, but this morning I was ...
3
votes
3answers
377 views

Suspicious “100% guaranteed” web hosting security package

Notes: I have very limited knowledge and experience in this field. My boss does not want to spend a penny more that what we already paid for. The website has a form that sends a message to our email ...
-1
votes
1answer
222 views

Why the DDoS attacker need many zombie machine for attack? [duplicate]

Why the DDoS attacker need many zombie machine for attack? if attacker has one machine for generate enough attack traffic for its business(DoS), does it still need many zombie machine(DDoS)? what's ...
4
votes
3answers
3k views

Threshold for DDOS Attack

I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of ...
2
votes
3answers
260 views

Is it possible to defend against a backscatter attack?

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender. The usual best practices are ...
1
vote
0answers
101 views

Will More vCPU's and RAM Help Protect Against Some Smaller Scale DDoS Attacks?

Obviously having more vCPU's (virtual CPU's) and more RAM by them self won't be able to alone help stop and/or prevent a DDoS attack, but let's say after a DDoS attack is finished and/or slowing down ...
2
votes
1answer
529 views

Amazon EC2 Abuse Report

My company recently received an email from Amazon which notified us of malicious activities occurring on our running EC2 Instance. The email states: We observed machines under your control ...
0
votes
1answer
433 views

Can I assume that an empty user agent will always be a robot?

I want to prevent robots flooding my website and I'm thinking about a ban in these cases... Can I assume that an empty user agent will always be a robot?
1
vote
3answers
655 views

How to detect when one or more devices in my local network have become DDOS attack nodes?

I have a home network, big family, with around 20 devices on it at any given time. It seems like every year or so, some device gets a virus or a security flaw is revealed, and the device starts ...
7
votes
4answers
675 views

Most reduced types of DoS attacks

As I understand it, there are generally only two common types of Denial of Service attacks in regards to the OSI model: Network-Layer-DoS (NLDoS) on layers 3, 2 or 1. Application-Layer-DoS (ALDoS) on ...
-4
votes
1answer
128 views

TCP protocol Denial-of-service attack [closed]

There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol ...
2
votes
2answers
162 views

How do you detect a Memcached DDoS attack on your server?

In terms of early detection, how could a sysadmin detect that a Memcached DDoS attack took place?
-2
votes
1answer
237 views

What is the difference between DNS flood attack and UDP flood attack?

As title says, what is the difference between DNS flood attack and UDP flood attack? Plus, do they only exhaust the network bandwidth or do they also exhaust the server-side assets such as CPU, ...
3
votes
3answers
424 views

Is a DoS attack possible on a single home connection when the ISP uses NAT?

Today almost all ISPs use a NAT system to assign more people the same IP (at least where I am), probably because the IPv4 addresses are ending and they want to save money. Is it possible to make a DoS ...
-2
votes
2answers
251 views

Why is DDOS is one of the most common Cyber-Attack? [closed]

Based on some articles and some research DDOS is one of the most common cyber-attack. There are tonnes of articles out there about the DDOS subject, including describing, mitigating, the question "...
2
votes
1answer
814 views

Difference between DNS flood attack and DNS amplifier attack [duplicate]

I am trying to understand DNS flood and DNS amplifier attack. I have read the definition and am still confused, could you give me an example of each attack or tell me the differences between them? It ...
0
votes
1answer
221 views

What Are the Algorithm and techniques of IP Traceback?

In most of the cases the cyber attacks such as a DDoS attack or other kinds, it is sometimes hard/impossible to identify the real source IP addresses. This is because when you review the logs and ...
0
votes
1answer
63 views

Why does Spamhaus' CBL blocklist return records for 1.1.1.1 and 8.8.8.8?

I'm looking up ips with the following code import dns.resolver resolver = dns.resolver.Resolver() resolver.timeout = 0.10 resolver.lifetime = 0.10 resolver.nameservers = ['127.0.0.53'] searchIp = '8....