Denial-of-service attack
|
|
A denial-of-service attack (also, DoS attack) is an attack on a computer system or network that causes a loss of service to users, typically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational resources of the victim system.
| Contents |
Methods of attack
A DoS attack can be perpetrated in a number of ways. There are three basic types of attack:
- consumption of computational resources, such as bandwidth, disk space, or CPU time
- disruption of configuration information, such as routing information
- disruption of physical network components
A nuke attack sends a packet, usually ICMP, which is malformed or fragmented in an invalid way, triggering a bug in the operating system and crashing the targeted computer. This is known as the ping of death.
WinNuke is a similar kind of attack, exploiting the vulnerability in the NetBIOS handler in Windows 95. A string of out-of-band data is sent to TCP port 139 of the victim machine, causing it to lock up and display a Blue Screen of Death. This attack was very popular between the IRC-dwelling script kiddies, due to easy availability of an user-friendly click-and-crash WinNuke program.
Various DoS-causing exploits can cause server-running software to get confused and fill the disk space or consume all available memory or CPU time.
Other kinds of DoS rely primarily on brute force, flooding the target with overwhelming flux of packets, oversaturating its connection bandwidth or depleting target's system resources. Bandwidth-saturating floods rely on the attacker having higher bandwidth available than the victim; common way of achieving this today is via DDoS, employing a botnet. Other floods may use specific packet types or connection requests to saturate finite resources, like maximum number of open connection, fill the victim's disk space with logs, or anything else with a limit.
Attacker having access to a victim computer can bring it to a crawl or even to crash by a fork bomb.
On IRC, IRC floods are a common electronic warfare weapon.
Ping flood is based on sending the victim an overwhelming number of ping packets, usually using the "ping -f" command. It is very simple to launch, and a T1 owner can easily defeat a dial-up user.
SYN flood relies on sending the target a lot of TCP/SYN packets, often with forged sender address, each of whom is handled like a connection request, spawning a half-open connection, each of whom then sends back a TCP/SYN-ACK packet, and waits for the TCP/ACK packet from the client, which never comes. This depletes the number of available possible connections, leading to the server being unable to answer legitimate requests until a short time after the attack ends.
A smurf attack is one particular variant of a flooding DoS attack on the public Internet. It relies on mis-configured network devices that allow packets to be sent to all computer hosts on a particular network via the broadcast address of the network, rather than a specific machine. The network then serves as a smurf amplifier. In such an attack, the perpetrators will send large numbers of IP packets with a faked source address, that is set to the address of the intended victim. To combat Denial of Service attacks on the Internet, services like the Smurf Amplifier Registry have given network service providers the ability to identify misconfigured networks and to take appropriate action such as filtering.
A "banana attack" is another particular type of DoS. It involves redirecting outgoing messages from the client back onto the client, preventing outside access, as well as flooding the client with the sent packets.
Attempts to "flood" a network with bogus packets, thereby preventing legitimate network traffic, are the most common form of attack, often conducted by disrupting network connectivity with the use of multiple hosts in a distributed denial-of-service attack or DDoS. Specific means of attack include: a smurf attack, in which excessive ICMP requests are broadcast to an entire network; bogus HTTP requests on the World Wide Web; incorrectly formed packets; and random traffic. The source addresses of this traffic is usually spoofed in order to hide the true origin of the attack. Due to this and the many vectors of attack, there are not comprehensive rules that can be implemented on network hosts in order to protect against denial-of-service attacks, and it is a difficult feat to determine the source of the attack and the identity of the attacker. This is especially true with distributed attacks.
Attacks can be directed at any network device, including attacks on routing devices and Web, electronic mail, or Domain Name System servers.
Effects of DoS
Denial of Service attacks can also lead to problems in the network 'branches' around the actual computer being attacked. For example, the bandwidth of a router between the Internet and a LAN may be consumed by a DoS, meaning not only will the intended computer be compromised, but the entire network will also be disrupted.
