Ask HN: "Creative" ways to handle abusive http traffic?

Re:Ask HN: "Creative" ways to handle abusive http traffic? by SrslyJosh on Friday May 25, 2018 @09:25PM (#17159561)

I think you may be on on to something the honeypot server...you could create something like Slowloris in reverse. One of the techniques it uses is to send a request one. Byte. At. A. Time. Very. Slowly. You could try doing the same thing with responses from your honeypot, which, assuming they don't give up before they get the full response, could even be redirects back to the honeypot.

But if you can ID them easily then iptables rules might be the most effective use of your time, especially if you can use fail2ban, which makes the whole process very easy.

The TLS thing is interesting, but if some of this traffic is coming from compromised devices it would probably be less harmful for the owner of the device if you didn't make them burn a ton of CPU cycles.

[ Parent | on HN ]

Re:Ask HN: "Creative" ways to handle abusive http traffic? by tyingq on Friday May 25, 2018 @09:56PM (#17159695)

This. Honeypot with fake data once you're sure they are a bad actor. That will reduce their value as a provider of data.

It's fairly easy to create fake, but checksum compliant credit cards.

[ Parent | on HN ]

Re:Ask HN: "Creative" ways to handle abusive http traffic? by jbyers on Saturday May 26, 2018 @12:40AM (#17160244)

This works surprisingly well for a class of unsophisticated attackers. nginx, among others, will happily spoon-feed very large numbers of concurrent clients at 1 byte / second.

[ Parent | on HN ]

Re:Ask HN: "Creative" ways to handle abusive http traffic? by jon__k on Sunday May 27, 2018 @07:21PM (#17169708)

After using fail2ban in production I've noticed Chinese attackers will start using a massive amount of entire subnets, which eventually cause servers to crash with such long Iptable rulsets.

[ Parent | on HN ]