IT Security and Penetration Testing

Chapter 11
Denial-of-Service Attacks
 Objectives
• Define a denial-of-service (DoS) attack
• Describe causes of DoS attacks
• Describe several varieties of DoS attacks

Computer Security and Penetration Testing 2

 Objectives (continued)
• Define a distributed denial-of-service (DDoS) attack
• Discuss some known DoS and DDoS attacks
• Describe ways to prevent DoS and DDoS attacks

Computer Security and Penetration Testing 3

 Causes of DoS Attacks

• Some major network defects and vulnerabilities

– Vulnerability of the network architecture
– Vulnerability of a specific server system architecture
(Intel x86, AMD Opteron, etc.)
– Defects and bugs in the operating system or software
– Holes present within system security
• Some vulnerabilities cannot be closed by patching
– Because there is an inherent bandwidth limit

Computer Security and Penetration Testing 4

 Causes of DoS Attacks (continued)

Computer Security and Penetration Testing 5

 Types of DoS Attacks

• See Figure 11-1

– X axis = Flood attacks or software attacks
– Y axis = Isolated attacks or distributed attacks
– Z axis =Voluntary or involuntary, on the part of the
systems administrator

Computer Security and Penetration Testing 6

Computer Security and Penetration Testing 7
 Voluntary DoS

• Occurs when the sysadmin has allowed the system

– To perform a variety of services without considering
the system’s limitations

Computer Security and Penetration Testing 8

 Involuntary DoS

• Takes place regardless of preparation and

readiness by the sysadmin

Computer Security and Penetration Testing 9

 Flood Attacks
• Consume the limited resources of a computer or a
network
– By transmitting a large number of packets as quickly
as possible
• A flood attack can occur under the following
conditions:
– Sending connection requests
– Consuming the bandwidth
– Using your own resources
– Consuming others’ resources

Computer Security and Penetration Testing 10

 Flood Attacks (continued)

• Sending Connection Requests

– Target or victim receives a large quantity of
connection requests
– Attacker is probably using a spoofed IP address
• Consuming Bandwidth
– All of a network’s available bandwidth is consumed by
sending a large number of packets

Computer Security and Penetration Testing 11

Computer Security and Penetration Testing 12
 Flood Attacks (continued)

• Using Your Own Resources

– Hacker uses forged UDP packets to connect the echo
service on one computer
• To a service on another computer
– Response for this packet will automatically be sent to
the computer whose IP address the hacker is using

Computer Security and Penetration Testing 13

Computer Security and Penetration Testing 14
 Flood Attacks (continued)

• Consuming Other’s Resources

– Hacker may be able to consume data structures
• Simply writing a program or a script that replicates itself
– Hackers also attempt to consume disk space
• By using any feature that allows data to be written to a
system’s hard disk
– Hacker may be able to lock an account by executing a
certain number of failed attempts to log in

Computer Security and Penetration Testing 15

 Software Attacks

• Exploit the existing software weaknesses

• Effect is either degraded performance or crashes on
the victim server
• Hackers generate a small number of carefully
malformed packets to exploit known software bugs
– Bugs allow hackers to change or damage
configuration files

Computer Security and Penetration Testing 16

 Software Attacks (continued)

• Ping of Death
– A historical DoS attack in which the hacker uses the
Ping utility to acquire access to a system
– Hacker sends a packet larger than 64 KB to the target
computer
– Target system may crash or restart
– Most legitimate Ping utilities do not allow you to send
a ping of more than 64 KB
– You can use Apsend to send an oversized packet

Computer Security and Penetration Testing 17

 Software Attacks (continued)

Computer Security and Penetration Testing 18

 Software Attacks (continued)

• Ping of Death (continued)

– You can block pings on your firewall
– Almost all operating systems have been patched to
deflect this attack
• DNS Service Attack
– Domain Name Service (DNS)
• Database that maps domain names to IP addresses
– Two kinds of attacks are related to the DNS service:
DNS spoofing and DNS overflow

