Skip to main content
98 votes
Accepted

How can ISPs handle DDoS attacks?

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the ...
Teun Vink's user avatar
  • 6,918
8 votes

What is the Akamai Name Server I see for some big companies?

It's a couple of things. The answers above are right, but also missing an important feature. It is for DDoS prevention. DNS is one of the last unencrypted, unauthenticated, UDP protocols in common ...
Brian Sniffen's user avatar
7 votes
Accepted

How to ensure the third party CDN is secure (and stays secure)?

The security measures you are thinking of already exist. Take a look at this example from jQuery's CDN page: <script src="http://code.jquery.com/jquery-3.3.1.min.js" integrity="sha256-FgpCb/...
multithr3at3d's user avatar
6 votes
Accepted

Should a CDN service like Cloudflare protect against Brute Force Attacks, or only from DDoS?

But should a CDN service like Cloudflare protect against Brute Force Attacks... TL;DR: Not should but could - but in case of Cloudflare there is actually such functionality. A CDN is a content ...
Steffen Ullrich's user avatar
6 votes
Accepted

Does Cloudflare masking my IP make my server more secure?

Yes. The idea is that you block all HTTP and HTTPS connections to your server, except those originating from Cloudflare's network. Therefore, your server cannot be attacked directly - all HTTP and ...
mti2935's user avatar
  • 23.6k
5 votes
Accepted

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

IP whitelist is an imperfect solution because it's fiddly. CloudFlare's global network of reverse proxies themselves aren't necessarily a static list of IP addresses. If CloudFlare added new IP Range, ...
Lie Ryan's user avatar
  • 31.4k
4 votes
Accepted

Is it possible to scan the whole IP range to find a domain behind the CDN?

There is no need to scan the whole IPv4 space. Completely wasteful. If you already know the CDN, then you can easily find the ASN and all the IP ranges under that AS. Very large organizations may run ...
Kate's user avatar
  • 8,405
4 votes

Is it possible to scan the whole IP range to find a domain behind the CDN?

Probably not. CNN could be using a push CDN (where data is sent to the CDN) instead of a pull CDN (where it downloads from a central server). Fastly also provides hosting services, so CNN could just ...
Stack Tracer's user avatar
4 votes

How can cloudflare read encrypted request without private key?

One of the ways you use cloudflare is by setting the NS records for your domain to cloudflare's name servers which in turn resolve www.mydomain.com to their IP addresses. This means that when you go ...
Marc's user avatar
  • 4,301
3 votes
Accepted

Why do so many websites use third-party sites for hosting JavaScripts?

Cost Everything you load from someone else is one less thing you need to host yourself. The literal cost (and risk of downtime) of hosting may be small, if you're already hosting your own HTML etc, ...
ShapeOfMatter's user avatar
3 votes

Does a DDOS attack on an application using CDN have to first bring down all the involved CDN servers to affect the application's availability?

Will such a DDOS attack have to completely bring down all the CDN servers serving this application's content before impairing the origin server completely? The CDN provider might decide that this ...
Steffen Ullrich's user avatar
3 votes

Is sharing private key with CDN dangerous?

If you have a website example.com and want to use a CDN without technically allowing the CDN to sniff the contents transferred to https://example.com, you can use a separate host for the items that ...
Ángel's user avatar
  • 18.9k
3 votes

Bypass network security filters with CDN

It seems that your example is more complicated than it needs to be. For a more concrete example, GitHub Pages (*.github.io) allows domain fronting. Let's say that there is a site evil.github.io that ...
Danya02's user avatar
  • 373
2 votes

How can cloudflare read encrypted request without private key?

There are a number of different ways you can configure cloudflare: You can set cloudflare as your DNS provider, most CA considers proof of DNS control as valid proof of domain control. This allows ...
Lie Ryan's user avatar
  • 31.4k
2 votes

What are the damages when a CDN gets hacked?

If you were reading about how CDNs work, then you will know that the CDN serves copies of the assets on the source site. Just like the article you linked talked about. Hacking the CDN does not mean ...
schroeder's user avatar
  • 131k
2 votes

Is the idea of a hosting provider with built-in DDoS protection plausible?

It depends on what you mean by DDoS protection. If you mean be able to serve normal request even when facing a DDoS attack using a very large number of relays, then the only way if to use a CDN that ...
Serge Ballesta's user avatar
2 votes

Does Cloudflare masking my IP make my server more secure?

Quite a bit of security requires obscurity. I.e., don't share your private keys. HOWEVER, the point of the near-universal hatred of "security through obscurity" is that, too often, people rely only ...
Ghedipunk's user avatar
  • 6,050
2 votes
Accepted

Do CloudFront edges talk to custom origins over open (non-AWS) networks?

From the AWS documentation: CloudFront Edge locations are connected to the AWS Regions through the AWS network backbone - fully redundant, multiple 100GbE parallel fiber that circles the globe and ...
keithRozario's user avatar
  • 3,711
2 votes

Why can't we encrypt twice instead of having Cloudflare MITM half the internet?

The simple act of having a load balancer as a service requires them to be in a position where they can intercept SSL communication. Cloudflare is not simply a load balancer as a service which does ...
Steffen Ullrich's user avatar
1 vote
Accepted

DDoS might be very unlikely to happen to my website but in any case a CDN that should protect from it slows my website

I'm a little unclear about your last paragraph so I'll answer a bit broadly. If you're enabling DDoS protection on a shared hosting system, doing so will protect your site and potentially the other ...
Benny C's user avatar
  • 41
1 vote
Accepted

Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?

What you describe is basically providing access to a website under a different domain, i.e. a domain you own yourself. This can not only be achieved with Cloudfront but also with running a reverse ...
Steffen Ullrich's user avatar
1 vote

CDN vs server-level GeoIP

Cloudflare is essentially a reverse proxy which might also cache content. If the content is then actually served from the cache or if the request is passed through the origin server can be influenced ...
Steffen Ullrich's user avatar
1 vote

CDN end to end encryption?

As explained in the post you've linked to with some comments added by my own: Cloudflare recommends [one] end-to-end encryption of traffic between site visitors and the Cloudflare network and [...
Steffen Ullrich's user avatar
1 vote
Accepted

Why do CDNs allow arbitrary backend to be set, is it not a big security concern?

... why do CDNs open the backend at the first place? Anyone can already setup their own domain without a CDN so that it works as a proxy to another domain. A simple hosting service or VPS is needed ...
Steffen Ullrich's user avatar
1 vote
Accepted

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

Subresource Integrity was designed to solve this problem. You can use subresource integrity to ensure that the supporting files that your system relies on have not been modified or tampered with (or ...
mti2935's user avatar
  • 23.6k
1 vote

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

Your CDN will likely use HTTPS to serve the assets, so if the app is configured correctly (requiring HTTPS with trusted certificate), DNS hijacking/spoofing and other similar malice should at most ...
multithr3at3d's user avatar
1 vote

How does a CDN actually prevent DDoS attacks, when an origin server accepts direct connections?

"Now, should I / must I have a Firewall at my orginal server that only allows connections from a CDN-related IP?" I think it's a good idea. Cloudflare use to not recommend it, as they claimed that ...
keithRozario's user avatar
  • 3,711
1 vote
Accepted

Is there a multi-layered DoS protection which can be tightly integrated with cloud hosting services?

Provider's Responsibility In the cloud, as a general rule, the cloud provider handles OSI layer 1 and 2 protection. This is essentially free, as they cannot offer a functional service without it. At ...
DoubleD's user avatar
  • 3,952

Only top scored, non community-wiki answers of a minimum length are eligible