DOS attacks, UDP bombs and combating them

niroshido

Distinguished
Jan 15, 2012
112
0
18,710
Hello,

I have noticed that over a one month period that i have been made victim to DOS attacks. I have attempted some measures in order to combat the problem however it doesn't seem to have worked, so i am left wondering a few things

Who is doing it (this question is kinda stupid because the logs are saying that it's coming from Brazil, Ukraine, Uk, usa and a variety of other locations i.e. someone is using proxies)

Why are they doing it (well this questions is kind of irrelevant as it's clear no one really needs a reason to do it, but i felt like asking it anyways)

Is this actually a personal attack (i.e. does the attacker or attackers know who they are attacking)?

and now the most important questions

What measures should i deploy?

What measures could the ISP deploy, if any at all?

Is it possible for Malware on my PC to enable this sort of attack or simply indicate to the attacker that i'm online and simply start an attack?

Do i need a new external facing IP address, if i recall the external IP address is dynamically allocated when accessing the internet through a DHCP server (does this mean when the router is restarted or in general, every time you turn on a PC and try to connect to the internet

Do i need my own proxy?

i know these questions can seem open ended and somewhat difficult to answer but it is quite annoying to find the reasons to sometimes losing connection with the outside world as a result of someones mischief

there is one last question i have

A friend of mine and myself as well downloaded Kali Linux, my friend claims to have received numerous viruses on his computer (while kali is installed on a virtual machine, but not being used) and i seem to coincidentally be hit by DOS attacks, is there any reason for this or is it mere coincidence or is there something i should know about Kali Linux?

Thanks in advance.
 
I doubt kali linux is causing any issues this is a tool used to check security so it very unlikely to have virus. Besides it is unix there are almost no virus that run under unix and you can not get virus between virtual machines unless you are really stupid and share all the drives.

Why do you think you are being DoS. Almost all machines receive some traffic digging around looking for holes in the security. A actual DoS sends so much traffic that it can disrupt your internet connection. Pretty much they will send massive amounts of random traffic to use up all your bandwidth. The other attacks try to overload the router with things like half open sessions. Most routers are so powerful that it is very hard to exceed their capacity and they recognize this attack and mitigate it. The brute force flood the connection attack is also far less effective because so many people now have 20,50,100m or more. It gets to the point that the attacker can not generate enough traffic easily.

I can't be fixed. Its like all the telemarketers that still call even though its illegal to call people on the do not call list. You can not trust the source addresses on any of the data you are receiving just like you can not trust the caller id on the calls from the telemarketers.

Now there is a lot of traffic people think is DoS when it really isn't. If you run torrents your IP will be roaming around in the lists for quite some time. Other peoples torrent clients will check to see if they can connect to your machine.
 

niroshido

Distinguished
Jan 15, 2012
112
0
18,710



After checking my routers system logs it says something like the following (this quote will be missing some stuff since i am far from my home computer)
"kernel: UDP bomb from src:x.x.x.x to destination: x.x.x.x"
"kernel: UDP bomb from src:x.x.x.x to destination: x.x.x.x"
etc. etc. etc. (the IP addresses are made up) so if my router says UDP bomb i can pretty much assume that it is a UDP bomb. btw these UDP bomb messages extend for about 4 or 5 pages.
 
I will assume you made up your destination IP otherwise remove it.

UDP bomb attacks as I suspected are only sorta a denial of service. As long as your router recognizes them and discards them it is not a issue. It just produces annoying messages. Unless they send so many of these that they exceed your download capacity they will have no effect.

This is old attack that used to cause the machine receiving them to itself generate more traffic which is what caused the DoS. Now days as you have found many routers detect these attacks and protect you from them.
 

niroshido

Distinguished
Jan 15, 2012
112
0
18,710


After checking my routers system logs it says something like the following (this quote will be missing some stuff since i am far from my home computer)
"kernel: UDP bomb from src:x.x.x.x to destination: x.x.x.x"
"kernel: UDP bomb from src:x.x.x.x to destination: x.x.x.x"
etc. etc. etc. (the IP addresses are made up) so if my router says UDP bomb i can pretty much assume that it is a UDP bomb. btw these UDP bomb messages extend for about 4 or 5 pages.

read my reply to your reply i clearly stated that none of the IP's are my IP's or someone elses. I still appreciate the help.
 

Kewlx25

Distinguished
How much bandwidth is the UDP "attack" actually consuming? As far as I can tell, a "UDP bomb" attack is just a DDOS that consumes bandwidth. If you downloaded Kali Linux via BitTorrent, your IP address may be in the DHT and lots of computers are attempting to connect to your machine over UDP. This cna last for days, but is very little bandwidth, like in the tens of kilobits per second average.