Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

learn more… | top users | synonyms

12
votes
3answers
2k views

What prevents me from launching an SYN-ACK flood using HTTP servers?

I've been studying networks lately and this issue came across my mind. What prevents me from sending a lot of SYN requests with source address of my (attack's) target and flooding the target's ...
-10
votes
0answers
53 views

how to DDOS a server with DDOS protection and get away with it? [on hold]

i need info about this just for learning
2
votes
1answer
116 views

I am being DDoSed for no reason, how can I protect myself?

I recently experienced an unprovoked DDoS attack with a speed of 8Tbps against my website from over 80k unique IP addresses and I was wondering is there any way to protect myself against these ...
0
votes
2answers
49 views

Repeated “Dos Attack” from remote IPs

I've been having some weird issues with a home network, and it seems to me like I have some vulnerability I don't know about. To be honest, though, I'm not a big network/security guy and I kind of ...
1
vote
0answers
44 views

What attack-methods for HTTP/L7-Attacks (Reflection and Co.) are you aware of [closed]

I know the following and would like to collect some more methods on how to attack websites and services via misused 3rd-party-applications: Wordpress PingBack/xmlrpc (seen a lot and wildly used) ...
3
votes
2answers
70 views

Should HSTS header be sent on an error response?

We need to configure our loadbalancer to send the HSTS header and we are debating whether or not to send the header on HTTP 4xx/5xx responses. Our main concern is application layer DDos attacks. We ...
128
votes
10answers
24k views

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

I received the following email, addressed to me at an email address on my personal domain (for which I run my own mail server on a VPS): FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY ...
-1
votes
0answers
64 views

Explanation for these entries in the Suricata fast.log?

We have installed Suricata on our system. We have the following similar lines in our fast.log. Can anyone explain these lines? 03/17/2016-17:18:52.744707 [**] [1:2200075:1] SURICATA UDPv4 invalid ...
0
votes
0answers
39 views

DDoS Solution for request floods [duplicate]

What are the mitigations to protect from ddos? Is using firewall like cloudflare would help or not? My use case is just want to make sure that no one is sending flood of requests i.e. thousands per ...
1
vote
0answers
29 views

SYN Flood from fixed spoof IP but receive only one packet

Why i flood many packet to a victim from 1 fixed IP+Port. But on Victim i netstat see only one SYN_RECV packet
9
votes
2answers
306 views

Sophisticated DDOS attack

According to this article, ProtonMail was the victim of a very sophisticated DDOS attack. "At 2pm there was a dramatic escalation," said Yen. According to Yen and Gargula the attackers smacked 15 ...
0
votes
0answers
61 views

From a topological point of view, are there any network structures which weaken a DDoS attack?

I am aware that I am doing some abstractions here (link-layer-3/link-layer-2 and router topology comparison, for instance). However, I wonder if there are any network structures (so-called ...
1
vote
1answer
72 views

DDoS amplification attacks

I have been learning DDoS atacks and how to be protected from it. But I have a question: What are the common services being misused in UDP amplification DDOS attacks?
2
votes
1answer
61 views

If a firewall deletes DOS packets before they reach the designated application. Is it then possible to break trough the firewall with a DDOS attack?

My Question is that if a Firewall blocks for example a DOS attack of UDP packets. Is it then possible to "break" or take up the capacity of a server by sending enough packets trough a DDOS attack? or ...
2
votes
0answers
56 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
3
votes
1answer
46 views

Does using the same mail and web server increase a risk of DDos due to IP exposure?

I use the same server for sending my emails and web hosting. I send user registration and support forum mails from my server and occasional marketing mails or newsletters. I read on a CloudFlare blog ...
10
votes
3answers
2k views

Is there any way to stop DDOS attacks? [duplicate]

As many other webmaster I am facing problems with DDOS attacks. I have tried denying offending IP addresses from htaccess files and using bigger and better hosting, but I am unable to stop the attacks ...
1
vote
0answers
96 views

How to keep my VPS server up on Hulk.py attack

This question in not duplicated, I tried everything that was published on stackexchange websites, but could not fix my problem. I have a web server. OS: Ubuntu 15.10 Configured on Apache2 Ram: 1.5 GB ...
1
vote
1answer
80 views

Dealing with a DDoS: horizontal vs vertical scaling?