Computer Security and Penetration Testing 19

 Software Attacks (continued)
• DNS Service Attack
– DNS Spoofing
• Users or customers may be redirected to Web sites
other than their intended destination
• Should not be confused with phishing
• May lead to customers giving their account information
to hackers
– DNS Overflows
• May happen when there is a failure to check and verify
the length of the host name
• Could be used to gain superuser access to the system

Computer Security and Penetration Testing 20

Computer Security and Penetration Testing 21
 Software Attacks (continued)

• Other software attacks include

– Teardrop
– Land
– Charge

Computer Security and Penetration Testing 22

 Isolated Attacks

• Comes from a single source

• It is easily countered by blocking traffic from that
source

Computer Security and Penetration Testing 23

 Distributed Attacks

• Come from multiple concurrent sources

• Much more difficult to block with ACLs or firewall
rules
• Distributed denial-of-service, or DDoS, attack
– Depends on the hacker’s ability to compromise
information on a large number of systems
– May require hundreds or thousands of compromised
hosts to make a DDoS attack successful
– Special tools used to attack a computer

Computer Security and Penetration Testing 24

Computer Security and Penetration Testing 25
 Distributed Attacks (continued)

• The process of DDoS is fully automated

• DDoS attack occurs in the following sequence:
– Hacker identifies vulnerable hosts (100 or more)
– Hacker gets access to these hosts after they are
compromised
– Hacker installs the tool needed to attack each host
– Hacker uses the compromised hosts for future attacks

Computer Security and Penetration Testing 26

 Known DoS Attacks
• Some known flood attacks are TCP SYN, SMURF,
and Fraggle
• Denial of Service Database
– At http://attrition.org/security/denial/
– Has over 360 known DoS (and Ddos) exploits used
on different targets

Computer Security and Penetration Testing 27

 TCP SYN
• TCP SYN attack
– Client and server exchange a sequence of messages
after establishing a TCP connection
– Uses the familiar three-way handshake of TCP
• Attacker establishes many half-connection
– Data structure in memory that holds all the pending
half-connections increases in size
• Hacker only has to use the IP spoofing technique to
send excess SYN requests to the server

Computer Security and Penetration Testing 28

Computer Security and Penetration Testing 29
 SMURF
• ICMP is used to handle errors and exchange control
messages on a network
• ICMP process is executed using the ping command

Computer Security and Penetration Testing 30

 SMURF (continued)
• Main components involved in a SMURF attack
– Hacker, packet amplifiers or intermediate devices,
and the target computer
• Recently, automated tools have been developed
– That enable hackers to send these attacks
simultaneously to several intermediaries

Computer Security and Penetration Testing 31

Computer Security and Penetration Testing 32
 Fraggle
• Fraggle attacks are like SMURF DoS attacks
– But use UDP packets
• Attacker uses a spoofed IP address to broadcast
hundreds of UDP packets across a network
• Intermediate devices reply to the victim computer by
sending hundreds of UDP echo reply packets
• Best possible result is a system crash
– At the very least, the attack will produce excess
network traffic

Computer Security and Penetration Testing 33

 Known DDoS Attacks
• DDoS tools use distributed technology to generate a
large network of hosts
– Hosts can attack thousands of computers via packet
flooding
• Tools that can be used for DDoS attacks are Trinoo,
Tribe flood network (TFN), and Botnets

Computer Security and Penetration Testing 34

 Trinoo
• Distributed tool used to initialize coordinated UDP
flood DoS attacks from multiple sources
• Trinoo network consists of a minute quantity of
servers and a large number of clients
• Hacker computer is connected to a Trinoo master
computer in a DoS attack utilizing a Trinoo network
• Hacker computer instructs the master computer to
begin DoS attacks
– Against one or more IP addresses

Computer Security and Penetration Testing 35

 TFN
• Used to launch coordinated DoS flood attacks from
multiple sources
• TFN has the capability to create packets with spoofed
source IP addresses
• TFN network can generate DoS attacks such as:
– UDP flood attacks
– TCP SYN flood
– ICMP echo request flood
– ICMP directed broadcast
• TFN follows the same principle as Trinoo

