198
votes
DDoS: Why not block originating IP addresses?
Let's say that you run a shop. Every day, you might get a few hundred customers.
One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets ...
- 1,321
116
votes
DDoS: Why not block originating IP addresses?
TL; DR
The multiple source IPs are what makes them so hard to defend against.
For the longer answer we look at the name. DDoS attack. That first D stands for distributed. In other words, there is no ...
- 5,135
115
votes
Accepted
What is the website checking about my browser to protect the website from a DDoS?
Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very ...
- 19.2k
107
votes
I got an email threatening to DDOS me if I don't pay a ransom. What should I do?
This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html
Someone has been copying the Armada Collective's email content to scare people ...
- 126k
99
votes
Accepted
How can ISPs handle DDoS attacks?
There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations):
blackholing
By blackholing traffic, you discard all traffic towards the ...
- 6,898
98
votes
Accepted
I got an email threatening to DDOS me if I don't pay a ransom. What should I do?
Based on the following article you may simply want to ignore it. This seems to be a common scam and your e-mail looks almost exactly like the one from the following article.
http://arstechnica.com/...
- 14.1k
97
votes
Accepted
Is serverless code immune to DDoS attacks?
There is always something that will break
While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates:
...
- 30.4k
84
votes
Accepted
Can a DDoS attack yield any information?
A DDoS will certainly give an attacker information about response times, load capability and routing.
It may also give information about how incidents are handled internally and externally, as well ...
- 61.5k
83
votes
Accepted
Someone knows my IP and is threatening to DDoS me
ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject.
What you are ...
- 21.2k
82
votes
Accepted
Does the amount of bandwidth available on a network determine how strong a DoS attack should be?
Imagine a post office.
It has an entrance, a counter with a clerk who deals with the customers and their packets. The clerk is a multi-tasking talent with a lot of arms to deal with packets on the ...
- 2,027
56
votes
Accepted
Why don't browser DNS caches mitigate DDOS attacks on DNS providers?
You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...
- 1,201
54
votes
Accepted
How is Google abused for DDoS attacks?
Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.
- 619
53
votes
I got an email threatening to DDOS me if I don't pay a ransom. What should I do?
Ignore it.
Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it ...
- 1,344
49
votes
Why don't browser DNS caches mitigate DDOS attacks on DNS providers?
A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in ...
- 32.9k
47
votes
Someone knows my IP and is threatening to DDoS me
Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
- 33.9k
44
votes
Accepted
Web Developer's responsibility for DDoS
The following is all hypothetical:
First off you should NEVER sign a SLA in this case, or guarantee any uptime whatsoever. (you are delivering a website, not the service to host that)
Secondly, a ...
- 8,364
41
votes
Accepted
Why does a (D)DoS attack slow down the CPU and crash a server?
How does one crash a server using (D)DoS?
To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of ...
- 754
39
votes
Accepted
DDOS - security or operational risk?
I think that is a false dichotomy, and your CSO is being plain silly.
Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "...
AviD♦
- 72.7k
39
votes
Cloud-based DDoS as a Service
... but they used their own infrastructure
It's not really their own infrastructure what they use. They use instead botnets consisting of hijacked systems. These are systems which they p0wn but ...
- 191k
38
votes
Accepted
Did I participate in the recent DDoS attacks on Dyn's DNS service?
Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic. But there are some things you can do now to determine if you were at risk of being a participant ...
- 1,201
37
votes
Accepted
Is it illegal to DDoS a phishing page?
If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
- 6,898
31
votes
Is serverless code immune to DDoS attacks?
Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ...
There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
- 191k
27
votes
DDoS: Why not block originating IP addresses?
In addition to @Hollowproc's excellent answer, the actual "addresses" being used as sources are often spoofed in an attack like this. An attacking host can pretend to be any number of other IPs, ...
- 72.4k
27
votes
Someone knows my IP and is threatening to DDoS me
Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
- 10.2k
25
votes
Webserver DDOS protection without giving away private keys (https, tls, ssl)
The reason 3rd party DDoS protection services require your private keys, is so they can actually inspect the traffic and act upon that.
Without that, they're just analyzing IP streams of encrypted ...
- 6,898
23
votes
Is there any way to stop DDOS attacks?
If you're running a website that's under attack, you should consider a service such as Cloudflare.
Cloudflare and other CDNs are designed with DDoS attacks in mind - traffic passes through Cloudflare'...
- 331
22
votes
Is serverless code immune to DDoS attacks?
In short: all-in-all serverless is not a protection against any kind of attack.
Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server ...
- 691
21
votes
Accepted
dns reflection attack vs dns amplification attack
Full disclosure, I work for a company that develops DDoS mitigation and web application firewall services
DNS amplification is a Distributed Denial of Service (DDoS) attack in which the attacker ...
- 226
21
votes
What prevents me from launching an SYN-ACK flood using HTTP servers?
This is a long known-about attack called a "reflected DoS". The reason it mostly doesn't cause much of a problem for defenders is that receiving an unexpected SYN+ACK doesn't take up any state on the ...
- 134k
Only top scored, non community-wiki answers of a minimum length are eligible