If the DoS is conducted in a sufficiently large scale, entire geographical swathes of internet connectivity can be compromised by incorrectly configured or flimsy network infrastructure equipment without the attacker's knowledge or intent. For this reason, most, if not all ISPs ban the practice.
Tell tale signs
Usually, your modem will flicker rapidly, due to a flood of incoming packets: this is one of the more obvious signs. You might also experience a loss of connectivity to the internet through your web browser and other mediums when your PC doesn't have any spyware or viruses.
Distributed denial-of-service attacks
In a distributed attack, the attacking computer hosts are often zombie computers with broadband connections to the Internet that have been compromised by viruses or Trojan horse programs that allow the perpetrator to remotely control the machine and direct the attack, often through a botnet. With enough such slave hosts, the services of even the largest and most well-connected websites can be denied.
Surviving distributed attacks
There are steps that can be taken to mitigate the effects of a DDoS attack. As mentioned in the previous section, the first thing to start is the investigative process. One determines which core router (a router that handles Internet backbone traffic) is passing the packets to one's border router (a router that connects his or her network to the Internet). One would contact the owners of the core router, likely a telecom company or the internet service provider, and inform them of his or her problem. Ideally, there will be a process in place which can expedite one's requests for help. They, in turn, need to determine where the malicious traffic reaches their network and contact the source. By that point, it is out of one's hands.
Since it is not likely that the administrator will be able to quickly stop the DDoS flood, there are a few steps which might help mitigate the attack temporarily. If the target is a single machine, a simple IP address change can end the flood. The new address can be updated on internal DNS servers and given to a few crucial external users. This is especially useful for key servers (e.g. email or database) under attack on one's network.
There is a chance that some filtering techniques can help. If the attack is unsophisticated, there might be a specific signature to the traffic. A careful examination of captured packets sometimes reveals a trait on which you can base either router ACLs (access control lists) or firewall rules. Additionally, a large amount of traffic may originate from a specific provider or core router. If that is the case, one might consider temporarily blocking all traffic from that source, which should allow a portion of legitimate activity through. One would also be blocking "real" packets, or legitimate traffic, but this may be an unavoidable sacrifice. However, depending on the method of attack, this option may be unavailable to you if, for example, the participants' IP addresses are spoofed.
A final option, one which might be available to larger companies and networks, is to throw more hardware or bandwidth at the flood and wait it out. Again, it is not the best solution, nor the least expensive one. It may provide a temporary fix, nevertheless.
The investigative process should begin immediately after the DoS attack begins. There will be multiple phone calls, call backs, emails, pages and faxes between the victim organization, one's provider and others involved. It is a time consuming process, so the process should begin immediately. It has taken some very large networks with plenty of resources several hours to halt a DDoS.
DoS attacks in fiction
In the Star Trek: Enterprise episode Detained, the Enterprise sends all of their databases to an internment camp and jamms all of their transmissions.
External links
- Dave Dittrich's DDoS page (http://staff.washington.edu/dittrich/misc/ddos/)
- Distributed Denial of Service Attacks (http://chinese-school.netfirms.com/computer-article-denial-of-service.html) - general information of Distributed Denial of Service Attacks (DDoS)
- SuraSoft DDoS (http://www.surasoft.com/articles/ddosa.php) - DDoS Case study, concepts & protection
- DDoSVax Research Project (http://www.tik.ee.ethz.ch/~ddosvax/) - at Swiss Federal Institute of Technology (http://www.ethz.ch/) in Zürich
- DDoS Mitigation Techniques (http://www.honeypots.net/incidents/ddos-mitigation) - research papers and presentations
- www.denialinfo.com - Denial of Service (DoS) Attack Resources
- www.newssocket.com (http://newssocket.com/foonet/) - Distributed Denial of Service (dDoS) for hire
- Dos attacks explained by grc.com (http://www.grc.com/dos/drdos.htm)de:Denial of Service
fr:Denial of service it:DDoS hu:DoS ja:DoS攻撃 no:Tjenestenektangrep pl:DoS fi:Palvelunestohyökkäys