Computer Security and Penetration Testing 36

 Botnets
• Botnets
– A variety of software DDoS
• A bot is a program that surreptitiously installs itself
on a computer so it can be controlled by a hacker
• A botnet is a network of robot, or zombie, computers
– Can harness their collective power to do damage
• Or send out huge amounts of junk e-mail

Computer Security and Penetration Testing 37

 Prevention and Mitigation of DoS and
DDoS Attacks
• Network administrators can use packet filtering on
the IP routers to give basic access control
• This often slows router performance to an
unacceptable point

Computer Security and Penetration Testing 38

 Prevention Methods
• Network Address Translation (NAT)
– Prevents DoS by
• Refusing network traffic from specific TCP ports
• Limiting the network traffic coming from specific
network addresses
• Scanning the network traffic for viruses or undesirable
applications
• Solutions were designed to prevent DoS attacks on
LANs and subnet systems
– Not meant for a Web environment

Computer Security and Penetration Testing 39

 Prevention Methods (continued)
• Cisco CSS 11000 series switches give
comprehensive Web site and server-system security
• Switches provide site-level safety as follows:
– DoS attack prevention
– Firewall security
– NAT
– Load-balancing

Computer Security and Penetration Testing 40

 Prevention Methods (continued)
• Other preventive measures
– Implement router filters or ingress filtering
– Computers should constantly be updated with the
relevant security patches
– Use intrusion-detection systems on networks
containing Web servers
– Disable any unnecessary services on your system
– If supported, enable quotas on the operating systems
• Important to establish baselines for activities

Computer Security and Penetration Testing 41

 Prevention Methods (continued)
• Measures for preventing DDoS attacks:
– Filter all the RFC1918 address space by using access
control lists (ACLs)
– Apply ingress and egress filtering using ACLs
– Rate-limit ICMP packets, if they are configurable
– Configure the rate limiting for SYN packets

Computer Security and Penetration Testing 42

 Mitigation of DoS and DDoS Attacks
• Use a tool such as Tripwire
– To detect changes in the configuration information or
on other files
• Problem with mitigation of DoS attacks
– Attacks are easily mistaken for a small spike in
network activity
• Upon detecting an attack
– Initiate blocking packets from the origin IP or to the
victim

Computer Security and Penetration Testing 43

 Mitigation of DoS and DDoS Attacks
(continued)
• Patch machines and applications
• Stay current on new reports of DoS and DDoS
attacks and systems
• Run an IDS system that alerts you when the
network is experiencing unusual traffic or activity

Computer Security and Penetration Testing 44

 Summary
• A denial-of-service attack is any network event that
restricts or denies valid uses of a resource
• DoS attacks are caused by
– Vulnerability of the network architecture
– Vulnerability of a specific server system architecture
– Defects and bugs in the operating system or software
– Holes present within system security
• Three main groupings of DoS attacks: voluntary and
involuntary attacks; flood and software attacks; and
isolated and distributed attacks

Computer Security and Penetration Testing 45

 Summary (continued)
• Known DoS attacks: TCP SYN, SMURF, and Fraggle
• DDoS attack tools include Trinoo, TFN, and Botnets
• Methods of prevention for DoS attacks include
– Using Cisco CSS Web switches
– Implementing router filters or ingress filtering
– Constantly updating computers
– Monitoring the network to identify attack tools
– Disabling unnecessary system services
– Enabling quotas on the operating system

Computer Security and Penetration Testing 46

 Summary (continued)
• Methods of prevention for DDoS attacks include
– Filtering all the RFC1918 address space by using
access control lists (ACLs)
– Applying ingress and egress filtering using ACLs
– Rate-limiting ICMP packets if they are configurable
– Configuring the rate limiting for SYN packets
• Attempting to mitigate DoS and DDoS attacks can
end up causing more harm than an actual attack

Computer Security and Penetration Testing 47