Classic Denial-of-Service Attacks

Flooding ping command Simplest classical DoS attack Aim is to overwhelm the capacity of the network connection to the target organization Traffic can be handled by higher capacity links on the path, but packets are discarded as capacity decreases

The attacker might use the large company’s Web server to target the medium-sized company with a lower-capacity network connection

When a large number of packets are sent to the target system, valid traffic will have little chance of surviving discard

Classic Denial-of-Service Attacks

Disadvantage of flooding attackers Source of the attack is clearly identified unless a spoofed address is used since its address is used as the source address in the ICMP echo request packets 1. Increase the chance that the attacker can be identified and legal

action taken in response

2. Reflect attack back at the source system The targeted system will attempt to respond to the packets being sent (the server would respond to each ICMP request with echo response packet directed back to the sender)

Network performance is noticeably affected

Source Address Spoofing

Use forged source addresses Usually via the raw socket interface on operating systems

Greatly eases the task of attacker to generate packets with forged attributes

Attacker generates large volumes of packets that have the target system as the destination address

Congestion would result in the router connected to the final, lower capacity link

However, ICMP echo response packets would be scattered across the Internet to all the various forged source addresses

Making attack systems harder to identify Requires network engineers to specifically query flow information from their routers (manual process) Useful side-effect: backscatter traffic

Security researchers advertise routes to unused IP addresses to monitor attack traffic

SYN Spoofing

Common DoS attack

Attacks the ability of a server to respond to (future) TCP connection requests by overflowing the tables used to manage them

Thus legitimate users are denied access to the server

Hence an attack on system resources, specifically the network handling code in the operating system

TCP Connection Handshake

Identify client’s address, port number

Recordinformation In the table

Mark connectionas established

Mark connectionas established

Data transfer

TCP SYN Spoofing Attack

TCP connection handshake sometimes fail due to… Packets are transported using unreliable IP network protocol Packets might be lost in transit due to the congestion

TCP protocol Advantage: reliable protocol

If no response is received, client or server resends those packets

Disadvantage Impose an overhead on the system in managing the reliable transfer

Attack Point!!!

TCP SYN Spoofing

Attack

Which one is under attack?Server? Spoofed client? (if there exists such a client)

TCP SYN Spoofing Attack

The attacker directs a very large number of forged connection requests at the target server

These rapidly fill the table of known TCP connection requests at the server

Once this table is full, any further requests are rejected

Flooding Attacks

Classified based on network protocol used Intent is to overload the network capacity on some link to a server

Alternatively aim to overload the server’s ability to handle and respond to this traffic Flood the network link to the server with a torrent of malicious packets to the server Valid traffic has a low probability of surviving discard, and hence of accessing the server

Flooding Attacks

Ping flood using ICMP echo request packets Traditionally network administrators allow such packets into their networks because ping is a useful network diagnostic tool

ICMP flood

Uses UDP packets directed to some port number on the target system A common choice was a packet directed at the diagnostic echo service

UDP flood

Sends TCP packets to the target system (with real or spoofed source address) Similar to SYN spoofing attack Difference: total volume of packets is the aim of the attack rather than the system code

TCP SYN flood

Virtually any type of network packet can be used Any of the ICMP, UDP, or TCP SYN The larger the packet, the more effective is the attack

Flooding Attack

What’s the problem with these attack variants? Limited in the total volume of traffic if just a single system is used The attacker is easier to trace

Multiple and indirect attacking systems Significantly scale up the volume of traffic The attacker is further distanced from the target and significantly harder to locate and identify

1. Distributed denial-of-service (DDoS) attacks 2. Reflector attacks 3. Amplifier attacks

DDoS Attacks

Use of multiple systems to

generate attacks

Attacker uses a flaw in operating

system or in a common

application to gain access and installs their program on it

(zombie)

Large collections of such systems under the control of one attacker’s control

can be created, forming a botnet

DDoS Attack Architecture

• Automatically grow suitable botnets using Handler Zombies

• Obscure the path backto the attacker

DDoS Attack Tools

Tribe Flood Network (TFN) One of the earliest and best known DDoS tools Written by the hacker known as Mixter (original variant from 1990s) Exploited Sun Solaris systems Later rewritten as Tribe Flood Network 2000 (TFN2K) Agent was a Trojan program, capable of implementing ICMP flood, SYN flood, UDP flood, ICMP amplification Rely on the layered command structure

Trinoo, Stacheldraht, …