The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [ddos]

Distributed Denial Of Service (DDOS) is the intentional paralyzing of a computer network by flooding it with data sent simultaneously from many individual computers (so-called zombies) which are used to stage DDOS attacks

Filter by
Sorted by
Tagged with
139
votes
8answers
31k views

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

I received the following email, addressed to me at an email address on my personal domain (for which I run my own mail server on a VPS): FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY ...
108
votes
4answers
65k views

What is the website checking about my browser to protect the website from a DDoS?

Some sites I visit take me to a page that says roughly, "Checking your browser before accessing example.com. DDoS attack protection by CloudFlare". What exactly about my browser is being checked and ...
102
votes
12answers
41k views

Why is it difficult to catch “Anonymous” or “Lulzsec” (groups)?

I'm not security literate, and if I was, I probably wouldn't be asking this question. As a regular tech news follower, I'm really surprised by the outrage of Anonymous (hacker group), but as a ...
100
votes
11answers
29k views

DDoS: Why not block originating IP addresses?

I'm a moderator of a major bulletin board. When a baddie shows up, we block their IP address; it works, at least until they find a new one. Why can't a protocol be developed for the world's routers to ...
75
votes
5answers
88k views

How do major sites prevent DDoS? [duplicate]

As far as I know, I have never heard of or seen any large scale web sites like Amazon, Microsoft, Apple, Google, or Ebay ever suffer from DDoS. Have you? I have a personal philosophy that the bigger ...
74
votes
5answers
35k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
74
votes
4answers
12k views

Did I participate in the recent DDoS attacks on Dyn's DNS service?

It was reported that the recent large scale DDoS attack affecting multiple websites in the US was done by hacking 10s of millions of devices and using them for the attack. How can one in general know ...
59
votes
2answers
14k views

How can ISPs handle DDoS attacks?

How can an ISP with low bandwidth like 50 Gbps handle a DDoS attack with more than this? I know there is a solution called "Black Hole". Is this enough to mitigate DDoS attacks or are there any other ...
57
votes
11answers
15k views

Can a DDoS attack yield any information?

Can a DDoS attack reveal any information or be used to mount a hack? My understanding is that the whole point of DDoS or DoS is to consume all of the resources/overload the server causing it to crash. ...
53
votes
6answers
8k views

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

Why are the recent DDoS attack against DNS provider Dyn, and other similar attacks successful? Sure a DDoS attack can bring an entity down, and if that entity controls DNS servers then queries to ...
47
votes
13answers
42k views

DDoS - Impossible to stop?

Is it possible - in theory - to stop1 a DDoS attack of any size? Many people claim it's impossible to stop DDoS attacks and tell me I just shouldn't mess with the wrong people on the internet. But ...
34
votes
2answers
7k views

How can a Software application defend against DoS or DDoS?

Most of the solutions for DoS attacks are not at the application level. In case I am using a proxy server, what are the possible countermeasures for DoS at the application level?
34
votes
2answers
4k views

Digging into DDoS attacks (includes hostile IP's from multiple honeypots)

I have been tracing a series of DDoS attempts, and am wondering if anyone else has seen anything like them. I've downloaded the following Powershell script which scrapes Terminal Server (RDP) Event ...
30
votes
3answers
11k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
27
votes
5answers
4k views

DDOS - security or operational risk?

The chief security officer of a medium sized IT company (400-500 employees) recently released a bulletin in which he stated that DDOS attacks are not a security risk but an operational one. Also I was ...
24
votes
6answers
5k views

Why do DDoS attacks cost a fortune to stop?

I have read so many stories that a major DDoS attack is causing companies thousands of dollars to mitigate. I have two questions: Is this because they try to keep the servers accessible to real site ...
23
votes
2answers
10k views

Reject IP packets with an ICMP error, or just drop them?

