Questions tagged [ddos]

Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

Filter by
Sorted by
Tagged with
1
vote
1answer
73 views

Can someone perform DDoS on my VPS even if it is only accessible through SSH?

Can someone perform DDoS on my VPS even if I have not installed any webserver software like apache, nginx, etc.? Since I have not installed any webserver software, it's not really available to the ...
2
votes
1answer
156 views

What's the limiting resource that makes DDoS attacks possible?

I often see DDoS attacks compared by network traffic, for example: The biggest DDoS attack to date took place in February of 2018. This attack targeted GitHub, a popular online code management ...
1
vote
2answers
1k views

DDOS attacks and multi-threading

Does a host create a separate thread for each TCP SYN request? Or it depends on the socket implementation for the host?
1
vote
1answer
77 views

Protect Wordpress against ddos attack [closed]

The above screenshot is from my website's cpanel visitors list.My website is build on wordpress. And I think someone is trying hard to crack open my website with DDOS attack and drain out my 10gb ...
1
vote
0answers
50 views

What are spammers trying to acheive who only provide the correct contact information in their spam? [closed]

I've recently received 2 spam SMS messages, claiming to be from 2 different organizations, but (obviously) not sent by them. However, all of the contact details in the SMS match the real details of ...
1
vote
1answer
233 views

How fill up a gig interface bandwidth with hping3?

I've been trying to test our software against DOS attacks. So, I used 'HPing3' but it just fills up 10-11M of my interface's bandwidth! I ran the tool 40 times, I mean 40 hping3 processes, ...
2
votes
2answers
125 views

How to protect Authentication API from a DDoS attacks?

After Login, severs can check authorization, tokens etc at API and WAF levels to mitigate DDoS attacks. But this can only happen after user has logged in. How can we protect DDoS attack on login API? ...
5
votes
2answers
146 views

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

I am trying to understand how a CDN (like Cloudflare e.g) does protect against a DDoS attack. I would think that the internet traffic is routed through a CDN's reverse proxy, then filtered. This ...
16
votes
6answers
9k views

What is a DoS Attack and how does it differ from a DDoS attack?

Can someone explain to me the concept of DoS attacks for web applications? Also, what is the distinction between DoS and Distributed DoS (i.e. DDoS) attacks? Wikipedia says: In computing, a denial-...
0
votes
1answer
97 views

How do attackers hit a website with thousands of similar but distinct IP addresses?

I have a website that is being hit with invalid URL requests by thousands of distinct IP addresses, never the same one used twice. Most of them are in a few ranges of IP addresses and often just go ...
1
vote
1answer
43 views

UDP amplification: length(response_packet) < length(request_packet)

I was researching the GitHub DDoS attack of 2018, in which memcached UDP amplification was used. I noticed that a GitHub blog post referenced a CloudFlare post which described memcached-based UDP ...
0
votes
0answers
30 views

Fundamental difference in security research in Cloud platform VM and normal machine

I am trying to study the effects of various network based attacks in an Openstack Cloud environment that I have setup with few machines. However, what would be the fundamental difference between a VM ...
3
votes
3answers
19k views

What is the Akamai Name Server I see for some big companies?

I have played with DNS a lot lately, and I have found that some big companies' web sites use the Akamai NS as the Name Server for their WWW servers, for example: $>nslookup > www.redhat.com ...
-1
votes
4answers
137 views

DDoS implication on your network?

DDoS attack can be used to infiltrate your network for attackers to try to exploit the machines in the inner network ? Or it just attack that meant to disrupt the daily operation of a Network.
0
votes
1answer
69 views

Is it possible to DDos a http wan filterd router? [closed]

Like the service is there but it's just filterd enabled for lan access only .. what will happen ?
0
votes
1answer
518 views

My router is getting port scan attacks [duplicate]

My internet suddenly cut out yesterday, i checked the router and it looked like nothing is wrong. I looked at the logs and i see this 2019-08-18 12:50:39 Security Warning Detect UDP port scan ...
3
votes
2answers
152 views

How do I prevent traffic on my site from a source other than Cloudflare?

