Ask HN: How to mitigate Layer 7 attacks?

Posted by thegeekbin on Thursday October 17, 2019 @07:20AM
from the ask-hn dept.

Hi HN,

I was recently a victim of Layer 7 DDoS attacks, and use Cloudflare. Cloudflare was able to migrate them off, but I'm in the mix of changing from Cloudflare to my own system for most of my websites and my wifes (blogged about it here: https://thegeekbin.com/ddos-protection-my-experience/).

What's a reliable way to mitigate most layer 7 attacks? I've added into nginx filters for slow connections (eg, HEAD and wait X time to clog server resource, slowloris) and other things like bad user agents, R-U-DEAD-YET, etc. but I'm not sure that's going to be enough.

What's your take on this HN? Any pointers to provide good enough protection against most common attacks?

Thanks

( 7 comments | 8 points | on HN )

Re:Ask HN: How to mitigate Layer 7 attacks? by hamid_ra on Thursday October 17, 2019 @08:22PM (#21287592)

What is your website?! is it just a content website or you have some sort of services serving your requests in backend. Application DDos attacked can hugely impact your website if they can put load on your backend and eventually trash your servers. Some useful solutions for those scenarios: -proper authentication/authorization mechanism -keep stats per user or session and set quota on the number of requests per user or session -add captcha to your registration pages to prevent them from scripting your signup.

[ Parent | on HN ]

Re:Ask HN: How to mitigate Layer 7 attacks? by zzzcpan on Thursday October 17, 2019 @10:22AM (#21282343)

I'm assuming you also want a simple way to mitigate layer 7 attacks, which is the hard part. You can try something like gathering statistics of /24 IP subnets that make connections to your server and once you detect increase in unseen subnets that goes over some threshold you think your server can't handle - nullroute unseen subnets that go over that threshold for some short period of time. And on a web server side configure rate limiting for everything.

[ Parent | on HN ]

Re:Ask HN: How to mitigate Layer 7 attacks? by thegeekbin on Thursday October 17, 2019 @10:48AM (#21282621)

I’ve done some basic filtering against some slowloris etc type attacks, I’ve got lots of open proxy and relays blocked from the web. I’ve also got rate limiting in place now, and I’m offloading assets to a proper CDN. In the end my server should only serve a few hundred KB at absolute max, the rest handled by a CDN. My thought is with that it probably would hold up to the attacks. Thoughts?

[ Parent | on HN ]

Re:Ask HN: How to mitigate Layer 7 attacks? by zzzcpan on Thursday October 17, 2019 @11:04AM (#21282796)

Imagine something like a pingback attack [1], it can hit you from at least tens of thousands of IPs you don't yet filter, because they are not proxies or relays and will likely exhaust various resources: file descriptor, socket limits, CPU. And this is one of the most primitive layer 7 attacks not even attempting to look like a real user agent.

[1] https://en.wikipedia.org/wiki/Pingback#Exploits

[ Parent | on HN ]

Re:Ask HN: How to mitigate Layer 7 attacks? by gtirloni on Thursday October 17, 2019 @09:39AM (#21281914)

Cloudflare is a good way to mitigate those attacks. They have a pipe much bigger than what most attackers can get together.

You don't stand a chance against a DDoS and you have to work with your upstream ISP to mitigate some of it. They might not have the tools to help you though.

[ Parent | on HN ]

Re:Ask HN: How to mitigate Layer 7 attacks? by zzzcpan on Thursday October 17, 2019 @10:26AM (#21282389)

> You don't stand a chance against a DDoS and you have to work with your upstream ISP to mitigate some of it.

You do. Plenty of hosting companies provide layer 3 and layer 4 DDoS protection and layer 7 is best handled in your software anyway to avoid false positives.

[ Parent | on HN ]

Re:Ask HN: How to mitigate Layer 7 attacks? by gtirloni on Thursday October 17, 2019 @10:29PM (#21288148)

How would you respond to these: https://www.cloudflare.com/learning/ddos/famous-ddos-attacks...

[ Parent | on HN ]