Common types of attacks and the investigation process recommendations

First, what is the chicken attack:

Broiler is to be hacker attacks and intrusions, computer viruses and Trojan horses placed inside the like backdoor, a remote computer with administrative privileges, the intruder by remote computer control.

It is advised broiler or ARP attack treatment:

1, the system level checks

(1) in the case of regular checks of system users, if found suspicious account administrators to check whether the group increased by an unknown account.

(2) check their Web site directory permissions, try to reduce the rights of unrelated users.

Per month (3) Windows client hosts must fight system patches, around the 15th of each month Microsoft will release a patch, please patch.

(4) advised to turn off unneeded services.

(5) the proposed closure of a number of high-risk ports, such as 135, 139, and so on.

2, the program checks from

(1) regularly check the site for suspicious executable files.

(2) avoid the use of free components and third-party controls, if you use third-party controls better watch updates.

(3) regular backups of your database and web application.

3. Submission System Initialization

Trojan virus infection or hacking, system file corruption, can not be repaired by conventional means, seriously affect use. No important data system disk, reinstall the system can be selected directly; (reinstall the system, other disk data affected)

Second, what is DDoS attacks:

DDoS is a Distributed Denial of Service English acronym, which means "distributed denial of service" then what is a denial of service (Denial of Service) do? It can be understood, all can lead to legitimate users can not access the normal behavior of network services are regarded as a denial of service attack. That is the purpose of denial of service attack is very clear, it is to prevent legitimate users to access network resources properly, so as to achieve the purpose of the attacker ulterior motives. It is also a denial of service attack, but DDoS and DOS or different, DDoS attack strategy focused on the large number of seemingly legitimate to send the victim host through a lot of "zombie master" (the invasion had been the attacker or indirect use of the host) network packets, resulting in network congestion or server resource exhaustion denial of service, distributed denial of service attacks, once implemented, will attack the network packet flock like a flood victim host, so that the legitimate users of network packets flooded, leading to legal users can not access the server's network resources, therefore, denial of service attack has been called "flood attacks," common DDoS attacks have SYN flood, ACK flood, UDP flood, ICMP flood, TCP flood, Connections flood, Script Flood, Proxy Flood and so on; and DOS will focus on through the use of attack on host-specific vulnerabilities lead to network stack failure, system crashes, host crash can not provide normal network services, resulting in a denial of service, common DOS attack means there TearDrop , Land, Jolt, IGMP Nuker, Boink, Smurf, Bonk, OOB .

DDoS attacks are initiated by a large number of connection to access your site, producing a large number of connections and traffic, resulting in server load is too high and insufficient bandwidth, it does not affect your website data. DDoS attacks have some relevance, there is no good solution, only to attack in the form of broken network can not find the target host.

DoS attacks investigation and prevention recommendations were:

1, troubleshooting tips

(1) Check the website and server data, if there are loopholes, will be attacked site content roll-out, to avoid the same attack again.

(2) Please see if competitors malicious attacks, comprehensive investigation and processing.

2, the precautions

(1) prevention procedures is recommended in the program code zend, MD5 and other encryption to encrypt their programs to avoid procedural flaws lead to hackers implanted Trojan program, and ultimately allow hackers to gain remote for this vulnerability launch DoS attacks.

Strengthen (2) a host of security measures, it is recommended not to use the default remote port on the server and all the passwords have to use complex passwords, such as remote password, FTP password, database password. Simple passwords are easily cracked by hackers will eventually host as a client to initiate DDoS attacks broiler to other servers.

Published 34 original articles · won praise 3 · Views 2910

Guess you like

Origin blog.csdn.net/YNlanduiyun/article/details/104776560