+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: How to prevent/stop DoS/DDoS attacks (/Thread-How-to-prevent-stop-DoS-DDoS-attacks)
How to prevent/stop DoS/DDoS attacks - Dreamwalker - 10-16-2013
I want to make this clear that this isn't a complete guide, it's more of a overview if anything.
It's much easier to launch a DoS/DDoS attack than it is trying to prevent one, if you've ever been on the flip side you'll know exactly what I am talking about and it goes without saying how many problems it can cause, from financial, loss of good will and so on. The truth is you can never "completely" stop such an attack, especially when a website (as web servers are the most common target) has to be exposed to the public, so it's something you're always vulnerable against.
There are often a few ways to prevent such attacks; I want to discuss them briefly with you and just assume it's a website being attacked for arguments sake (but same rules apply to everything).
Fancy kit
Yes, there is some hardcore hardware out their specifically designed to filter such attacks, but they are often VERY PRICEY and only the much bigger companies that will get them. Now they are good and you certainly get what you pay for, but there are so many products available, too many mention. But as an example Cisco Guard and Juniper NetScreen are the types of things I mean.
Configuring your server and backing up data
OK, even though it's on the software side you want to configure your webserver and database if you have one, while not as effective as a hardware firewall it still filters traffic, applies rules, and when configured properly can handle many problems and prevent errors, including backing up data, allowing users to view an archived site, storing the database, re-directing pages, blocking IP's, filtering traffic and managing certain TCP handling. This way, while it may not completely stop the attack, it can slow it down, still allowing many legitimate users to the site, prevent server side and database errors and so on. For this you want to read up on configuring the actual server you own (ie; Apache, IIS), along with any databases etc (ie; SQL) and take it from there. And if you can afford it, get multiple servers.
Configure your router/switch/hub and turn it into a hardware firewall! (cheap and very effective)
For arguments sake we'll say you're running a router. Now this is probably the most effective method (cheaply) for stopping incoming attacks, because it works like so:
SERVER->ROUTER->WWW->ATTACKER
you still want to configure your website server side (and db etc), but now, before anything hits your server, you want to try and filter this out. MOST devices have configurable built in protection (even my home Virgin hub has complex protection) but they're often in default, which generally means crap, so you want to configure this. You will often have options like block fragmented packets, allow IP's a finite amount of bandwidth, block address and/or IP range if an attack is detected for a timed period of indefinitely and so on... this is fantastic protection and can really help in an attack. So look into the vendor for your router/switch/hub and see how you can configure it.
I am the law
If you're being attacked persistently by the same person(s), and/or if it's one or a small amount of individuals, you may want to report their IP address to their internet service provider (Note: try not to be too angry as it's possible the IP's are spoofed, they're a unknowing participant etc) and what often happens is, they will do an investigation and block the internet for those individuals until the matter is resolved one way or the other.
Don't panic!
No matter how good you are and technically savvy, you can never as aforementioned completely stop DoS/DDoS attacks, but you can deal with it in the right way, if you follow some of the above steps it will help you equip yourself and be ready should an attack occur, and if so, deal with it calmly and professionally.
I hope this helps