Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
I'm a regular user of your website but I never asked a question. I hope, it's a good way. For some weeks, I have special DDoS attacks on a website. I don't know what kind of attack they are and how is it possible to launch them. The question is not how to block them, I know this, but what kind of attack it is and how is it possible. I think it's flood DDOS attack, but how this one?
For some weeks, 3 times, I had on my website thousands and thousands gets (+/- 10,000/min, during 30 minutes, to make down my server), such as :
index.php/q=99999, all queries are different and existing on the website;
all IP are the same per attack (only one IP per attack, and the 3 IP used for each of these attacks are in the same segment xxx.xxx.xxx... From a same host in another country, which doesn't have link or competition or anything with my site.
the user-agents are different (+/- 40 different agents per attack, never two times the same successively, but all of them same time.)
I don't think that the IP sources are really the attackers, because, it's little stupid to use all the same IP for such attack. But I think that the hackers want to make me think that the attacks are really coming from these IP.
But, if these IP sources are not real, how is it possible to launch such attack, with +/- 40 different agents, coming from the same IP in same time. Is-it easy to do that? does it need big systems? A single hacker could do that? Or such services are cheap and existing on the net?....
I can block such attacks but I try to understand the goal, the meaning of them and how they do that. To block only is not enough. I need to understand. If you cannot help, maybe advise me where I could find the information.
Thank you so much.
It does sound like an attack alright. It's not hard to pull off, nor set up. These kinds of attacks are usually done via computer farm or a zombie horde, and as such it's fairly easy to set up, and as a result to that, it's a service offered online.
People do this because they can or because of a personal and/or business vendetta.
I could write about this topic for hours, but none of it wouldn't have been said before. So allow me to forward you to some further reading on the topic.
For a quick and dirty overview:
Tom's hardware entry on the topic is also a nice, condensed, straight to the point write up, which I've found useful in the past.
A more detailed, yet broad overview of DDoS attacks and protection:
Wikipedia's article on Distributed Denial of Service attacks is extremely well written and updated. I suggest you start there.
If you're serious about defending yourself/ educating yourself: CISCO's article on how to defend yourself against DDoS. It's extremely detailed and long and useful. I've come back to it several times over the years for help on the topic -- both academically and professionally.
Good luck!
Related
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 7 years ago.
Improve this question
After finding someones ip you can easily send pings to them to make DOS attacks. Me and my friend tried to make a defense against them and wanted to know how a low level attacker can send this DOS attacks. When one of us sent pings to the other using cmd when we were connected to the same modem(wifi) it succeed in sending pings. But when we were on different networks it failed and sent a message like "Request timed out". I assume this is a failure message but I've some questions in this matter.
I won't write the command to make DOS attacks since I don't want to encourage anyone in making those and anyone who is knowledgeable in this subject already knows how to do that.
//Assume that attacker knows the ip of the victim.
Questions
Can a computer be successful enough to slow down the second computer if he sends infinite pings? If so in how much time(approximately.)(assume their computers are same.) What can be the worst result for the victim?
How can someone be successful in making DOS attacks to people who are connected into different networks from cmd? And how can I take measures against them?
This will not work over the internet if the victim's router is set not to send ICMP replies to ping requests.
Can a computer be successful enough to slow down the second computer
if he sends infinite pings? If so in how much
time(approximately.)(assume their computers are same.) What can be the
worst result for the victim?
Not significantly. What you need is an amplification attack - that is the victim's computer has to do more work than you for each request. Sending a reply to a ping is minimal work and involves sending the same amount of bytes back, so you are not slowing the victim machine anymore than your own.
How can someone be successful in making DOS attacks to people who are
connected into different networks from cmd? And how can I take
measures against them?
You would be better off using a software tool to do this, or by setting up a botnet to do a distributed denial of service instead (DDoS). Usage of such tools are probably illegal depending on your jurisdiction and you should get full permission if testing this from the owners of all networks and systems where your traffic would flow.
Mitigating DDoS is the million dollar question. Services such as CloudFlare can help. It all depends on what you need to protect and who from.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 8 years ago.
Improve this question
Using the popular torrent backdoor come.in as an example, why are only the sub domains being blocked by ISP's?
Originally my ISP blocked eztv.it so I found eztv.come.in which was eventually blocked after some time only to be replaced with ezztv.come.in.
They are now on ezzzztv.come.in and no doubt in time they will be on ezzzzzzzztv.
They also have backdoors to all the other big torrent sites and do the same thing, just open up again with a new sub domain URL
Is there some kind of technical reason that the main domain is not being blocked? Or maybe it's a legal reason. I am no expert but can't think of a logical reason the main domain is not being blocked instead of the ISP playing this cat and mouse game.
I doubt it's anything too mysterious. I'd say it depends heavily on how they are doing the blocking and I'm willing to bet this changes a good bit from ISP to ISP. I would guess that it's one of the following:
1) They get hostnames to block from some source (some kind of commercial feed maybe?), this source gives them the subdomains (i.e. specific hosts instead of a group of hosts), they import this to some list that gets blocked
2) Plain old ignorance or laziness - maybe whatever team is in charge of this just blocks based on hosts because they don't care enough to do basic pattern recognition on hosts they're ordered to block.
