198 votes

DDoS: Why not block originating IP addresses?

Let's say that you run a shop. Every day, you might get a few hundred customers. One day, you get tens of thousands of people coming in, who get in the check-out line, buys a trinket, and then gets ...
user128269's user avatar
  • 1,321
116 votes

DDoS: Why not block originating IP addresses?

TL; DR The multiple source IPs are what makes them so hard to defend against. For the longer answer we look at the name. DDoS attack. That first D stands for distributed. In other words, there is no ...
HashHazard's user avatar
  • 5,185
114 votes
Accepted

What is the website checking about my browser to protect the website from a DDoS?

Most Denial-Of-Service (DOS) attacks rely on some asymmetry between the resources involved on attacker side and on target side. In other words, to be successful, a DOS needs an action to require very ...
WhiteWinterWolf's user avatar
107 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

This article might be important for you: https://ca.news.yahoo.com/armada-collective-ddos-threats-were-212413418.html Someone has been copying the Armada Collective's email content to scare people ...
schroeder's user avatar
  • 129k
98 votes
Accepted

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Based on the following article you may simply want to ignore it. This seems to be a common scam and your e-mail looks almost exactly like the one from the following article. http://arstechnica.com/...
Trey Blalock's user avatar
  • 14.2k
98 votes
Accepted

How can ISPs handle DDoS attacks?

There are a number of strategies, each having their own costs and benefits. Here are a few (there are more, and variations): blackholing By blackholing traffic, you discard all traffic towards the ...
Teun Vink's user avatar
  • 6,918
97 votes
Accepted

Is serverless code immune to DDoS attacks?

There is always something that will break While, theoretically, serverless systems can scale up your application to very high levels, there is always something that will break. Likely candidates: ...
Conor Mancone's user avatar
84 votes
Accepted

Can a DDoS attack yield any information?

A DDoS will certainly give an attacker information about response times, load capability and routing. It may also give information about how incidents are handled internally and externally, as well ...
Rory Alsop's user avatar
  • 61.5k
81 votes
Accepted

Does the amount of bandwidth available on a network determine how strong a DoS attack should be?

Imagine a post office. It has an entrance, a counter with a clerk who deals with the customers and their packets. The clerk is a multi-tasking talent with a lot of arms to deal with packets on the ...
hamena314's user avatar
  • 2,037
81 votes
Accepted

Someone knows my IP and is threatening to DDoS me

ISP's have ways of dealing with DDoS attacks targeting one or more IP addresses on their network. See How can ISPs handle DDoS attacks? for some interesting reading on this subject. What you are ...
mti2935's user avatar
  • 23.4k
56 votes
Accepted

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

You are correct that the DNS cache would mitigate against a nameserver being unavailable. It is extremely common to have a TTL of 5 minutes or lower. Hence, 5 minutes after the DDOS attack brought ...
Shackledtodesk's user avatar
54 votes
Accepted

How is Google abused for DDoS attacks?

Most likely someone using Google's Cloud Platform (GCP). They have a page here where you can report abuse on their platform.
Dan's user avatar
  • 619
53 votes

I got an email threatening to DDOS me if I don't pay a ransom. What should I do?

Ignore it. Cloudflare themselves have stated that these are fake - see https://blog.cloudflare.com/empty-ddos-threats-meet-the-armada-collective/ I highly recommend that you read this article, as it ...
David Glickman's user avatar
49 votes

Why don't browser DNS caches mitigate DDOS attacks on DNS providers?

A small design change to DNS caches could make a big difference. Most DNS caches remove an entry when the TTL expires. A cache could instead keep the entry, but mark it as expired. If a query comes in ...
paj28's user avatar
  • 33.4k
46 votes

Someone knows my IP and is threatening to DDoS me

Contact your ISP’s security team and explain your situation. They should be able to help you change your IP to a new address.
John Deters's user avatar
  • 34.2k
41 votes
Accepted

Why does a (D)DoS attack slow down the CPU and crash a server?

How does one crash a server using (D)DoS? To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of ...
R. Murray's user avatar
  • 754
39 votes

Cloud-based DDoS as a Service

... but they used their own infrastructure It's not really their own infrastructure what they use. They use instead botnets consisting of hijacked systems. These are systems which they p0wn but ...
Steffen Ullrich's user avatar
37 votes
Accepted

Is it illegal to DDoS a phishing page?

If you do a DDoS by sending large amounts of traffic to that site, you're very likely creating a lot of collateral damage since other services in (parts of) the network will suffer as well if the ...
Teun Vink's user avatar
  • 6,918
37 votes
Accepted

Did I participate in the recent DDoS attacks on Dyn's DNS service?

Knowing after the fact can be a bit difficult if you are not actively monitoring your network traffic. But there are some things you can do now to determine if you were at risk of being a participant ...
Shackledtodesk's user avatar
31 votes

Is serverless code immune to DDoS attacks?

Theoretically speaking, there is no limit for resources that will be allocated to a Lambda function ... There is - it's the budget and the quotas. Lambda functions are not free to execute, so a DDoS ...
Steffen Ullrich's user avatar
27 votes

DDoS: Why not block originating IP addresses?

In addition to @Hollowproc's excellent answer, the actual "addresses" being used as sources are often spoofed in an attack like this. An attacking host can pretend to be any number of other IPs, ...
gowenfawr's user avatar
  • 72.9k
27 votes

Someone knows my IP and is threatening to DDoS me

Not enough information for a qualified answer. I will make some assumptions and spell them out. Basic assumption: You actually care about being DDoS'ed (you earn money doing live streams or something)....
Tom's user avatar
  • 10.4k
24 votes

Webserver DDOS protection without giving away private keys (https, tls, ssl)

The reason 3rd party DDoS protection services require your private keys, is so they can actually inspect the traffic and act upon that. Without that, they're just analyzing IP streams of encrypted ...
Teun Vink's user avatar
  • 6,918
23 votes

Is there any way to stop DDOS attacks?

If you're running a website that's under attack, you should consider a service such as Cloudflare. Cloudflare and other CDNs are designed with DDoS attacks in mind - traffic passes through Cloudflare'...
dreadiscool's user avatar
22 votes

Is serverless code immune to DDoS attacks?

In short: all-in-all serverless is not a protection against any kind of attack. Note that "serverless" doesn’t mean servers are not involved. It only means that you have delegated server ...
Alexey Kamenskiy's user avatar
20 votes

What prevents me from launching an SYN-ACK flood using HTTP servers?

This is a long known-about attack called a "reflected DoS". The reason it mostly doesn't cause much of a problem for defenders is that receiving an unexpected SYN+ACK doesn't take up any state on the ...
Polynomial's user avatar
  • 135k
20 votes

How to deal with this denial of service attack on an Apache server?

This is a classic SYN flood attack, preventive measures include hashing syn packets, implementing syn cookies checking if the client properly sends RST after an invalid packet sent back to him ddos ...
Rápli András's user avatar
19 votes
Accepted

Why is the Wikileaks site still accessible? How come it hasn't been hacked?

Why haven't other foreign powers hacked or DDoS attacked it in the past when it posted information they didn't want public? Attacking the Wikileaks website to withhold information is ineffective. The ...
Arminius's user avatar
  • 44.8k
19 votes

What is the website checking about my browser to protect the website from a DDoS?

Just to add what I know from experience: Cloudflare blocks non-graphical browsers (tested: links, lynx), not on the first page view, but from the second one. These browsers (presumably) don't load ...
user2394284's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible