Be calm when the unthinkable arrives. Modern tyranny is terror management. When the terrorist attack comes, remember that authoritarians exploit such events in order to consolidate power. The sudden disaster that requires the end of checks and balances, the dissolution of political parties, the suspension of freedom of expression, the right to a fair trial, and so on, is the oldest trick in the Hitlerian book. DO NOT FALL FOR IT.
- Timothy Snyder
同時也有19部Youtube影片,追蹤數超過50萬的網紅神魔之塔 Tower of Saviors,也在其Youtube影片中提到,In ancient century, humans built up Enochian Tower, attempting to reach Gods. However, Devils in Hell tried to exploit the Tower to invade Heaven. A b...
exploit attack 在 iThome Security Facebook 八卦
網路安全專家劉俊雄先前曾經接受iThome的專訪,
分享他對於DDoS攻擊的觀察。
囿限於媒體篇幅和屬性,
劉俊雄趁著夜深人靜之際,
把他對於DDoS攻擊的觀察有更深入的分享!!
關注DDoS攻擊所有的資安與IT人員,
都不要錯過這一篇動人的分享!!
感謝奧天大大不藏私的經驗分享~~
[淺談 DDoS 攻擊]
幾個月前受訪談了些 DDoS 的話題,沒想到最近一連串爆發了這麼多事件,也讓個人淺見出現在幾篇 iThome 的報導
http://www.ithome.com.tw/news/109932
http://www.ithome.com.tw/news/110135
http://www.ithome.com.tw/news/110144
http://www.ithome.com.tw/news/110137
http://www.ithome.com.tw/news/111861
因訪談限制及媒體屬性,無法很完整的表達我的看法,趁著夜深人靜時整理一下 :
DDoS 大略可分為三個層級 - 網路層、系統層、應用層,
網路層為癱瘓目標頻寬,典型手法為 UDP/ICMP Flood、以及近年流行的各種 Reflection&Ampplification 洪水攻擊;
系統層為癱瘓目標的基礎建設或系統層,典型手法為 SYN Flood、Fragment Packet Flood、Connection Flood 等;
應用層為癱瘓目標的應用服務,典型手法為 SSL Flood、HTTP Flood、DNS Flood、Exploit、Slow Attack 等。
十多年前個人剛接觸 DDoS 的時候,盛行的是「細巧」的系統層/應用層攻擊,但近幾年因許多協定的 反射&放大 手法被開發、以及 IoT Botnet 的盛行,應該會有一段時間轉為 「爆量」 的網路層攻擊。
以開店作生意比喻 - 將店門口及前方道路視為網路出入口及上游,店裡設施和走道空間視為基礎建設,結帳櫃檯視為應用系統。則攻擊者可以堵住店門和馬路、可以塞爆店裡的走道和空間、又或者癱瘓結帳櫃檯。
而 DDoS 為何難防 ?
這與企業為何很難阻止駭客入侵的原因一樣,攻擊方與防守方處於不對等的立場,攻擊者有太多的方式可選擇,且可不斷的調整與嚐試,防守方卻礙於人力與預算限制,難以全天候對每一種手法都有良好的對應措施。
許多老闆總認為花錢買設備就可以了事,但偏偏這不是單一設備、單一解決方式可以完全處理的,應該沒有一家的服務或設備直接上架,完全不需調校就可以完美對應每一種攻擊手法,需要有經驗豐富的專業人士視實際攻擊狀況調校參數及規則。有如同一把大刀,在關公和小孩手上耍起來實有天壤之別啊!
以本次券商 DDoS 事件來說,由媒體報導看起來是屬於 [網路層] 的攻擊方式,但即使加大頻寬、或由ISP端阻擋住了,難保哪天不會出現針對系統層或應用層等更為精細、打得更為巧妙的手法,加上金融業幾乎全用 SSL 加密應用服務,會使中間的清洗商更難介入分析應用層攻擊(除非提交 SSL 金鑰)。
至於實務上應該要怎麼阻擋會比較理想?
我的看法是需 雲端清洗+本地防護,量大的攻擊由雲端或上游清洗處理,而細巧的攻擊可能穿過清洗中心,則由本地的防護機制處理,但絕對不會是由 "防火牆" 這萬年設備,至於用什麼設備可達到較好的阻擋效果請洽各大 SI。
另外若預算許可下,還可建立多個資料中心或介接多條 ISP 線路,配合 GSLB 機制快速切換 DNS ,讓攻擊者難以鎖定每一個出入口,可增加攻擊難度及應變時間。
另外真的遭遇 DDoS 攻擊時,個人的簡易 SOP 大概如下 -
1. 快速診斷,描述症狀由專業人士判斷(有側錄封包更佳)
2. 對症下藥
- 洪水攻擊 : 請求 ISP/清洗商 協助、Black Hole、更換 IP / Multi ISP / GSLB
- 系統層攻擊 : 更換撐不住的設備、關閉負載高的功能、調整系統參數延緩攻擊影響
- 應用層攻擊 : 增加服務能量、減少異常存取
3. 減少異常存取的方法:辨識特徵 + 過濾
- 網路層特徵 (IP/PORT/ID/TTL/SEQ/ACK/Window/...)
- 應用層特徵 (SSL/URL/Parameter/User-Agent/Referer/Cookie/Language/...)
4. 如果打到沒有特徵可過濾,則需靠應用層的機制來辨識真實使用者
- Redirection
- Challenge
- Authentication
5. 若無上述功能則儘快商調適合的設備。
以上是個人的看法,但我已經很多年沒直接處理 DDoS 的事件,也非任職於 ISP 方或 DDoS 防護服務廠商,只是單純的以技術角度分享,如有錯漏之處也請業界真正的高手不吝指教。
題外話,最近 DDoS 正夯,服務商們可仿效已有許多資安業者提供的 IR Retainer 服務,推出 DDoS Retainer,也許是不錯的商機 XD
[以上轉載請註明出處]
exploit attack 在 Howtindog's Channel Facebook 八卦
[HowtinQuotes]
尋日睇書見到有句我覺得很有意思的文字, 講到教會高層好多時會縱容色魔橫行, 出自Andrew Greeley, review of Spoils of the Kingdom by Anson Shupe, Contemporary Sociology: A Journal of Reviews 37 (March 2008) 142:
"The Clerical elite will rally around the accused person because an attack on him is an attack on the whole elite... For the sexual abuser this provides an almost perfect situation. You can exploit, and your colleagues will protect you from the effects of your exploitation either by denying it or finding you another place to exercise your power."
exploit attack 在 神魔之塔 Tower of Saviors Youtube 的評價
In ancient century, humans built up Enochian Tower, attempting to reach Gods. However, Devils in Hell tried to exploit the Tower to invade Heaven. A bloody war between Gods, Devils and Humans (Three Worlds) broke out, triggering Gods' anger. Gods desperately broke the Tower's top and sealed Devils in it. As time goes by, conflict among Three Worlds continues to disturb the world peace. The last hope lies on the Summoners who can unleash the Seals and wipe out all the Devils!
*Addictive and fun RPG game with match 3 Runestones challenges*
By dissolving Runestones, attacks will be fired off towards the enemies. Attaining a higher number of Combos will power up the attack.
*Legends come together to overturn the end of the world
Fight with mythical characters from Greece, Egypt, China to go through the experience of a legendary Summoner!
*Experience the brand new RPG style
Level up and Evolve Monsters to form the strongest Team to fight with you.
*Logging in everyday will reward you with Diamonds to summon Rare Monsters!

exploit attack 在 神魔之塔 Tower of Saviors Youtube 的評價
Android Download link: https://play.google.com/store/apps/details?id=com.madhead.tos.en
In ancient century, humans built up Enochian Tower, attempting to reach Gods. However, Devils in Hell tried to exploit the Tower to invade Heaven. A bloody war between Gods, Devils and Humans (Three Worlds) broke out, triggering Gods' anger. Gods desperately broke the Tower's top and sealed Devils in it. As time goes by, conflict among Three Worlds continues to disturb the world peace. The last hope lies on the Summoners who can unleash the Seals and wipe out all the Devils!
*Addictive and fun RPG game with match 3 Runestones challenges*
By dissolving Runestones, attacks will be fired off towards the enemies. Attaining a higher number of Combos will power up the attack.
*Legends come together to overturn the end of the world
Fight with mythical characters from Greece, Egypt, China to go through the experience of a legendary Summoner!
*Experience the brand new RPG style
Level up and Evolve Monsters to form the strongest Team to fight with you.
*Logging in everyday will reward you with Diamonds to summon Rare Monsters!

exploit attack 在 蜂蜜ゆうた Youtube 的評價
ビデオクリップの時間の長さを10分に設定していたため、最初の30秒が撮れていませんでした。
ですのでその欠けていた部分を再現して編集しました。
皆様に一通りすべての動画をお見せできないことを深くお詫び申し上げます。
Kjarr Crest “king”
safi Crested Crown β+
safi Crested Chest β+
safi Crested Vambraces β+
safi Crested Belt β+
safi Crested Boots β+
Blaze Charm V
Waterproof Mantle+
Evasion Mantle+
Guardian/Attack Jewel 4 ×3
Tenderizer Jewel 2 ×3
Attack Jewel 1 ×5
Ironwall Jewel 1 ×3
Ironwall Jewel+ 4
Blaze Jewel 1
Sharp Jewel 2
Phoenix/Medicine Jewel 4
Fire Attack 6
Attack Boost 4+(Attack Boost 2)
Guard 5
Critical Boost 3
Weakness Exploit 3
Evade Window 3
Offensive Guard 3
Blight Resistance 2
Recovery Up 1
Protective Polish 1
Critical Element 1
Coalescence 1
Safi’Jiiva Seal 5
Health Regen I
Element/Status Effect Up II

exploit attack 在 exploit - Definition - Trend Micro 的相關結果
An exploit is a code that takes advantage of a software vulnerability or security flaw. It is written either by security researchers as a proof-of-concept ... ... <看更多>
exploit attack 在 What Is an Exploit? - Cisco 的相關結果
An exploit is a software tool that takes advantage of a vulnerability in a computer system for malicious purposes such as installing malware. ... <看更多>
exploit attack 在 Exploit (computer security) - Wikipedia 的相關結果
A compromised system to attack other systems on the same network that are not directly reachable from the Internet due to restrictions such as firewall. There ... ... <看更多>