DDNS attacks

Distributed denial of service (Ddos) is when a collection of computers are owned by an attacker/zombie master who then runs stress testing tools or bots against the victim.

Zombies are normally found by block ip port scanning for systems infected with Trojans listening on there respective ports, these scanners are very powerful ad can scan a small country of all it’s computers in a couple of hours, once they exploit these back doors and gain root/admin status to the infected system they then remotely instal a stress testing tool/bot. A good Ddos attack will normally have around 400 – 1000 zombies which will all be used in synch, and the master will normally use IRC as the attack HQ with fellow masters also attacking you.
When the attack happens basically your being flooded with packets of either ICMP, SYN, UDP or SMURF from the zombies the master ‘owns’ and if the master has enough zombies say bye bye cause your connection is going loco. You only need five progs that are readily available on most ‘security sites’ to set up a basic but highly effective Ddos attack and it is very simple to do, hence why it’s one of the commonest attacks out there. Ddos attacks are not used for just killing bandwidth and taking websites offline, they can also be used to attack firewalls.

You can get bandwith probs when alot ppl directly link to media on your website. You can try to rename the media to correct this problem.

There are hundreds of bots and alot of them are very highly configurable and theres bots that’ll eat bandwidth….. any type of distributed attack is an attack on bandwidth full stop.

However i find it highly unlikley your being attacked unless you either píssed someone of in IRC chat or you have a website that someone disagrees with.

@o0neo wrote:

Thanks for that Super, its been puzzling me be for a while this problem as the people Ive asked to see if they are doing it , say its most like search engine spiders and not these zombies you’ve mention , which i feel is a more fitting name for it .

I was wondering if i could ban the odd ip or dns , be a pain to change every media file.

valuable information there super .. nice 0ne :wink:

I think that renaming all media with some bizarre name that ppl aint gonna type in search engines is best in the long run. If your having bandwidth probs thats means it’s gonna be alot of ppl directly linking to your site and you’ll be there for ages banning ip’s then theres the problem of dynamic ip’s like dial up.

On a second thought to make 100% sure you could try pinging all major search engines, recording there ips and banning them, i think this would stop them linking to your site in futre

start>run>cmd>ping http://www.google.com