I hope another takeaway from this was to check at a lower level much sooner. At least the way it reads you spent quite some time suspecting your app being at fault or the tech stack goofing out. Htop should have shown high cpu usage from the db process right away, traffic was probably more than usual; access logs are always a good thing to check too.
Jerks on the Internet: what my first DDoS taught me
51–60 of 95 posts
Re: Jerks on the Internet: what my first DDoS taught me
#52Earlier quoted context omitted.
Those requests seldom get far enough to start significant server activity. It's the ones that look like legit requests that are the problem.
Seldom isn’t good enough. When it comes to security you have to be right 100% of the time. An attacker only has to be right once. Good luck.
That's not true. Security is always a trade-off between effort invested and probability of a possible breach.
There is no 100% secure system.
Re: Jerks on the Internet: what my first DDoS taught me
#53Can anyone shed some light on why someone would go out of their way to conduct an attack like this? Is DoSing production web applications just a hobby for black hat jackasses with nothing better to do?
Re: Jerks on the Internet: what my first DDoS taught me
#54If you have some kind of expensive request, use fair queuing by IP address. If someone has a request pending, more requests from the same source go behind IP addresses with fewer requests. So each IP address competes with itself, not others. For some reason, this isn't done much. I have it on a site of mine. I didn't notice for a week that someone was making a huge number of requests and not even waiting for the task…
It’s not used because any serious attack is going to come from multiple unrelated sources, think a botnet full of compromised IoT devices hitting your server with 20TB a second worth of requests. So you might as well plan for that scenario instead.
That's an entirely different kind of attack. If your server is being flooded with 20TB/s of traffic, there's nothing you can do on the box itself to fix things. Whatever you do, the legitimate requests won't be able to get through.
If however your DOS attack is an attacker making lower-volume CPU-expensive requests on your site, there's plenty of things to help mitigate the assault.
Re: Jerks on the Internet: what my first DDoS taught me
#55Earlier quoted context omitted.
It’s not used because any serious attack is going to come from multiple unrelated sources, think a botnet full of compromised IoT devices hitting your server with 20TB a second worth of requests. So you might as well plan for that scenario instead.
Those requests seldom get far enough to start significant server activity. It's the ones that look like legit requests that are the problem.
Only a small percentage of a volumetric attack has to get through to take you down. Also, depending on the attack, they probably all are "legit requests."
Re: Jerks on the Internet: what my first DDoS taught me
#56Earlier quoted context omitted.
oh..gosh. well, that makes sense, in a way. I confess I did have to google how to spell 'psych' properly. started from 'pysch'.
I always was sure it was spelled psych, since it's basically short for "psyched out" and I had always seen it spelled that way. But the topic recently came up in conversation with my teenaged niece, she claims it's definitely spelled "sike" even though she's fully aware of the etymology. I chocked it up to a "kids these days" generational kinda thing, like how we got "phat" in the 70s and "kewl" in the 90s, both of w…
>I chocked it up
chalked it up ;)
Re: Jerks on the Internet: what my first DDoS taught me
#57Earlier quoted context omitted.
Those requests seldom get far enough to start significant server activity. It's the ones that look like legit requests that are the problem.
Seldom isn’t good enough. When it comes to security you have to be right 100% of the time. An attacker only has to be right once. Good luck.
This is not true though. Security is about mitigating threat at some cost. There are some threats you can't mitigate cost-effectively. Some are unmitigable at all.
Re: Jerks on the Internet: what my first DDoS taught me
#58Can anyone shed some light on why someone would go out of their way to conduct an attack like this? Is DoSing production web applications just a hobby for black hat jackasses with nothing better to do?
Lumping DDoS in with hacking has always seemed disingenuous. skiddies DDoS things. Why? Who knows. Boredom? lulz? Perceived personal slight? "Justice"?
Re: Jerks on the Internet: what my first DDoS taught me
#59Can anyone shed some light on why someone would go out of their way to conduct an attack like this? Is DoSing production web applications just a hobby for black hat jackasses with nothing better to do?
I don't know much about "blackhats" but I know people, so the answer is yes.
Re: Jerks on the Internet: what my first DDoS taught me
#60Can anyone shed some light on why someone would go out of their way to conduct an attack like this? Is DoSing production web applications just a hobby for black hat jackasses with nothing better to do?
Pretty sure it's jackasses with nothing better to do. Either for revenge or the lolz. Probably an impulsive decision since the attacker gave up so fast.
There's not much you can achieve for your own gains with a DDoS. I've heard of rare cases of extortion or underhanded business practices to hurt competitors.