Denial of Service (DoS) By Vijay C Uyyuru, Prateek Arora, & Terry Griffin

Denial of Service (DoS)Denial of Service (DoS)

By

Vijay C Uyyuru, Prateek Arora, & Terry Griffin

OverviewOverview• Introduction• Background• Benchmarks and Metrics• Requirements• Summary of Methods• Conclusion

Vijay C Uyyuru

Prateek Arora

Terry Griffin

What is denial of service attack?What is denial of service attack?

• When a denial of service (DoS) attack occurs, a computer or a network user is unable to access resources like e-mail and the Internet. An attack can be directed at an operating system or at the network.

Denial of ServiceDenial of Service

DoS

Bad guy VictimCompromisedhost

Third parties

What is distributed denial of What is distributed denial of service?service?

• A distributed denial of service (DDoS) attack is accomplished by using the Internet to break into computers and using them to attack a network. Hundreds or thousands of computer systems across the Internet can be turned into “zombies” and used to attack another system or website.

Distributed Denial of Service Distributed Denial of Service

• DDoS

Bad guyMasteragent

Victim (s)

Slave agents(zombies, bots)

Third parties

Ownedhost

Brief history and trendsBrief history and trends

• DoS attacks started at around early ’90s.• At the first stage they were quite "primitive",

involving only one attacker exploiting maximum bandwidth from the victim, denying others the ability to be served. This was done mainly by using simple methods of ping floods, SYN floods and UDP floods.

• These attacks had to be "manually" synchronized by a lot of attackers in order to cause an effective damage.

Brief history and trendsBrief history and trends

• The shift to automating this synchronization, coordination and generating a parallel massive attack became public in 1997, with the release of the first publicly available DDoS attacks tool, Trinoo.

• In the following years, few more tools were published – TFN (tribe flood network), TFN2K, and Stacheldraht ("Barbed wire" in German).

Massive attack on public sitesMassive attack on public sites

Massive attack on public sitesMassive attack on public sites

• The subject came to public awareness only after a massive attack on public sites on February 2000. During a period of three days the sites of Yahoo.com, amazon.com, buy.com, cnn.com & eBay.com were under attack.

• Analysts estimated that Yahoo! Lost $500,000 in e-commerce and advertising revenue when it was knocked offline for three hours.

Interesting FactsInteresting Facts

• It turned out that about fifty computers at Stanford University, and also computers at the University of California at Santa Barbara, were amongst the zombie computers sending pings in these DoS attacks.

• A study during a period of three weeks in February 2001 showed that there were about 4000 DoS attacks each week. Most DoS attacks are neither publicized in the news media nor prosecuted in courts.

Other major attackOther major attack

• May 2001 - hackers overloaded Weather.com routers and those of its Web hosting company with bogus traffic. To counter the attack, weather.com moved to another dedicated router and installed filtering software to protect switches and servers, as well as intrusion detection software to record all ongoing activity. It took the company 7 hours to bring the site back up.

How does an attack work?How does an attack work?

• One way to attack a company’s network or website is to flood its systems with information.

• Web and e-mail servers can only handle a finite amount of traffic and an attacker overloads the targeted system with packets of data.

ImpactImpact

• Denial-of service attacks can essentially disable the computer or the network. Depending on the nature of the enterprise, this can disable your organization.

• Some denial-of-service attacks can be executed with limited resources against a large, sophisticated site. This type of attack is sometimes called an “asymmetric attack”.

• For example, an attacker with an old PC and a slow modem may be able to disable much faster and more sophisticated machines or network.

Dollar amount of losses by type!Dollar amount of losses by type!

Attack classificationAttack classification

• DoS attacks exploit the asymmetric nature of certain types of network traffic. One attack method seeks to cause the target to use more resources processing traffic than the attacker does sending the traffic. Another method is to control multiple attackers. Therefore DoS attacks can be classified into three categories

1. Bandwidth/Throughput Attacks2. Protocol Attacks3. Software Vulnerability Attacks

Bandwidth/Throughput AttacksBandwidth/Throughput Attacks

• Ping Flood Attack (ICMP echo)

• SYN Flood Attack (DoS attack)

• DDoS Attack (Distributed SYN Flood)

• UDP Flood Attacks

Ping Flood AttackPing Flood Attack

• An attempt by an attacker on a high bandwidth connection to saturate a network with ICMP echo request packets in order to slow or stop legitimate traffic going through the network.

SYN Flood AttackSYN Flood Attack

DDoS AttackDDoS Attack

• The idea behind this attack is focusing Internet connection bandwidth of many machines upon one or a few machines. This way it is possible to use a large array of smaller (or “weaker”) widely distributed computers to create the big flood effect.

UDP Flood AttacksUDP Flood Attacks

• UDP protocol is a connectionless unreliable protocol which doesn't require session negotiation between client and server application. UDP provides easy to use interface for producing large quantity of packets.

• A common attack which exploits UDP simply floods the network with UDP packets destined to a victim's host. Due to the relative simplicity of this protocol an attacker can produce large bandwidth capacity with relatively small effort.

Protocol AttacksProtocol Attacks

• Smurf Attack

• DNS name server Attack

Smurf AttackSmurf Attack• In this attack, spoofed IP packets containing

ICMP Echo-Request with a source address equal to that of the attacked system and a broadcast destination address are sent to the intermediate network.

