now we are afraid that some bots or human will exploit these making some programs,curl and sucking up our bandwidth…repeatedly downloading same file using this url
so as first level of security we have implemented captcha BUT even with that a human who is trying to suck up bandwidth may get file actual url(actual server storage path ,with first time investigating the things ,entering correct character in captcha test…and download manager like idm shows the url path where file is stored)…
so he can take that url(direct link) and program a looping download to suck up bandwidth
so how can we program to protect against it…
i have found in sites like rapidshare links are valid for cetain period of time or when direct link is tried it redirects users to pre-download page
You could just add captcha to your download page. That would stop someone from using a script to download files at least.
EDIT: I should have read your entire post, combine what blaine said and captcha and they won’t be able to request the file without filling in the correct captcha.
It is less in bandwidth yes. But PHP will need to run 100 times churning the CPU of the server. This can be more problematic then running out of bandwidth. It can bring your whole server to its knees and even crash it.
that may sound foolish but another truth is that in most of the cases intruder was able to get in because either system admin thinks s/he is too smart or s/he thinks that particular thing is too small to cause problem…
any wa tracking ip and all are eaiser said than done…
ln my experience in one site we had kind of attack, some mp3 songs of the home page was being downloaded many times …the site had around 500 unique visitors but bandwidth consumption was more than 5gb per day…(ok may be not big issue but what to waste things…)
we blocked some ips…after sometime new ip use to emerge…so if we have more than 1000 unique visitors then we will need to hire one manpower just to track these things…so i said it is easier said than done…
any way thanks…
i know i may sound too cautious now but i am sure it is not completely unnecessary …so i am watching for now…
some confusions
“The attacker can crash your server just by hitting the PHP file”
yup but i use to think
suppose he hits the 10kb php files 100 times …couldnot get to actual download
and
he hits 50mb files 100 times …and download files every time
isn’t effect of earlier less than later in terms of bandwidth…
just my confusion
i respect and i think i have got the general sense of your suggestion and i think i should go with that …and do that
may be scripting is not right department that should handle these things
If you are really wanting to protect this file from being downloaded to prevent DOS and eating your bandwidth. You are doing it wrong. If you do it the way you are planning, the attacker doesn’t need to download the file. The attacker can crash your server just by hitting the PHP file used to download the file over and over again. It doesn’t matter if you block there IP in that file the server must still process the request and must execute PHP.
What you are wanting to do should be done at the root of the network layer, the firewall, the router. Not on the server. Not using PHP. Block the abusive usage before it gets on the network.
The first rule of security is that you need to understand the risks surrounding what you’re protecting. You’ve got an idea (a poor one, check your math) of what one of the vulnerabilities might be, but you need to determine your exposure (likelihood of exploitation) before you can figure out what your risk profile actually is.
In this case, what you’re describing is an incredibly stupid way to DOS a server. Protecting against it is likely going to be a total waste of time and effort. A much better idea would be to simply make sure that logging is enabled, and that you’re tracking IPs of people who are downloading. If you see repeat downloads on a regular schedule, attempt to contact the user or block their IP. Sorry for being blunt, but the direction you’re trying to go with this is simply foolish.
thanks
well,i think this structure file=game.zip always infact encourage wrong doers to carry out different test(can any private files can be accessed…can system command can be executed and so on …)
so i normally use first method…
take id and query for file name …
for now simplist seems to be adopt captcha and check referal website (it must be same website) and then keep on eye on bandwidth usage and analytics…
if it is being explioted then adopt further action…
any way other suggestions are also welcomed…
but if that file is suppose 100mb and it somebody crons it every 2 hours then i will need just around 3gb for one cron per day…5 such crons means 15gb daily for bots…which means 450gb per month…
( may seem like just plain calculations and may sound too cautious…but there is no barrier that it will not or cannot happen …so somebody(competitor) if wants can do it…)
just i hope it is always good to think of problem that may come in future…
having said that WITH RESPECT i agree with your thoughts…that why i am in wait and see game…
there is no unusual bandwidth consumption for now…so no need of that as on now…
thanks any way
I think you are just over complicated a problem…when there isn’t even a problem. If someone was going to do a DOS attack they don’t need to download some zip file. They can just download your index page a billion times over.
So my advice is…just leave it alone. Follow KISS, Keep it simple s…
The real way to solve and protect from DOS attacks is at the network level, not the application level.
may seem like just plain calculations and may sound too cautious…but there is no barrier that it will not or cannot happen …so somebody(competitor) if wants can do it…)