Hot answers tagged

198 votes

DDoS: Why not block originating IP addresses?

Let's say that you run a shop. Every day, you might get a few hundred customers. One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets ...
user avatar
  • 1,321
116 votes

DDoS: Why not block originating IP addresses?

TL; DR The multiple source IPs are what makes them so hard to defend against. For the longer answer we look at the name. DDoS attack. That first D stands for distributed. In other words, there is no ...
user avatar
  • 5,095
114 votes
Accepted

What is the website checking about my browser to protect the website from a DDoS?

Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very ...
user avatar
107 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people ...
user avatar
  • 123k
99 votes
Accepted

How can ISPs handle DDoS attacks?

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the ...
user avatar
  • 6,768
98 votes
Accepted

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Based on the following article you may simply want to ignore it. This seems to be a common scam and your e-mail looks almost exactly like the one from the following article. http://arstechnica.com/...
user avatar
  • 14.1k
96 votes
Accepted

Is serverless code immune to DDoS attacks?

There is always something that will break While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates: ...
user avatar
84 votes
Accepted

Can a DDoS attack yield any information?

A DDoS will certainly give an attacker information about response times, load capability and routing. It may also give information about how incidents are handled internally and externally, as well ...
user avatar
  • 61.4k
83 votes

Someone knows my IP and is threatening to DDoS me

ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject. What you are ...
user avatar
  • 19.6k
82 votes
Accepted

Does the amount of bandwidth available on a network determine how strong a DoS attack should be?

Imagine a post office. It has an entrance, a counter with a clerk who deals with the customers and their packets. The clerk is a multi-tasking talent with a lot of arms to deal with packets on the ...
user avatar
  • 1,997
66 votes
Accepted

How do major sites prevent DDoS?

They generally have a very layered approach. Here are some things I've either implemented or seen implemented at large organizations. To your specific question on smaller businesses you generally ...
user avatar
56 votes
Accepted

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...
user avatar
54 votes
Accepted

How is Google abused for DDoS attacks?

Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.
user avatar
  • 621
53 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it ...
user avatar
49 votes

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in ...
user avatar
  • 32.6k
47 votes

Someone knows my IP and is threatening to DDoS me

Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
user avatar
  • 33.6k
44 votes
Accepted

Web Developer's responsibility for DDoS

The following is all hypothetical: First off you should NEVER sign a SLA in this case, or guarantee any uptime whatsoever. (you are delivering a website, not the service to host that) Secondly, a ...
user avatar
  • 8,151
40 votes
Accepted

Why does a (D)DoS attack slow down the CPU and crash a server?

How does one crash a server using (D)DoS? To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of ...
user avatar
  • 744
39 votes
Accepted

DDOS - security or operational risk?

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "...
user avatar
  • 72k
39 votes

Cloud-based DDoS as a Service

... but they used their own infrastructure It's not really their own infrastructure what they use. They use instead botnets consisting of hijacked systems. These are systems which they p0wn but ...
user avatar
38 votes
Accepted

Did I participate in the recent DDoS attacks on Dyn's DNS service?

Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic. But there are some things you can do now to determine if you were at risk of being a participant ...
user avatar
37 votes
Accepted

Is it illegal to DDoS a phishing page?

If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
user avatar
  • 6,768
31 votes
Accepted

Since I can set the source IP address to anything using raw sockets, does this mean I am untraceable?

You are correct that this is possible. There are problems with the plan though: The network you are leaving can filter to drop outgoing packets that do not have a source IP from within their network. ...
user avatar
31 votes

Is serverless code immune to DDoS attacks?

Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ... There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
user avatar
28 votes

NTP DDoS Attack on Home Servers

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be ...
user avatar
  • 34.4k
27 votes

DDoS: Why not block originating IP addresses?

In addition to @Hollowproc's excellent answer, the actual "addresses" being used as sources are often spoofed in an attack like this. An attacking host can pretend to be any number of other IPs, ...
user avatar
  • 71.7k
27 votes

Someone knows my IP and is threatening to DDoS me

Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
user avatar
  • 10k
24 votes

Webserver DDOS protection without giving away private keys (https, tls, ssl)

The reason 3rd party DDoS protection services require your private keys, is so they can actually inspect the traffic and act upon that. Without that, they're just analyzing IP streams of encrypted ...
user avatar
  • 6,768
23 votes

Is there any way to stop DDOS attacks?

If you're running a website that's under attack, you should consider a service such as Cloudflare. Cloudflare and other CDNs are designed with DDoS attacks in mind - traffic passes through Cloudflare'...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible