Cloud DDoS Mitigation Services Can Be Easily Bypassed (softpedia.com)

Posted by ryuzaki0 on Saturday October 10, 2015 @11:40PM from the your-computer-is-broadcasting-an-IP-address dept.

An anonymous reader writes: A recent research paper shows that most Cloud-Based Security Providers are ineffective in protecting websites from DDoS attacks, mainly because they cannot entirely hide the origin website's IP address from attackers. As five security researchers from Belgium and the U.S. are claiming, there are eight methods through which these mitigation services can be bypassed. The techniques of obtaining a website's origin IP address rely on hackers searching through historical Web traffic databases, in DNS records, subdomains that resolve to the main domain directly, the site's own source code, when the main website triggers outbound connections, via SSL certificates, via sensitive files hosted on the website's server, and during migration or maintenance operations on the mitigation service itself, which leaves the target website temporarily exposed.

1 of 40 comments (clear)

Min score:

Reason:

Sort:

have your origin accessible to only your provider by Anonymous Coward · 2015-10-10 23:56 · Score: 3, Interesting

Akamai sells as an add-on for "origin cloaking", called "Site Shield", inwhich the origin to limits access to only a subset of akamai systems (which then distribute to the rest of akamai), and drops the rest of the internet. I wonder if that is effective against these attacks?