Film-Tech Forum ARCHIVE: What are DDoS Attacks and how to Stop/Prevent Them?

This is topic What are DDoS Attacks and how to Stop/Prevent Them? in forum Film-Yak at Film-Tech Forum ARCHIVE.

To visit this topic, use this URL:
https://ft-forum.com/ft/cgi-bin/ubb/ultimatebb.cgi?ubb=get_topic;f=8;t=003779

Posted by Joe Redifer (Member # 3) on 12-26-2004, 05:20 PM:

Another web site that I moderate is currently under "DDoS Attacks". WTF are DDoS attacks? All I can surmise from the person who runs the site is that there are many, many HTTP requests for that domain coming from many different "fake" IP addresses, which has caused the site to be suspended for the time being. He is afraid that he will get charged for the attacks. Would any reputable hosting company do that?

Also, is there a way to stop or prevent these type of lame-ass attacks?

Posted by David Stambaugh (Member # 1102) on 12-26-2004, 07:37 PM:

Lots of good info here and here.

Posted by Bobby Henderson (Member # 840) on 12-27-2004, 12:26 AM:

quote: Joe Redifer
Also, is there a way to stop or prevent these type of lame-ass attacks?

Not really. At least not with the way large ISPs currently do business. The link to the GRC.com's DOS attack story page illustrates this fact very specifically. They don't care about customer problems or the bad conduct of other users.

The amount denial of service attacks would be greatly reduced if large ISPs would automatically detect and delete any malware infected e-mail arriving on their mail servers. Most computers are infected and turned into "bots" via e-mail (typically downloaded via Outlook Express in its dangerously unsecure default configuration). This is by far the most effective and effortless method to use in infecting computers and building up an army of bots. If the ISPs would just kindly pull their heads out of their backsides on this issue, you would see a great deal of the problem disappear in a very short amount of time. This step would not eliminate the problem completely (you still have usenet, chat and P2P postings of malware). Hackers would have to build bot armies in a much slower fashion.

Posted by David Buckley (Member # 2600) on 12-27-2004, 05:11 AM:

Perhaps not in the best taste, but the spam that delivers the malbots (amongst much other cr*p) has reduced in volume dramatically coincidentally since a certain natural phenomena affecting much of the pacific rim occured...

As an observation, tonight on tele here in New Zealand we had the episode of Watching Ellie featuring an earthquake, and the movie The Beach. I cant help but think that when I lived in the UK both of these would have been canned and replaced with items less related to curent news.

Posted by Mark J. Marshall (Member # 1409) on 12-27-2004, 09:06 AM:

A friend of mine is a Novell engineer. He said that the FBI came to Novell once and asked them why Border Manager (their firewall software) was issuing DOS attacks against ISPs. Novell had no answer of course. They did some investigative work and they discovered that the customers who were supposedly issuing the attacks against the ISPs via Border Manager had Border Manager's reverse proxy services turned on. Reverse proxy caches a web server's content and then hands out the responses to the HTTP requests coming in so the surfing PCs never actually touch the web server itself. As it turns out, there was a DOS attack going on against company with the Border Manager proxy server, but Border Manager's proxy server is so fast, it was actually able to keep up just fine, and the result was that it looked like there was an attack against the attacker's ISP.