Can I use captcha to hold off a DDos?

if they attack the captcha, it wont have too much of an impact because the captcha is not load intensive, right, so if they attack the captcha it won't have too much of an impact right?

GrantNO5:  Even if you used captcha in a "referral" manner, it doesn't prevent the server that is doing the referral from going down by the same DDOS method.  DOS would still be accomplished.

Especially if the point of failure is bandwidth or firewall overload.

i am not comfortable disclosing what site it is but it is a site that gets about 3 million pageviews and 1.5 million uniques  month

Well, after thinking about it for a few minutes, a captcha could help on the server's load. It would reduce the load caused by the DDoS if it served a blank page or something instead of running intensive server-side scripts. The bottleneck at that point would then probably shift to bandwidth availability as opposed to server resources. Other than that and moving your server to another IP address and nullrouting the other until the attack is over, alll you can really do expand to withstand the increase in traffic.

understandable....


With regard to DOS,.... In most cases, what is being requested from your server, by the attackers, isn't as important as the amount of simultaneous requests coming in.

Simply sending enough simultaneous requests for the default page, can overload a web service or max the bandwidth or router processing power... it just depends on the nature of the attack.

Have you tried running a packet capture on web server to see what is coming in ?

xuserx: I thought of that about a minute after posting. You are correct. If the referred CAPTCHA was DDoSd it would still take the site down via proxy.

Exactly... which is why there is no cheap/easy solution for this yet.... and even sites like Yahoo or Google can experience DoS from time to time.... and their mitigating solution is to have server service clusters with failover.

I think we all agree that "something" needs to be done immediately even if the long term solution is expanded infrastructure.

Before we can do that.... we have to identify the exact point of failure.  Is it the SQL service, the web service, bandwidth, or router load ?

We have to know what the bots are requesting if you don't already know this.  I would suggest packet capture during off-peak hours using wireshark or netmon.  Try to identify the http GET or POST packets that are in fact malicious.  If it's requesting or sending something to a specific web service or page... a simple code or site rearrangement change may stop the effectiveness of the attack.

yeah according to the ISP, the requests are distributed across multiple scripts, its not one script that is being overloaded, if it was, i would have shut it down

the overload is on the database and the web service, bandwith is not that big of an issue because we are not getting a huge enough amount of requests for the isp to take us offline, we are just getting enough to shut down my server

also, what is the consensus on the captcha? if the captcha script is low resource intensive, do you guys think it will work or not?

also there is no workaround around this right

i was also thinking that i could upload static html versions of my pages (the total # of pages is like 7000) and i have the static pages but the problem is the file names do not have the same name as the urls on my site. To make the urls the same I will have to rename the file names to include slashes (/) in multiple places but you can't have a / in the file name so this is not working either.

because there is a script that powers these 7000 pages, i can shut it down if I can get these static pages up instead of it

another idea - it seems the speculation is that these kinds of attacks come from outside the US, so should i just temporarily block all non-US traffic. The site typically gets 40% of its traffic from outside the US but I am willing to sacrifice that now if the site would work properly for US traffic (which is where the bulk of the ad revenues come from)

I'm not sure how captcha would prevent making calls to the web app on the server...or just the bombardement of the server in general.

I don't think it will work, but then again I don't profess to know everything..... it's just that, if captcha was a solution for DoS, then more people would use it in that manner.

These dos attacks don't last forever... so temporarily blocking most of the bad traffic, would be a decent short term solution.  I would try to be very selective of course when blocking entire address blocks.

Clustered/distributed services with failover would be an actual solution....long term.

I would get a general feel for where the traffic is coming from and block traffic not coming from the US, Canada, or major European countries (such as Germany, France, UK, etc). That will hopefully lessen the load at least a little bit.

The captcha seems to be improving things but the server is still a little slow but more importantly, captcha is not a long-term solution, so short of upgrading the server, can anybody think of any other solutions? e.g. should i buy an anti-ddos software? is there any free sofware that i can try on a trial basis and see whether it deals with the problem and then if it does, i can buy it

Some firewalls like Sonicwall have built in anti-ddos features....

I'm not sure how well it works, because I haven't been the subject of an attack in quite a while and i've only had this firewall for about a year....

does anybody know if there is a way to get temporary server resources (e.g. via cloud computing)? I temporarily need additional serving capacity.

My hosting company says the ddos attack has subsided but my current server is still overloaded, they say its because the server is not powerful enough but just last week the current server was fine and traffic has not increased much, so I temporarily want to add additional serving resources and see whether that fixes the problem.

Amazon Web Services.  You can create it and activate on demand.  You pay per hour of use, not flat rate per month.

So, you could pre-populate/provision the server, then leave it dormant until traffic required its use.

It called Elastic Compute Cloud (EC2):
http://aws.amazon.com/ec2/#pricing

United States		
	 	
Standard On-Demand Instances 	Linux/UNIX Usage 	Windows Usage
Small (Default) 	$0.10 per hour 	$0.125 per hour
Large 	$0.40 per hour 	$0.50 per hour
Extra Large 	$0.80 per hour 	$1.00 per hour
		
High CPU On-Demand Instances 	Linux/UNIX Usage 	Windows Usage
Medium 	$0.20 per hour 	$0.30 per hour
Extra Large 	$0.80 per hour 	$1.20 per hour
                                              

1:
2:
3:
4:
5:
6:
7:
8:
9:
10: