Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Categories

In this Discussion

› › Thank Jebus Bhrist. - Page 3
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Thank Jebus Bhrist.

13»

Comments

  • ThundasThundas Member

    Now everyone and their grandmothers will know LET is weak vs L7 attacks.

  • jbilohjbiloh Administrator, Veteran

    We are still working the issue.

  • imgmoneyimgmoney Member

    I have peeked into hostloc and lots of talk regarding LET. It seems they are jealous.

    And I am surprised by seeing a screenshot. YABS screenshot is in English, it seems like the only thing they left without translating to Mandarian.

  • ps20090ps20090 Member

    Like when DDOS attacks against PlayStation happened those people were jailed/sentenced to prison. Can't this guy who did this can also be prosecuted/I meant prostituted/ I meant Involucrated

    Thanked by 1yoursunny
  • DPDP Administrator, The Domain Guy

    @ps20090 said:
    Like when DDOS attacks against PlayStation happened those people were jailed/sentenced to prison. Can't this guy who did this can also be prosecuted/I meant prostituted/ I meant Involucrated

    No, because this is not PlayStation 😁

  • SirFoxySirFoxy Member

    @jbiloh said:
    We are still working the issue.

    Reach out to the guys at Path, I have a connection if you need it.

  • jbilohjbiloh Administrator, Veteran

    @SirFoxy said:

    @jbiloh said:
    We are still working the issue.

    Reach out to the guys at Path, I have a connection if you need it.

    Appreciate it, thanks. May just do that.

  • FranzkafkaFranzkafka Member

    I got into hostloc,they are talking about LET.It seems that they are all surprised by the shutdown of LET.Maybe this attack is personal?

  • dahartigandahartigan Member

    @Hakim said:

    @yoursunny said: MJJ

    What does "MJJ" stand for?

    mjj = ancient chinese for "boy with no penis".. it's some type of weird group of disenfranchised chinese homosexuals who use ddos attacks to express themselves sexually..

    Some fucky shit there Julian

  • risharderisharde Patron Provider, Veteran

    As if the earth wasn't already a messed up place ...

    @dahartigan said:

    @Hakim said:

    @yoursunny said: MJJ

    What does "MJJ" stand for?

    mjj = ancient chinese for "boy with no penis".. it's some type of weird group of disenfranchised chinese homosexuals who use ddos attacks to express themselves sexually..

    Some fucky shit there Julian

    Thanked by 1dahartigan
  • redcatredcat Member

    @dahartigan said:

    @Hakim said:

    @yoursunny said: MJJ

    What does "MJJ" stand for?

    mjj = ancient chinese for "boy with no penis".. it's some type of weird group of disenfranchised chinese homosexuals who use ddos attacks to express themselves sexually..

    Is John Cena MJJ?

    https://youtu.be/pqjOrsMupgg

    Thanked by 1CheepCluck
  • darbdarb Member

    How to beat application DDoS attacks with CrowdSec & Cloudflare: https://crowdsec.net/2021/06/28/how-to-beat-application-ddos/

  • darbdarb Member

    How to beat application DDoS attacks with CrowdSec & Cloudflare: https://crowdsec.net/2021/06/28/how-to-beat-application-ddos/

  • TimboJonesTimboJones Member

    @yoursunny said:

    @stevewatson301 said:

    @yoursunny said: directly accessing the IP would leak the certificate of available virtual hosts.

    You could also use a webserver like caddy which only presents certificates if the ServerName in ClientHello matches one of the configured certificates, and sends a TLS alert otherwise.

    As I mentioned at the bottom, the MJJ's scanning method is ineffective: the attacker should always include the target domain instead of the IP in the ClientHello, so that the TLS server would return the certificate if it exists.
    Using a TLS server that validates SNI cannot protect against this improved attack.

    @yoursunny said: It is possible to configure firewall to only allow Cloudflare IP Ranges, but this would require periodical updates so that it's more complex than using a random IPv6 that nobody could guess.

    If the DDOS has already reached the origin, it's difficult to handle it using a firewall as it would now compete for CPU with the rest of the kernel and applications. You could consider filtering IPs in the PREROUTING tables though so that the packets get dropped without conntrack being invoked.

    The firewall is not a countermeasure for DDoS.
    It is to prevent finding the server by scanning global IP space, because anyone other than Cloudflare cannot reach the webserver.

    @dahartigan said:

    @Hakim said:

    @yoursunny said: MJJ

    What does "MJJ" stand for?

    mjj = ancient chinese for "boy with no penis".. it's some type of weird group of disenfranchised chinese homosexuals who use ddos attacks to express themselves sexually..

    Some fucky shit there Julian

    I doubt they're homosexual, more likely incels.

    Thanked by 1dahartigan
  • dahartigandahartigan Member

    @TimboJones said:

    @yoursunny said:

    @stevewatson301 said:

    @yoursunny said: directly accessing the IP would leak the certificate of available virtual hosts.

    You could also use a webserver like caddy which only presents certificates if the ServerName in ClientHello matches one of the configured certificates, and sends a TLS alert otherwise.

    As I mentioned at the bottom, the MJJ's scanning method is ineffective: the attacker should always include the target domain instead of the IP in the ClientHello, so that the TLS server would return the certificate if it exists.
    Using a TLS server that validates SNI cannot protect against this improved attack.

    @yoursunny said: It is possible to configure firewall to only allow Cloudflare IP Ranges, but this would require periodical updates so that it's more complex than using a random IPv6 that nobody could guess.

    If the DDOS has already reached the origin, it's difficult to handle it using a firewall as it would now compete for CPU with the rest of the kernel and applications. You could consider filtering IPs in the PREROUTING tables though so that the packets get dropped without conntrack being invoked.

    The firewall is not a countermeasure for DDoS.
    It is to prevent finding the server by scanning global IP space, because anyone other than Cloudflare cannot reach the webserver.

    @dahartigan said:

    @Hakim said:

    @yoursunny said: MJJ

    What does "MJJ" stand for?

    mjj = ancient chinese for "boy with no penis".. it's some type of weird group of disenfranchised chinese homosexuals who use ddos attacks to express themselves sexually..

    Some fucky shit there Julian

    I doubt they're homosexual, more likely incels.

    Homosexual incels at that.

  • TimboJonesTimboJones Member
    edited July 2021

    @yoursunny said:
    As I mentioned at the bottom, the MJJ's scanning method is ineffective: the attacker should always include the target domain instead of the IP in the ClientHello, so that the TLS server would return the certificate if it exists.
    Using a TLS server that validates SNI cannot protect against this improved attack.

    Did you typo? You have conflicting statements. Also, if the domain can't be specified using wget,curl, nc or their own tool, they'd just sed etc hosts. Trivial.

    @yoursunny said: It is possible to configure firewall to only allow Cloudflare IP Ranges, but this would require periodical updates so that it's more complex than using a random IPv6 that nobody could guess.

    This would be automated and I'm sure exists.

    @yoursunny said: It is possible to configure firewall to only allow Cloudflare IP Ranges, but this would require periodical updates so that it's more complex than using a random IPv6 that nobody could guess.

    You probably missed the whitepapers on IPv6 scanning and reconnaissance. There's an engineer who has blogged about IPv6 security and attempts at fixing in RFC's. I wish I bookmarked it. I thought you were against security through obscurity?

    You're better off moving the webserver to a unique port than expecting your IPV6 IP to never get probed.

  • bulbasaurbulbasaur Member

    @TimboJones said: You have conflicting statements.

    What's conflicting about it? Just send the same public hostname in the ClientHello to the origin instead of the Cloudflare IPs?

    @TimboJones said: This would be automated and I'm sure exists.

    Cronjobs, yes.

    @TimboJones said: You're better off moving the webserver to a unique port

    As if port scans aren't a thing.

    Thanked by 1yoursunny
  • jbilohjbiloh Administrator, Veteran

    I appreciate everyone reaching out with their offers of help and advice. Much appreciated.

    I'm working hard to keep the site online.

    Thanked by 2DP ps20090
  • dahartigandahartigan Member

  • mcsmcs Member

    you can use combined solutions, for example on this site - https://ddos-guard.net/en/store/web . And such attacks are not scary to you in the future.

Sign In or Register to comment.