Consider an internet-facing host (the outer firewall). What should be done with undesired traffic: just drop it, or send back an ICMP error such as port unreachable? (In Linux terms: iptables -P DROP ...
22
votes
2answers
5k views

Does the amount of bandwidth available on a network determine how strong a DoS attack should be?

Does bandwidth alone determine how many packets a router or server can handle before the server is overran and then goes offline?
22
votes
4answers
11k views

Why does a (D)DoS attack slow down the CPU and crash a server?

So I get the basic idea of (D)DoS used for flooding, but I don't quite understand how this causes servers to crash or get them to slow down due to CPU overuse. As far as I know, the thing that is ...
22
votes
10answers
75k views

How do I know if my computer is being used for a botnet-based DDoS attack?

A botnet is a collection of compromised computers, each of which is known as a 'bot', connected to the Internet. When a computer is compromised by an attacker, there is often code within the ...
22
votes
3answers
6k views

Since I can set the source IP address to anything using raw sockets, does this mean I am untraceable?

For homework, I coded a TCP packet with raw sockets. So I was also able to change the source IP address to whatever I wanted. So why can't someone just make a program, which sends millions of these ...
22
votes
5answers
27k views

How to simulate DDoS attacks from the Internet?

The idea behind security tests is easy. You want to know what a hacker can do - you hire a security expert who acts like a hacker to see how far he can get. You want to know what an evil admin can do -...
20
votes
2answers
2k views

Web Developer's responsibility for DDoS [closed]

If my website is targeted for a DDoS attack after I have been paid for completing the website, and I get an angry phone call from the client regarding outage of service, what do I do? It hasn't ...
18
votes
5answers
6k views

Cloud-based DDoS as a Service

With the consolidation of cloud computing and virtualization, a really simple doubt comes to my mind: why isn't DDoS being largely offered as a service? Why don't we see cloud-based DDoS attacks? ...
18
votes
4answers
815 views

Global Blackout is a myth?

In order to shut the Internet down, anonymous claimed that putting-down the 13 root DNS servers of the Internet and therefore disabling the HTTP Internet, the most widely used function of the Web, ...
18
votes
3answers
2k views

NTP DDoS Attack on Home Servers

After some half-good script kiddies found out about this exploit or DDoS method, they have been doing it like crazy to websites, game servers, and now my home servers which allows me to work on some ...
18
votes
3answers
10k views

DNS Amplification DDOS attack

During the weekend I made some tests to simulate an DNS Amplification DDOS attack. sending about 90Mb/s traffic I was able to generate about x.x Gb/s amplified traffic which sent our datacenter ...
18
votes
4answers
7k views

Accessing a site (which is) under a DDoS

Lets say http://www.an-example-site.com is under DDoS attack. Alice, who does not have direct access to the hardware infrastructure, urgently wants some information which can be accessed through the ...
18
votes
1answer
1k views

Why is the Wikileaks site still accessible? How come it hasn't been hacked? [closed]

Let me get started by saying I think Wikileaks is great, and that their work is invaluable. Background/context for this question: The recent Wikileaks data dump on the CIA. I've visited the site ...
17
votes
7answers
2k views

Would it be possible to overload a large part of the internet, and if so then how?

Last week a news article went viral about a Dutch web hosting/data center company that was allegedly using a DNS amplification attack to DDoS an anti-spam company, because they blacklisting the former....
16
votes
6answers
9k views

What is a DoS Attack and how does it differ from a DDoS attack?

Can someone explain to me the concept of DoS attacks for web applications? Also, what is the distinction between DoS and Distributed DoS (i.e. DDoS) attacks? Wikipedia says: In computing, a denial-...
16
votes
1answer
2k views

How to make a report after a ddos attack? what information do I need to write on the report?

In my company, after a DDOS against a server, my employer asked me to make an analysis of the attack and to write down some stuff. What do you think I need to write down in my report? Is there any ...
15
votes
4answers
4k views

How to deal with this denial of service attack on an Apache server?

