1

We have received a DDOS attack with the same pattern with all requests:

  • Protocol HTTP
  • GET
  • Random IP Address
  • Loading the home page /

Our server was returning a 301 to all requests and we had problems with the performance, the server was down.

We have blocked all requests coming from the HTTP and we have stopped the attack, we would like to know why we are receiving the attack to our servers under HTTP and not HTTPS from different sources, we would like to know if the source IP could only be changed using HTTP requests?

What's the best way to prevent this kind of attacks?

Our server right now is only working with HTTPS without issues. Server running on Azure Web Apps.

1 Answer 1

3

We have blocked all requests coming from the HTTP and we have stopped the attack.

Please note, when people type in your URL in browser manually, the first hit is usually over HTTP. If you turn off HTTP, people will not be able to access the the site by simply typing in your domain name.

we would like to know why we are receiving the attack to our servers under HTTP and not HTTPS from different sources

This is by the attacker to decide. Most probably it was only coincidence that the attack went over HTTP only.

we would like to know if the source IP could only be changed using HTTP requests?

No. For an HTTP request to be performed you need to do TCP handshake first. This means, that you can not fake the IP address easily, as you need to actively participate in the communication and the routers must see you as a valid participants. You can fake the IP while being in the same local network but it would be only for one packet and would not allow to perform a TCP handshake correctly.

What's the best way to prevent this kind of attacks?

We're still struggling with DDOS and there is no 100% solution. An attack of sufficient scale can turn down the internet as it did in the past already. There are some things you can do like:

  1. Rate limiting - put some brakes on the incoming traffic not to kill your infrastructure completely. You will loose some valid traffic, but you will be up and running.
  2. Filtering - pain when dealing with DDOS attacks. Analyse which IP addresses are attacking you constantly. Filter them on your firewall. (Imagine the fun when you are being attacked by 100k IoT devices). A WAF (Web Application Firewall) may allow you to filter not only on IP addresses but also on other request parameters too.
  3. Scaling up - more infrastructure can do more.

In most cases all you need to do is survive till the attack is over.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.