Denial of Service

Objectives

Overview of DOS attacks and DDoS attacks, understanding the techniques of DoS/DDoS Attack Techniques, Understanding the Botnet Network, Understanding Various DoS and DDoS attack tools, DoS/DDoS countermeasures, Overview of DoS attack penetration testing

DoS/DDoS Concepts

• Denial of Service (DoS) is an attack on a computer or network that reduces, restricts or prevents accessibility of system resource to its legitimate users
  • Attackers flood a victim system with non-legitimate service requests
• DDoS attack involves a multitude of compromised systems attacking a single targeted system (botnet)

DoS/DDoS Attack Techniques

• Basic categories of the attacks
  • Volumetric Attacks: consumes the bandwidth of the target network or service
  • Fragmentation: overwhelms target’s ability of reassembling fragmented packets
  • TCP state-exhaustion attack: consumes connection state table present such as load balancers ,firewalls, app servers
  • Application layer attack: consumes app resources or service making it unavailable to other legitimate users
• SYN Attack
  • Attacker sends a large number of SYN request to target server
    • Target machine sends back a SYN ACK in response to the request waiting for the ACK to complete session
    • Attacker never sends ack
• ICMP flood attack: type of DoS where perpetrators send a large number of ICMP packets causing the system to stop responding to legitimate TCP/IP requests
  • To protect yourself: set a threshold limit that invokes a ICMP protection feature
• Peer to Peer Attack: attackers instruct clients of p2p file sharing hubs to disconnect for their p2p network and connect to victims fake website. Attackers can launch massive DoS attacks and compromise websites
• Permanent Denial-of-Service Attack: Also known as phlashing, refers to attacks that cause irreversible damage to system hardware
  • Unlike other DoS attacks,, it sabotages the system hardware
• Application-Level Flood Attack: Application-level flood attacks results in the loss of services
  • Using this attack , attackers exploit weaknesses in programming source code to prevent in the application from processing legitimate requests
• Distributed Reflection Denial of Service (DRDoS)
  • Also known as a spoofed attack, involves the use of multiple intermediary and secondary machines that contribute to the actual DDoS attack against the target machine or application

Botnets

• Bots are software applications that run-automated tasks over the internet
  • A botnet is a huge network of compromised systems and can be used by an attacker to launch a DoS attack
• Scanning Methods for Finding Vulnerable Machines: Random Scanning, Hit-list scanning, topological scanning, local subnet scanning, permutation scanning
• DoS and DDoS attack tools
  • LOIC, GoldenEye

Countermeasures

• Techniques

  • Activity Profiling
    • Increases in activity levels, distinct clusters, average packet rate etc
  • Changepoint detection
    • Filters network traffic by IP addresses, targeted port numbers, stores traffic flow data in a graph that shows the traffic flow rate vs time
  • Wavelet-based signal analysis
    • Analyzes network traffic in terms of spectral components. Divides incoming signal into various frequencies for analyzation

• DoS/DDoS countermeasure strategies

  • Absorbing the attack (requiring additional resources)
  • Degrading services (identify critical services and stop non-critical)
  • Shutting down the services

• Deflect Attacks: Honeypots act as an enticement for an attacker. Serve as a means for gaining information about attackers, stores their activities

• Ingress filtering: protects from flooding attacks. Enables originator be traced to its true source
• Egress Filtering: scanning packet headers of IP address leaving a network. Ensures unauthorized or malicious traffic never leaves the internal network
• Mitigate Attack: Load balancing, throttling
• Post-Attack Forensics
  • Analyze traffic patterns for new filtering techniques, analyze router, firewall, and IDS logs , can update load-balancing and throttling countermeasures