I was the target of different attacks today. The last one created this traffic on port 80. Apache is down and the load on server remains high. Firewall is enabled. Any suggestions? 15:27:10.203993 ...
15
votes
3answers
2k views

External websites in logs [duplicate]

I have a website, let's call it www.good.com. I've been getting a lot of requests to www.good.com under completely different URLs than www.good.com. I suspect this traffic is also causing some site ...
13
votes
8answers
11k views

How does CAPTCHA mitigate DDoS attacks?

This seems like an easy question, but I've failed to find an answer. One of the uses of CAPTCHA is to cope mitigate Denial of Service attacks. Suppose an adversary performs excessive login attempts, ...
13
votes
3answers
3k views

What prevents me from launching an SYN-ACK flood using HTTP servers?

I've been studying networks lately and this issue came across my mind. What prevents me from sending a lot of SYN requests with source address of my (attack's) target and flooding the target's ...
13
votes
4answers
10k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
13
votes
4answers
10k views

How to perform a proper DDoS test in a safe and controlled way?

What is the proper and safe way to perform a DDoS test without crashing the whole infrastructure? What different types of DDoS attacks are there and what things should be considered performing such a ...
13
votes
1answer
540 views

Siri DDoS over FM Radio

A few days ago I was driving home and suddenly Siri started to talk by herself in reply to a command I never gave. As you can imagine I have the "hey siri..." feature active, so I can make calls ...
13
votes
1answer
1k views

What happens inside of a DDoS Scrubbing Center?

I understand, that traffic is redirected to a scrubbing center during a DDoS to differentiate between malicious and legitimate traffic as has been explained in this post. However, from a technical ...
12
votes
4answers
7k views

mitigating anonymous DOS (tor combined with pyloris)

I found this rather scary video in youtube, that takes DOS to a whole new level, by making it look like coming from multiple sources. As a counter measure to Rsnake (Robert Hansen) slowloris.py script,...
12
votes
2answers
273 views

What is a Poison Dart attack?

From The Forrester Wave™: DDoS Services Providers, Q3 2015 report, (emphasis mine): Attack types defended CGI request, denial of capability, diluted low rate degrading, direct, DNS request ...
11
votes
3answers
19k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
11
votes
4answers
7k views

Can I protect my router from a Mirai Worm and how do I know if I'm vulnerable?

Today this article was published by the BBC: Talk Talk and Post Office routers hit by cyber-attack. It states: It involves the use of a modified form of the Mirai worm - a type of malware that is ...
11
votes
1answer
22k views

dns reflection attack vs dns amplification attack

Over the past few weeks I have heard discussions about a DNS reflection attack and a DNS amplification attack. Is there truly a difference between the two or are people just using 2 different names ...
11
votes
2answers
2k views

How to test against DDoS in a controlled enviroment?

Can you suggest me methods or tools that can help in simulating a DDoS attack in a controlled enviroment (like my private lab)?
11
votes
2answers
594 views

Sophisticated DDOS attack

According to this article, ProtonMail was the victim of a very sophisticated DDOS attack. "At 2pm there was a dramatic escalation," said Yen. According to Yen and Gargula the attackers smacked 15 ...
10
votes
5answers
5k views

Is it illegal to DDoS a phishing page? [closed]

I used to go on a site called blockchain.info For storing bitcoins but today when I entered the URL I was redirected to a phishing page. I have entered all my information and it was obviously sent to ...
10
votes
3answers
3k views

Is there any way to stop DDOS attacks? [duplicate]

As many other webmaster I am facing problems with DDOS attacks. I have tried denying offending IP addresses from htaccess files and using bigger and better hosting, but I am unable to stop the attacks ...
10
votes
2answers
8k views

Understanding Layer 7 DoS

I recently read this article about how a lone hacker (The Jester) conducts, amongst various other things, his DoS attacks over layer 7 instead of layer 4. It also mentions at one point he was able to ...