I'm reading this paper about DDoS protection in AWS. One of the benefits of EC2 is that depending on the instance, it can scale for minimizing the effect of the attack. In the paper there are two ...
0
votes
4answers
311 views

How can I remove an unknown device from my wifi network?

I have an OnHub (from Google), and there is a device I don't know on my wifi network. Is there some way for me to kick it, or DDoS it, whether through some command line command on windows or ubuntu, ...
3
votes
1answer
59 views

In house mitigation for a volumetric DDoS attack

Can a volumetric DDoS attack be mitigated by some in house defense or does the defense always need to be on the cloud? If yes, then why?
2
votes
0answers
57 views

Securing API against DDoS attacks

I have designed a backend service which is only accessible via a custom REST API. As I understand, services such as CloudFlare are designed to protect HTTPS traffic, and do not apply for custom APIs. ...
0
votes
0answers
60 views

Are link-flooding attacks a real threat or only an academic scenario?

I read some papers about link-flooding attacks (i.e. flooding network links) and I wonder if these attacks are really of relevance in the real-world and what makes them so dangerous compared to ...
0
votes
2answers
134 views

How hackers implemented DDoS attack with 602 Gbps?

Everybody's heard about DDoS attack with 602Gbps Bandwidth that crashed BBC site, But is really Botnets and hacked servers can implements an attack in this scale ?
0
votes
0answers
121 views

Wordpress pingback attack

I am getting Wordpress pingback attach on my server. I tried to put if condition on nginx to block deny all requests that contains "Wordpress" in the header. It works fine but still nginx get millions ...
0
votes
2answers
82 views

Preventing a web-page from getting hit from another server

A DDoS attack may result from a website attempting to access the resource of another website. For instance, example.com (attacker) is trying to access resources on example.net (victim). The ...
4
votes
1answer
139 views

How can CloudFlare save your website if the attacker knows the IP of the server?

I saw CloudFlare's services where you need to change the DNS of your domain name to their provided DNS address. The traffic coming as "mywebsite.com" goes through CloudFlare. What if I have a ...
1
vote
2answers
141 views

DDoS Mitigation - Whitelist or Blacklist Incoming SOURCE Ports?

For a network offering webservices, I have had recommendations to blacklist a couple of common incoming DESTINATION ports, such as UDP 53, to combat the increasing load from DDoS. I'm wondering if it ...
2
votes
0answers
77 views

CPU load of iptables to deny IPs during DDoS event [closed]

If a server has an external IP address protected with an iptables whitelist rule to reject all by default except from 3 ip addresses ip1, ip2 and ip3. If someone identifies this external IP address, ...
1
vote
0answers
48 views

How to find which domain in my VPS triggered a DDoS attack with WP xmlrpc

Today, my data center suspended my VPS for DDoS attack reasons. They say one of my clients, that has WordPress website, started a DDOS attack to another websites using xmlrpc. But I don't know which ...
1
vote
0answers
102 views

What is an Origin Error Attack?

Similar to my previous question here, however I thought it was best to ask two separate questions rather than combining them into one. From The Forrester Wave™: DDoS Services Providers, Q3 2015 ...
11
votes
2answers
178 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS ...
1
vote
2answers
268 views

Where can I get a list of “bad” IP addresses that are likely to be used by attackers or spammers? [closed]

Is there an open source project or a list of "bad" IP addresses or ranges that are likely to be used by attackers or spammers? UPDATE: ideally I want it to be a service call so I can call it using ...
3
votes
1answer
102 views

What's the best way to block all external proxy IP's which could be used for pivot points or as a DDOS Source?

