198
votes
DDoS: Why not block originating IP addresses?
Let's say that you run a shop. Every day, you might get a few hundred customers.
One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets ...
- 1,331
117
votes
DDoS: Why not block originating IP addresses?
TL; DR
The multiple source IPs are what makes them so hard to defend against.
For the longer answer we look at the name. DDoS attack. That first D stands for distributed. In other words, there is no ...
- 5,185
114
votes
Accepted
What is the website checking about my browser to protect the website from a DDoS?
Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very ...
- 19.4k
97
votes
Accepted
Is serverless code immune to DDoS attacks?
There is always something that will break
While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates:
...
- 31.7k
81
votes
Accepted
Someone knows my IP and is threatening to DDoS me
ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject.
What you are ...
- 24k
56
votes
Accepted
Why don't browser DNS caches mitigate DDOS attacks on DNS providers?
You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...
- 1,191
54
votes
Accepted
How is Google abused for DDoS attacks?
Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.
- 619
49
votes
Why don't browser DNS caches mitigate DDOS attacks on DNS providers?
A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in ...
- 34.7k
46
votes
Someone knows my IP and is threatening to DDoS me
Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
- 34.7k
41
votes
Accepted
Why does a (D)DoS attack slow down the CPU and crash a server?
How does one crash a server using (D)DoS?
To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of ...
- 754
39
votes
Cloud-based DDoS as a Service
... but they used their own infrastructure
It's not really their own infrastructure what they use. They use instead botnets consisting of hijacked systems. These are systems which they p0wn but ...
- 208k
37
votes
Accepted
Is it illegal to DDoS a phishing page?
If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
- 6,948
37
votes
Accepted
Did I participate in the recent DDoS attacks on Dyn's DNS service?
Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic. But there are some things you can do now to determine if you were at risk of being a participant ...
- 1,191
31
votes
Is serverless code immune to DDoS attacks?
Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ...
There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
- 208k
27
votes
DDoS: Why not block originating IP addresses?
In addition to @Hollowproc's excellent answer, the actual "addresses" being used as sources are often spoofed in an attack like this. An attacking host can pretend to be any number of other IPs, ...
- 73.3k
26
votes
Someone knows my IP and is threatening to DDoS me
Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
- 10.7k
24
votes
Webserver DDOS protection without giving away private keys (https, tls, ssl)
The reason 3rd party DDoS protection services require your private keys, is so they can actually inspect the traffic and act upon that.
Without that, they're just analyzing IP streams of encrypted ...
- 6,948
22
votes
Is serverless code immune to DDoS attacks?
In short: all-in-all serverless is not a protection against any kind of attack.
Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server ...
- 691
20
votes
How to deal with this denial of service attack on an Apache server?
This is a classic SYN flood attack, preventive measures include
hashing syn packets, implementing syn cookies
checking if the client properly sends RST after an invalid packet sent back to him
ddos ...
- 2,154
19
votes
Accepted
Why is the Wikileaks site still accessible? How come it hasn't been hacked?
Why haven't other foreign powers hacked or DDoS attacked it in the past when it posted information they didn't want public?
Attacking the Wikileaks website to withhold information is ineffective. The ...
- 45.1k
19
votes
What is the website checking about my browser to protect the website from a DDoS?
Just to add what I know from experience: Cloudflare blocks non-graphical browsers (tested: links, lynx), not on the first page view, but from the second one. These browsers (presumably) don't load ...
- 289
18
votes
Why does a (D)DoS attack slow down the CPU and crash a server?
A SYN flood isn't about exhausting CPU, it's about exhausting memory.
A TCP connection is established through what is known as a "three-way handshake". Traditionally, it works as follows:
Client ...
- 34.8k
18
votes
Accepted
Difference between Amplification and Reflection Attack?
TL;DR: amplification attack is a reflection attack where the reply is larger than the the request.
Reflection attack is if the reply is send back to the claimed origin of the request. With a spoofed ...
- 208k
16
votes
Did I participate in the recent DDoS attacks on Dyn's DNS service?
Identifying this can be a little difficult, but possible.
Identify the devices in your network
This might sound trivial, but you might be surprised to see some rogue devices you may have even ...
- 3,951
16
votes
Accepted
Can I protect my router from a Mirai Worm and how do I know if I'm vulnerable?
Like your quote says; change the password. It would be much harder to fix if Mirai used 'actual' vulnerabilities (software bugs i.e. memory corruption). Then you'd have to hope there's an update ...
- 4,861
16
votes
Accepted
Prevent a bot accessing login page with multiple IPs and massive list of username/ passwords
Attack is automated. You can inspect packets coming from attack vs packets coming from your customers. It can be as simple as the HTTP user agent string or can be some TCP header difference (e.g. some ...
- 654
14
votes
Accepted
Could IOT Botnets be Stopped by Static IP addressing the Devices?
Almost all IoT devices of the sort we are talking here (ie, consumer level) are deployed behind home grade routers (or ARE home grade routers) and are using IPv4 and NAT/uPNP to reach the internet. ...
- 6,391
14
votes
Accepted
Threshold for DDOS Attack
Nowadays TCP SYN attacks are not common, focus more on UDP amplification attacks over DNS, memcache and other UDP services. On the other hand, if you want to compute the traffic rate you can use the ...
- 2,294
14
votes
Someone knows my IP and is threatening to DDoS me
The worst this person can do is interfere with your internet speed. They won't be able to "hack you" or do anything to your computer, nor will they be able to obtain any sensitive ...
- 67.3k
Only top scored, non community-wiki answers of a minimum length are eligible