Indie-Resource.com

Hey guys, I read in a PT tech news website that yesterday it was "reported" the biggest DDoS attack in history, 400GBps was the rate of the attack, and that's pretty big...

I know what a DDoS is and how it works (basically), so for those who don't know anything i can say that DDoS stands for Dynamic Denial of Service Attack, and it's an attack that consists in accessing a server many times in a second from multiple sources. So let's say there was a DDoS attack to IR, 1000 PC's in the attack, so those 1000 PC's would be trying to open IR.com multiple times till the servers got overflowed with so many acesses and the site would crash. That's my view on the topic, correct me if wrong.

But now comes my naiveness on the subject with a possible "solution". Why can't servers have some kind of "system" that would detect an abnormal number of access from a unique IP Address?
Example:
From those 1000 PC's there was the #29.
#29 had the ip: 127.1.1.1
So once it would try to connect to the server it was attacking, that server should know when to say "halt! This IP tried to access this page 40 times in the past second.. something's wrong, and then just deny access to that IP for a period of time.

Wouldn't that work? Why not?

I would like to know your view on this attack type, one of the most common between hacktivists.

It wouldn't work because a true DDoS (actually means "Distributed Denial of Service") attack is coming from hundreds or thousands of different IP addresses. That is the "Distributed" part. You couldn't just sit at your house and open 1000 connections to a site. Most hosts have hardware that will block you before you hit the server and then instantly blacklist your IP address.

But a DDoS attack is indistinguishable from regular traffic. One hit is coming per IP address, just like regular users.

With a traditional DoS attack, you have to find an exploit, because you are trying to use up resources just from your one or two connections. Back in the day, a website's Search option was often used. That is why pretty much any site will stop you from doing more than 1 search per 10 or so seconds at least. Without that, you could bring down their DBMS by flooding it with costly searches.

But a DDoS doesn't need an exploit. It isn't much different than when the "I F$#%ing Love Science" group on Facebook posts a link to a small scientific website. They are used to getting maybe 50 - 100 visitors a day. And then the owner of IFLS posts the link on a group that has 10 million followers, of which even 5% simultaneously going to check out the page immediately brings it to its knees. That is an unintentional DDoS attack (which is sometimes called "wanging" when it is done accidentally without knowledge of a site's resources).

On the plus side, few people have the power to launch large-scale DDoS attacks. I don't have instant access to thousands of Internet-connected computers around the world, and I doubt you do either. Nor will we likely ever. It takes a lot of planning ahead of time, such as well-planned and well-distributed malware to create what is called a "botnet" (a large group of computers infected with malware that allows you to take control of them remotely). And you have to have a way to communicate with the network without it being traced back to you, which again is very difficult.

One of the largest botnets of all time was the "Storm Botnet". It was distributed essentially as a trojan, and once a computer was infected, most of the time they would be dormant, but somewhere around 10% at any one time were working on infecting other systems. It was first detected in the early 2000's and peaked around 2007. At its peak, it was estimated to be on 25 million computers ranging from home users to high-level government workers. Much of their tasks were programmed to be handled automatically, although the "zombie master" could reprogram them remotely for other tasks. All communication was handled through a very complicated ICQ routine dubbed "fast flux", where the route of the channel changed far too fast to be tracked. At its peak, the Storm Botnet had enough collective CPU cycles and bandwidth to DDoS entire European countries off the Internet. As far as anyone knows, it was never used for a DDoS, however. But that kind of power is a huge threat, and the FBI, along with several major computer security firms had groups of experts monitoring and trying to crack it at all times for years. Starting in 2008, a combination of slower infection rates due to antivirus programs, some well-placed counter attacks through its P2P communication routes, and detections that Storm was being broken down (possibly for sale to organized crime) lead to its decline, and today it is nowhere near the threat it used to be. Although it definitely is still out there.

These kind of attacks have been around since the beginning of the internet. It was actually the ONLY thing the movie "Hackers" got somewhat right. Real hackers use to use these methods to drop banks and then log in to the system on the reboot process to get in.

