full-disclosure - Re: Who's behind limestonenetworks.com AKA DDoS on polipo(8123)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130818080458.GG8556@debjann.fritz.box>
Date: Sun, 18 Aug 2013 10:04:58 +0200
From: Jann Horn <jann@...jh.net>
To: Valdis.Kletnieks@...edu
Cc: Full Disclosure List <full-disclosure@...ts.grok.org.uk>,
 Jann Horn <jann+couchdb-dev@...jh.net>
Subject: Re: Who's behind limestonenetworks.com AKA DDoS
 on polipo(8123)

On Sat, Aug 17, 2013 at 07:50:34PM -0400, Valdis.Kletnieks@...edu wrote:
> On Sat, 17 Aug 2013 13:39:16 +0200, Jann Horn said:
> 
> > And yes, you're right, a DoS attack can be unsuccessful. My point was that
> > this small amount of traffic shouldn't be called a DDoS because there's no
> > way that the intention behind this amount of traffic was to take down that
> > service with pure bandwidth.
> 
> How quickly they forget....
> 
> Not all DDoS are pure bandwidth based.  Consider SYN flooding, where the
> packets sent are relatively small and often not even all that frequent, but can
> tie up large amounts of resources on the target machine. This sort of attack
> works particularly well against sites that have a big blind spot because they
> think that all DDoS attacks are massive bandwidth hosedowns.

So, why would an attacker use a distributed attack for that? Wouldn't
one machine with good connectivity be sufficient (assuming that you spoof the
source address differently each time)?


> How many connections/sec does it take to forkbomb your Apache server into
> uselessness?  And if you rate limit your Apache so your system doesn't
> forkbomb, how many does it take to prevent legitimate traffice from being
> serviced?

Right, that would be much harder to block if it was distributed.

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/