I use Google Cloud Platform to serve the site I manage. I have one load balancer there, which controls the movement to several virtual machines. When I came across the problem of DDOS attacks on ...
0
votes
2answers
1k views

How to prevent ddos and brute-force attack by restricting IP's on Wordpress website

I want to make wp-login.php and/or wp-admin accessible only from one country. If I want wp-login.php access only from USA then my approach from .htaccess is like below <Files wp-login.php> ...
1
vote
1answer
40 views

Rate limiting API with PBKDF2 challenge?

Assume I have a public API endpoint which I'd like to protect against abuse. I'd like to implement a solution that ensures that the client spends some computational time before allowing the request to ...
109
votes
4answers
69k views

What is the website checking about my browser to protect the website from a DDoS?

Some sites I visit take me to a page that says roughly, "Checking your browser before accessing example.com. DDoS attack protection by CloudFlare". What exactly about my browser is being checked and ...
0
votes
0answers
116 views

Unkown attack on linux server wordpress website

I have a WordPress site. Recently under a serious DDoS attack. For this WordPress site I use nginx, varnish and apache in the backend. A part of access log shows this: 24.41.213.36 - - [23/Jun/...
-3
votes
2answers
87 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
1
vote
1answer
106 views

Why is GRE tunneling is needed when having a BGP based solution against DDoS?

I understand that GRE tunneling is very handy when sending the data back to the client after scrubbing because it's designed to ensure that the data is sent reliably by initiating a private point-to-...
4
votes
2answers
6k views

Where can I get a list of “bad” IP addresses that are likely to be used by attackers or spammers? [closed]

Is there an open source project or a list of "bad" IP addresses or ranges that are likely to be used by attackers or spammers? UPDATE: ideally I want it to be a service call so I can call it using ...
1
vote
3answers
145 views

What can be done against DDoS attacks when I just have only small number of “known” clients reaching a server?

Description of the Situation: Let's say 1000 "known" clients/workers are collecting time-sensitive data from the field and sending to a server. Therefore, we need to secure the server from DDoS ...
2
votes
3answers
303 views

Is it possible to defend against a backscatter attack?

Yesterday, some spammer on the other side of the world decided to send out a ton of phishing mails with my business mail address as both From address and envelope sender. The usual best practices are ...
4
votes
2answers
281 views

Why were hyperlink auditing pings used for DDoS attacks and not any other requests?

A few days ago this new story has been published: Researchers have found that the HTML feature called hyperlink auditing, or pings, is being used to perform DDoS attacks against various sites. This ...
2
votes
1answer
330 views

SYN Flood from fixed spoof IP but receive only one packet

I'm generating a network flood with a lot of packets coming from one fixed IP+port pair (in this example, 1.2.3.4:2003). Why do I only see one SYN_RECV'd packet in netstat on the victim machine?
0
votes
2answers
191 views

Website is behaving strangely - was it attacked?

Our website was behaving strangely. Sometime it was down and nothing was accessible. Sometime it started loading but pages browsing was too slow. We checked apache logs and found the below ...
1
vote
2answers
170 views

Please help diagnose multiple incoming packets

We have an internet-facing router and it is significantly slowed down. We investigated the network traffic and came up with following information: All the packet size is same (i.e. 40 bytes) All ...
-1
votes
1answer
127 views

Cloud based solution to prevent DDoS attack on multiplayer game server?

I built an architecture below: How does it work (and if it's possible) Assuming your game server currently runs on Node 1 and then Node 1 gets a successful DDoS attack. Your cloud system has ...
1
vote
0answers
2k views

LAN-side UDP Flood [closed]

My internet has been really slow these days, and it takes around 5 minutes after the computer starts to even being able to open a webpage. I've checked my router logs and it says I'm being port ...
5
votes
3answers
6k views

Can anyone DDOS my server with jmeter? Do they need a powerful server for that?