The one method I have seen used the most to prevent this is a Flood Control. The major issue with flood control is the very ugly page that says too many people are attempting to use the server which looks very non professional. To fix this one could put a reroute in place to a backup but this kind of thing happens so little these days due to the massive amount of bandwidth servers have and the amount of resources one would need to drop a server these days.

Back in the old days you could do it with a few thousand connections and as Jack said there were virus's to do this.

Wow, i knew the first D was for multiple sources, but I still thought those multiple sources worked like alone, but since they were doing the same and at the same time it would be a bigger attack scale.

I've heard about the botnet before too, its a bit scary since your pc can be perfectly normal and a % of your CPU being used for DDoS attacks

Well why they dont use HTML + CSS to style that ugly page

Thanks a lot for the info jacko and halls , i love to learn this kinds of stuff, but i would hate to work on some research center for this subjects... Poor guys :/

hallsofvallhalla wrote: The one method I have seen used the most to prevent this is a Flood Control. The major issue with flood control is the very ugly page that says too many people are attempting to use the server which looks very non professional. To fix this one could put a reroute in place to a backup but this kind of thing happens so little these days due to the massive amount of bandwidth servers have and the amount of resources one would need to drop a server these days.

But isn't that basically the same thing as being down? As soon as you open up the reroute to the backup, it will instantly be DDoS'd. I don't see how it would prevent anything. I didn't even think there really was any cure or protection for a true, wide area DDoS (since, for all you can see, it is just a flood of legitimate users from different IP addresses) besides just rolling over, taking it and hoping it stops soon lol.

That's really scary... It's like a disease from there is no cure... only treatment.. And the risk is always there... If i was facebook, amazon, paypal, those big sites owner or manager i couldn't even sleep knowing my website could crash like that...

This technology starts to scare the hell out of me.. I'm a good guy

vitinho444 wrote:That's really scary... It's like a disease from there is no cure... only treatment.. And the risk is always there... If i was facebook, amazon, paypal, those big sites owner or manager i couldn't even sleep knowing my website could crash like that...

This technology starts to scare the hell out of me.. I'm a good guy

I found some random Cisco documents that was talking about how to fight DDoS attacks by looking for specific tells in the packet headers that can show they are from a common DDoS attack program. Of course, I am sure that would only work if they use something off-the-shelf, and if it isn't too massive of an attack.

The issue with DDoS (which yes I had) is that basically it doesn't flood only your server but even the router or the link are basically saturated. Patching your router to be intelligent enough and detect those will help little if all the network is saturated. So what's the solution? There are a couple:

1) Have a large distributed network to answer to any possible requests (google, and other big companies have that). You may flood one net, but all? Hardly possible.
2) Un-connect your net while being under attack and hope it will last only for so long.

Jackolantern wrote:

vitinho444 wrote:That's really scary... It's like a disease from there is no cure... only treatment.. And the risk is always there... If i was facebook, amazon, paypal, those big sites owner or manager i couldn't even sleep knowing my website could crash like that...

This technology starts to scare the hell out of me.. I'm a good guy

I found some random Cisco documents that was talking about how to fight DDoS attacks by looking for specific tells in the packet headers that can show they are from a common DDoS attack program. Of course, I am sure that would only work if they use something off-the-shelf, and if it isn't too massive of an attack.

I once used the LOIC software, but i later found that that software was just a virus that with your consent (by using it) your pc would be used in the next DDoS attack.

a_bertrand wrote:The issue with DDoS (which yes I had) is that basically it doesn't flood only your server but even the router or the link are basically saturated. Patching your router to be intelligent enough and detect those will help little if all the network is saturated. So what's the solution? There are a couple:

1) Have a large distributed network to answer to any possible requests (google, and other big companies have that). You may flood one net, but all? Hardly possible.
2) Un-connect your net while being under attack and hope it will last only for so long.

Well if you are a mid-size company... just sit in the corner crying till the attack ends