Denial of Service Attacks

1
Denial of Service Attacks

• By Mike Ortlieb

2
What is a DoS Attack?

• February 7-11th, 2000
• Yahoo, eBay, CNN, ETrade, ZDNet, Datek and
  Buy.com all hit
• Hackers preventing legitimate business

3
Definition

• A DoS attack disrupts or completely denies
  service to legitimate users, networks, systems,
  or other resources.
• The intent of any such attack is usually
  malicious and often takes little skill
• -Hacking Exposed, 3rd Edition

4
Types of DoS Attacks

• Bandwidth Consumption
• Network Flooding
• T3 vs. 56K
• Amplifying Attack
• Using multiple sites for attack

5
Types of DoS Attacks

• Resource Starvation
• Consuming system resources instead of network
  resources
• Routing / DNS Attacks
• Modifying routing tables so users cannot access
  legitimate site

6
Specific DoS Attacks

• Smurf
• Amplification attack
• Sends ICMP ECHO to network
• Network sends response to victim system

7
Specific DoS Attacks

• SYN Flood
• Send spoofed SYN packets to system
• System responds with SYN/ACK
• Never receives final connection
• Backlog in connection queue

8
DoS Countermeasures

• Disable directed broadcasts
• Ex. Cisco no ip directed-broadcast
• Reduce connection establishment timeout
• IDS programs
• ZoneAlarm

9
Distributed DoS Attacks

• More effective
  than DoS Attacks
• Multiple sources
  for attack
• Tribe Flood Network, Trinoo, TFN2K

10
Zombies

• Infected machines
• Controlled by master client
• Hacker installs server version on compromised
  machines, client version on master machine

11
DRDoS Attacks

• New kind of DDoS attack
• Uses legitimate TCP servers to reflect spoofed
  packets

12
DDoS Countermeasures

• Increase size of connections table
• Use firewalls
• Increase bandwidth
• Zombie zappers
• Find_ddos by NIPC
• Prevent machines from being used as Zombies

13
Summary

• DoS Attacks on the rise
• http//www.cnn.com/2002/TECH/internet/04/09/dos.t
  hreat.idg/index.html
• 2 threat behind worms (Code Red, Nimda)
• http//www.cnn.com/2002/TECH/internet/04/05/iss.wo
  rms.ddos.idg/index.html