At the simplest form - the question is to block external proxy due to an emergency situation due to which management have forced technical teams to get a solution to block all the external proxy or ...
1
vote
1answer
118 views

What is the role of IP spoofing in DDoS attacks?

I've read that IP spoofing is often used in denial of service attacks, and I've also just recently read about ingress filtering, which attempts to use blacklisting to filter out spoofed IP addresses ...
0
votes
1answer
71 views

Why is a DNS Amplification attack considered a DDoS attack?

My understanding is that a DNS Amplification attack involves sending a DNS resolver a bunch of requests with a spoofed sender address, which is the victim's. The DNS responds to this IP address with a ...
1
vote
1answer
122 views

Must an attacker using a Smurf attack be on the same network as the victim?

I'm learning about Smurf Attacks. Since they need to use a broadcast address, doesn't that mean they can't work over the internet? For example if an attacker sends a router the packet with the ...
0
votes
0answers
760 views

What are the most popular DNS amplification attack tools for Windows and Linux?

I would like to test my edge-router firewall rules against some DNS amplification attack traffic. I could run some DNS lookup utility in an endless loop, but maybe there are some dedicated utilities ...
1
vote
2answers
70 views

How can perpertrators of denial of service attacks, determine the impact their attack has had?

Although I know how a user could mitigate Dos attacks and detect their presence e.g. checking packets received and sent, comparing current CPU usage to normal, comparing network usage to normal etc. ...
0
votes
1answer
44 views

Additional Protection Against DDoS

We have subscribed to an upstream ISP's protection service to protect against DDoS. I am thinking of developing a incident procedure in case my ISP's DDoS mitigation fails (highly unlikely right?). ...
1
vote
2answers
130 views

What danger can come from D-DoS over VPN

Every time I use VPN, I get a message to notify me to be sure that my PC is 'healthy' from pots infections. Also I've read in this article to stay away from that. My question, what damage could ...
0
votes
3answers
189 views

Why does an overload of requests give one root access all of a sudden?

There's this saying that using a DDOS-attack, people first attack a server using millions of concurrent requests and by doing that they miraculously gain access to the server. How does this work? Why ...
4
votes
1answer
276 views

Can a Cisco ASA 5505 block this DDoS attack?

Since more than a week ago, my dedicated server (located at ovh.com) has been under TCP SYN (I think) attack. OVH don't care about it but this attack is killing my server with a high CPU load ...
3
votes
1answer
167 views

DDoS Attack Protection

Recently I've been threatened with an IP Address DDoS attack. I was wondering in what ways and how could I stop this attack. I'd really like to be able to do this without my parents finding out.
31
votes
2answers
880 views

Digging into DDoS attacks (includes hostile IP's from multiple honeypots)

I have been tracing a series of DDoS attempts, and am wondering if anyone else has seen anything like them. I've downloaded the following Powershell script which scrapes Terminal Server (RDP) Event ...
0
votes
0answers
127 views

Deny IP spoof from on ASA destination

on Cisco ASA I am seeing lost of logs like following (127.108.61.90) to 190.93.249.93 on interface inside (127.30.171.61) to 190.93.249.93 on interface inside (127.105.54.108) to 190.93.248.93 on ...
3
votes
3answers
1k views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
3
votes
1answer
158 views

Common attacks when no ports are open

If you have a web server with all ports closed (except, of course, the necessary HTTP) what kind of attacks can an attacker use to hack into the system? Are the only vulnerabilities stuff like ...
1
vote
2answers
357 views

How can someone DDoS me?

If I've not opened the port 80, how can someone DDoS me? Is there a method or is it possible? Someone said that it's possible, but I'm not so sure, that's why I'm asking here.
4
votes
2answers
111 views

How do DoS attacks work on non-servers?

I understand how DoS/DDoS attacks work on servers. If I have not been misled, it is possible to DoS/DDoS a system that does not act as a server, but is still connected to the internet. How is this ...