2 ms·
The program that is being used is a multi-threaded .NET app that opens a lot of connections and then allows them to timeout. Easiest form of DoS to carry out a
by nikcub 16y ago
The program that is being used is a multi-threaded .NET app that opens a lot of connections and then allows them to timeout.
Easiest form of DoS to carry out and easiest to defend.
Prevention:
a) Upstream forwarding proxy that will block all requests from an IP that hammers the server
b) Low timeouts (5-10 seconds)
c) Intelligent upstream router than can drop the routes
d) They are hitting mastercard.com, which should be distributed on a CDN
e) Separate the public website from the application, don't even but them in the same IP address block
At Techcrunch we survived a 4chan DoS attempt. Surprised Mastercard didn't (I think the scale of this attack is larger, but still)
- wildmXranat 16y ago>At Techcrunch we survived a 4chan DoS attempt I wouldn't mention it; just my friendly advice. Anon is a fickle beast.
- ubercore 16y ago> I think the scale of this attack is larger, but still That's a pretty large but, when a DoS is, by nature, all about scale.
- icegreentea 16y agoIn fact, pretty sure it's this program: http://en.wikipedia.org/wiki/LOIC http://en.wikipedia.org/wiki/LOIC They even gave it a cute name. I find the 'relinquish control' part really interesting. Someone could totally f anon over if a hivemind version with access to the OS was released. Yeah, you could only ever use it once, but once is enough. 4chan would reverb about it for months. Also because I just kept imagining the program playing a clip of the Harbinger going "assuming direct control" whenever you relinquish.