Hot answers tagged

198

Let's say that you run a shop. Every day, you might get a few hundred customers. One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets right back in line to repeat. Obviously, you are losing business from authentic customers who must wait hours in line. Now, you hire a security guard at the ...


116

TL; DR The multiple source IPs are what makes them so hard to defend against. For the longer answer we look at the name. DDoS attack. That first D stands for distributed. In other words, there is no one IP to block. Or two, or three, or even four.. There are hundreds or thousands of unique IPs. Usually DDoS attacks originate from a hacker in control of a ...


107

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people into paying, but no attacks have been recorded. So, possibly, you don't have to do anything.


103

Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very few resources client-side (so the each clients can send a lot of requests) while involving larger resources server-side (so the server(s) will be unable to ...


97

Based on the following article you may simply want to ignore it. This seems to be a common scam and your e-mail looks almost exactly like the one from the following article. http://arstechnica.com/security/2016/04/businesses-pay-100000-to-ddos-extortionists-who-never-ddos-anyone/ Look up the source ISP of the service provider that sent the e-mail and ...


91

Imagine a shopping mall. By definition, anybody can enter the mall and then browse the shops. It is public. The shops are expecting people to come by, look at the displays, maybe enter and then buy things. In the mall, there is a shopkeeper, who sells, say, computers. Let's call him Jim. He wants people to come by and see the computers and be enticed into ...


86

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the target IP address. Typically, ISP's try to use RTBH (remotely triggered blackholing), by which they can ask their upstream networks to discard the traffic, so it ...


84

A DDoS will certainly give an attacker information about response times, load capability and routing. It may also give information about how incidents are handled internally and externally, as well as how they are reported to the public. But this is not what the main uses are. Generally the two key reasons for DDoS are to: take a service or website ...


82

Imagine a post office. It has an entrance, a counter with a clerk who deals with the customers and their packets. The clerk is a multi-tasking talent with a lot of arms to deal with packets on the counter. The counter has a certain width, so only a certain number of customers can be processed at the same time. The clerk has a small address book with ...


65

They generally have a very layered approach. Here are some things I've either implemented or seen implemented at large organizations. To your specific question on smaller businesses you generally would find a 3rd party provider to protect you. Depending on your use case this may be a cloud provider, a CDN, a BGP routed solution, or a DNS-based solution. ...


56

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought down Dyn, your cache would've been invalid and you wouldn't have been able to hit github, etc.


53

Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it is a very clear explanation from the front line. The armada collective is a real DDOS group, but some con artists are just using their name to try to scare ...


49

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in for an expired entry, the cache would first try to resolve the name upstream, and if that fails, return the expired entry. I expect this is technically in ...


44

The following is all hypothetical: First off you should NEVER sign a SLA in this case, or guarantee any uptime whatsoever. (you are delivering a website, not the service to host that) Secondly, a hosting company should be used who can defend against a DoS attack in some way. (be aware of SLA's and their limitations) You need to think of yourself in the ...


40

How does one crash a server using (D)DoS? To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of attacks specifically attempt to use up as much of the target servers resources a possible and bring it down, rather than just hammer it with network traffic. ...


39

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture. While there are various ways of qualifying the realm of ...


39

... but they used their own infrastructure It's not really their own infrastructure what they use. They use instead botnets consisting of hijacked systems. These are systems which they p0wn but definitely not own. And thus it is very cheap for them. Apart from that any VPS provider who would rent their VPS for DDoS attacks would quickly lose reputation ...


38

Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic. But there are some things you can do now to determine if you were at risk of being a participant and to mitigate against future participation. As has been mentioned in a number of places, if your WAN router/bridge/cablemodem/firewall has uPnP turned on, ...


37

If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the network is saturated. Also, very often phishers use hacked websites (for example poorly managed and outdaged Wordpress installs) to host their phishing sites, so ...


31

You are correct that this is possible. There are problems with the plan though: The network you are leaving can filter to drop outgoing packets that do not have a source IP from within their network. DDoS (Distributed Denial of Service) is based around idea that many boxes target a single one, overloading the target's ability to handle the data. Your single ...


28

As an immediate mitigation, shut down your NTP service until you can get it secured properly. Your computer's clock won't (or at least, shouldn't) drift too much in a day or two. You'll still be seeing the incoming requests, but your server won't be sending replies, so the overall traffic level should drop by 90% or more. Since you're running a home ...


27

In addition to @Hollowproc's excellent answer, the actual "addresses" being used as sources are often spoofed in an attack like this. An attacking host can pretend to be any number of other IPs, especially in a UDP-based attack such as is used against DNS providers. There's a solution for this called BCP 38, or Network Ingress Filtering. If all the world ...


25

CERT recognizes this as a vulnerability in DNS. As it stands there are about 27 million misconfigured (read: Default!) DNS servers that can be used in this attack. Ideally you want to prevent these UDP packets from reaching their destination by filtering them at the edge router (which is your provider). Unfortunately not many providers offer this service. ...


23

A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories: Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time) Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid ...


23

If you're running a website that's under attack, you should consider a service such as Cloudflare. Cloudflare and other CDNs are designed with DDoS attacks in mind - traffic passes through Cloudflare's network before it reaches yours. Since Cloudflare will filter DDoS traffic, only clean traffic will reach you. On the other hand, if the attack is small ...


21

Full disclosure, I work for a company that develops DDoS mitigation and web application firewall services DNS amplification is a Distributed Denial of Service (DDoS) attack in which the attacker exploits vulnerabilities in domain name system (DNS) servers to turn initially small queries into much larger payloads, which are used to bring down the victim’s ...


21

This is a long known-about attack called a "reflected DoS". The reason it mostly doesn't cause much of a problem for defenders is that receiving an unexpected SYN+ACK doesn't take up any state on the target server; at most it may send back a packet to say "uh, sorry, wasn't expecting that" which may cause some saturation of their network connection in a ...


20

There are 13 top-level server designations, but there are significantly more than 13 servers, since most of them are multi-homed. Taking down all of them at the same time would be extraordinarily difficult. Furthermore, the only information you need to get from the root servers is the location of the TLD servers, of which there's only a few hundred. Any ...


20

BY THE MAGICK POWER OF UNICORNS!!! Snark aside, CAPTCHA is a very poor solution for D/DoS protection. While it does have some effect, this is minimal, and easily compensated for by the attackers. CAPTCHA solves the wrong problem for this, and solves it badly. CAPTCHA does not try to rate-limit the connections; it is not intended to protect the login ...


20

Ping of Death attacks are things of the past. Operating systems no longer freak out when assembling large fragmented ICMP packets. That video is trying to demonstrate a ping flooding attack, a DoS attack in which he's trying to send more ICMP packets than what the server can handle. Chances are that the server being "attacked" has bigger downlink that the ...


Only top voted, non community-wiki answers of a minimum length are eligible