3) Technical reasons - maybe whatever tool they use to manage their blacklists only accepts subdomains?
Unless we get someone that does this kind of work for ISPs (and they do it the same way as you are describing), then we'll never know :-)
I do not know why the subdomains are being blocked, however I do know that using a encrypted VPN such as HotspotShield means that your ISPs cannot know what you are visiting (And therefore would have to either block everything or nothing), which means that you can bypass that block.
When I accidentally forgot to pay the bill (Was overdrawn) and my ISP limited me to only Google and Youtube, I used a VPN and was able to access everything fine.
I have only ever used HotspotShield, never used TOR, etc, so I don't know which VPNs it would work with or not (really the question is, which VPNs are encrypted?).
VPNs give higher latency, but to my knowledge do not give slower download speeds (Except if the VPN has a slower internet connection than you), so should be fine for downloads.
Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 9 years ago.
Improve this question
Recently, my brother suggested me to use mod_security. I did a research what it truly is and what it does, but I feel very uneasy to decide whether should I use it or not. Here is what in my mind that keep me from not using it.
Slightly affect my website performance. The more rules, the slower it will get.
It does not completely filter all the attacks (it is understandable, because it is not possible for any software to truly protect everything).
Sometimes, it can block innocent users.
Add another software means add another responsibility to maintain it.
Now the real question is:
If mod_security cannot filter everything, and you still need to make
sure your web application is secure, why not properly write a
secure web application without running any Web Application
Firewall?
Since it is our web application, we know better than any 3rd-party software what expected input from users. Having 3rd-party software to detect the attack and then write a input validation in our web application is like a double-check (while it is good, but the performance cost would be double as well).
In the scenario you describe, where you have a custom application written by developers who care about security, I agree that WAFs offer nugatory value as an intrusion prevention system.
The idea that WAFs are effective in automatically providing unknown web apps is industry marketing spin of the worst kind. They provide exceedingly poor performance(*) if not painstakingly configured to fit the application; unless you have a separate security team that has the resources to do that, it is typically indeed better to spend the resources on secure development.
(*: as in protection afforded vs time and custom lost due to false positives; mod_security's core rules are IMO particularly troublesome.)
WAFs are, on the other hand, useful:
as temporary workarounds to allow you to protect legacy and third-party applications with specific known vulnerabilities until such time as they can can be fixed or replaced;
configured as intrusion detection systems, raising alerts rather than blocking, where you have operational resources to follow up and potentially block attack sources.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 11 years ago.
Improve this question
I have a client app that faces the internet, but only clients will access. The site should never be indexed or crawled or viewed outside of our clients. We always concerned about DDOS and attempts to gain access. If the system can add one more level of being hidden, or harder to find, I don't see the negatives.
Users will never have to enter the domain name (think kiosks), and admins can use bookmarks. Yes, security by obscurity is no solution and never relied upon. But if you can add it to an existing and robust secured system, why not?
Is there any downside to having a random domain name like j398sh3-3nj23j.com?
I would love to hear some thoughts and opinions.
If you're never using where anyone will see it (even by rDNS on an incoming connection from your server), then the only real drawback is that you're paying for it when you could as easily use a random subdomain under a domain you already control (e.g. j398sh3-3nj23j.example.com).
But it'll provide zero protection from DDOS or attempts to gain access, as anyone who is in a position to extract a normal domain name from your client app will probably be able to extract this random domain name just as easily, and they may not even bother with domain names and just get the IP address your client is connecting to anyway.
Emphatically speaking, that's useless. As was pointed out above, using some subdomain of your own would cost less, be saner, and have more utility.
If you have a number of nodes on a private network that is not physically private, use a good VPN system and machine authentication with certificates. If you do that, nothing is accessible except the Internet-facing VPN software, and that can easily ignore anything that's not legitimate.
Closed. This question is off-topic. It is not currently accepting answers.
Want to improve this question? Update the question so it's on-topic for Stack Overflow.
Closed 12 years ago.
Improve this question
I have been a .net developer for the past three yrs. Just curious to know about the network security field. What kind of work does the developers working in these area do? I really have not much idea about network security but what my understanding is these people are involved in securing network, preventing attacks on network as obvious. Could any one please give me some details about this field and also what does it take to move to this field.
Take a look at "Security Engineering" by Ross Anderson. The first edition and part of the second are available for free online here. While he talks about many non-network issues, the principles mostly apply.
Network security is a vast subject. On the developer side, I think you would most likely be concerning yourself with lots of encryption schemes and process security. There are basic things like using SSL for network traffic of a program to more advanced subjects like preventing any traces of a sensitive operation from remaining in RAM after a program has processed (and probably encrypted) it.
Today, you would need to become an expert in TCP/IP protocols. Everything from ARP, DNS, UDP, ICMG, BGP, and on and on. Most networks are IP-based, with IP-based firewalls. The firewalls will allow, for example, "TCP traffic on port 80" to come through. You need to be able to understand if that traffic is valid web surfing, DOS attack, or otherwise malicious. This can only be accomplished with detailed understanding of how IP networks work. Ditto for other protocols like DNS. In addition, lower-level understanding of ethernet communications and other means of transport (like cell phone networks or WiFi networks) would be important. I suppose it depending on what you mean by "network security" - to me this is below the application layer.