Is there a way to DDOS my web app through jMeter? Can anyone DDOS with a simple PC? I couldn't find any answer here. I would appreciate if anyone could help me out.
5
votes
4answers
496 views

Public API security: authentication vs. rate limiting etc

We are raising a SaaS product that allows businesses to setup and orchestrate selling of a certain class of goods/services. This product has an API in its core and an ecosystem of various apps around ...
7
votes
2answers
1k views

I'm having a DDoS attack, my hosting company is not giving me a solution, and I need to know what is hapening

So ok, right now my windows 2003 dedicated server is under attack by some guy who's flooding UDP packets (~90.000 packets/sec) on my 100Mbps server for the last 8 hours. I'm on a shared port, so I'm ...
0
votes
1answer
171 views

519 tls handshake attempts in 3 seconds, with 415 within one second, was this a DDOS attack?

This morning our webserver was unresponsive to say the least. The connection was lost, the database connection we have was sluggish to say the least. I was forced to do a reboot via the remote hosting ...
2
votes
1answer
393 views

Thousands of 28000 “no pg_hba.conf entry for host” logs from Postgres - is this an attack?

Since yesterday afternoon my production Postgres database hosted on Amazon EC2 has been logging thousands of errors (averaging one or two per second) that all follow the format: sql_error_code = ...
5
votes
1answer
223 views

a mysterious & pointless long-term hacking attempt?

It seems that I am the target of a mysterious ongoing hacking attempt. I have several domain names, most of which are currently parked & pointed at a single ‘main’ website. For the last couple ...
0
votes
0answers
27 views

Which metrics can be considered in the context of DDoS-similarity analysis?

What data should be collected if i want to bind two different DDoS-attacks? In example i want to build a model, which will calculate the similarity of two DDoS-attacks. The basic metrics should be: ...
0
votes
1answer
362 views

How did facebook DDoS me?

About 1 day ago my router was being DDoS by some people and one of the ip addreses was Facebook's. Can anyone explain this? [DoS Attack: ACK Scan] from source: 31.13.65.50, port 443, Saturday, ...
2
votes
4answers
1k views

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood attack?

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood (SYN Reflection) attack?
-1
votes
2answers
404 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
1
vote
1answer
118 views

How does IP traceback works? [closed]

In part prompted by the difficulties in determining the true origins of DDOS attacks featuring spoofed IP addresses, researchers have attempted to develop the concept of IP traceback: determining ...
3
votes
2answers
26k views

Am I getting DDOS attacked?

There has been some weird activity with my WiFi router after somebody threatened to DDoS me. I am looking at my WiFi router's activity logs and I don't know what I am looking for. What happens is my ...
1
vote
1answer
70 views

Blockchain + shared unused bandwidth as the proxy front = ddos mitigated?

Pentesting the new webapp that we have developed before having an external source have a go at it and give us a risk assessment. Now we have come to the portion right at the end; DDOS. For the most ...
2
votes
2answers
163 views

How do you detect a Memcached DDoS attack on your server?

In terms of early detection, how could a sysadmin detect that a Memcached DDoS attack took place?
7
votes
1answer
306 views

Do major ISPs still ignore IP spoofing?

I was reading this question: Why don't ISPs filter on source address to prevent spoofing? and based on those answers, ISPs ignore it because of the overhead of checking for spoofing. But that ...
10
votes
2answers
8k views

Understanding Layer 7 DoS

I recently read this article about how a lone hacker (The Jester) conducts, amongst various other things, his DoS attacks over layer 7 instead of layer 4. It also mentions at one point he was able to ...
22
votes
4answers
11k views

Why does a (D)DoS attack slow down the CPU and crash a server?

So I get the basic idea of (D)DoS used for flooding, but I don't quite understand how this causes servers to crash or get them to slow down due to CPU overuse. As far as I know, the thing that is ...
1
vote
1answer
81 views

How link flooding DDoS attack remain undetected?

I read some explains or paper about link flooding DDoS attack, which is new relatively. For example "employs legitimate, low-density flows to flood a group of selected links. Therefore, these ...