• Sending a ICMP Echo Request to a broadcast address triggers all hosts included in the network to respond with an ICMP response packet, thus creating a large mass of packets which are routed to the victim's spoofed address.

Smurf Attack Smurf Attack (contd.)(contd.)

DNS name server AttackDNS name server Attack

• The most common method seen involves an intruder sending a large number of UDP-based DNS requests to a Nameserver using a spoofed source IP address. Any Nameserver response is sent back to the spoofed IP address as the destination.

• In this scenario, the spoofed IP address represents the victim of the denial of service attack. The Nameserver is an intermediate party in the attack. The true source of the attack is difficult for an intermediate or a victim site to determine due to the use of spoofed source addresses.

DNS name server Attack DNS name server Attack (contd.)(contd.)

Software Vulnerability AttacksSoftware Vulnerability Attacks

• Land Attack

• Ping of Death Attack

• Fragmentation Attack and Teardrop Attack

Land AttackLand Attack• In this attack, an attacker sends spoofed TCP SYN packets, with the

same source and destination addresses as the victim's host address.

• In some TCP/IP stack implementations those kinds of packets may cause the victim's host to crash.

• Any remote user that can send spoofed packets to a host can crash or "hang" that host.

• Possible solution for this attack is to block IP-spoofed packets. Attacks like those of the Land tool rely on the use of forged packets, that is, packets where the attacker deliberately falsifies the origin address. With the current IP protocol technology, it is impossible to eliminate IP-spoofed packets. However, you can reduce the likelihood of your site's networks being used to initiate forged packets by filtering outgoing packets that have a source address different from that of your internal network.

Land Attack Land Attack (contd.)(contd.)

• In cases where the victim's host is a router, this attack may result in a routing loop consuming large quantities of bandwidth (unless filtered in advance).

• One of the variations of this attack targets a certain TCP service provided by the victim. In this case the attacker uses the same source and destination ports which used by the victim's service. This may consume the victim's host CPU resources.

Land Attack Land Attack (contd.)(contd.)

• Here DUT is the Device Under Test

Ping of Death AttackPing of Death Attack

• Ping of Death is an attempt by an attacker to crash, reboot or freeze a system by sending an illegal ICMP (over IP) packet to the host under attack.

• The TCP/IP specification allows for a maximum packet size of up to 65536 octets. In some TCP stack implementation encountering packets of greater size may cause the victim's host to crash.

Ping of Death Attack Ping of Death Attack (contd.)(contd.)

• Most implementations of the ICMP protocol use packet header size of 8 octets but allow the user to specify larger packet header sizes.

• In the attack, the ICMP packet is sent in the form of a fragmented message which, when reassembled is larger than the maximum legal IP packet size.

Ping of Death Attack Ping of Death Attack (contd.)(contd.)

Teardrop AttackTeardrop Attack• A normal packet is sent. A second packet is sent which has a fragmentation

offset claiming to be inside the first fragment. This second fragment is too small to even extend outside the first fragment. This may cause an unexpected error condition to occur on the victim host which can cause a buffer overflow and possible system crash on many operating systems.

• Teardrop attacks target a vulnerability in the way fragmented IP packets are reassembled. Fragmentation is necessary when IP Datagrams are larger than the maximum transmission unit (MTU) of a network segment across which the Datagrams must traverse. In order to successfully reassemble packets at the receiving end, the IP header for each fragment includes an offset to identify the fragment's position in the original un-fragmented packet. In a Teardrop attack, packet fragments are deliberately fabricated with overlapping offset fields causing the host to hang or crash when it tries to reassemble them.

Teardrop Attack Teardrop Attack (contd.)(contd.)

• In the following figure, a source test port simulates a Teardrop attack by sending one, and then many IP packet fragments with overlapping Fragment Offset fields. This attack traffic is first sent to the Device Under Test (DUT) interface connected to the source test port and then to the DUT's loopback address. The DUT's ability to drop this attack traffic is verified. Finally, normal background traffic is sent at the same time as attack traffic, so the DUT's performance during a Teardrop attack can be measured.

Frequency & ScopeFrequency & Scope

• How prevalent are denial-of-service attacks in the Internet today?

• Researchers at the Cooperative Association for Internet Data Analysis (CAIDA) address this question in their paper, “Inferring Internet Denial-of-Service Activity”. Using a technique called backscatter analysis, the researchers monitored unsolicited traffic to unpopulated address space. Their theory is that DoS traffic that uses random spoofed source addresses will generate some response traffic to the entire Internet address space, including unpopulated space.

Frequency & Scope Frequency & Scope (contd.)(contd.)

• Their results in February’ 2001 were that using backscatter analysis, they observed 12,805 attacks on over 5,000 distinct Internet hosts belonging to more than 2,000 distinct organizations during a three-week period.

• In addition, CAIDA reports that 90% of attacks last for one hour or less; 90% are TCP based attacks, and around 40% reach rates of 500 Packets Per Second (PPS) or greater.

• Analyzed attacks peaked at around 500,000 PPS. Other anecdotal sources report larger attacks consuming 35 megabits per second (Mbps) for periods of around 72 hours, with high-volume attacks reaching 800 Mbps.

Damage & CostsDamage & Costs• Hidden Costs: There may be hidden costs associated with denial-

of-service attacks. For example, the direct target of a DoS attack may not be the only victim. An attack against one site may affect network resources that serve multiple sites.

• Bandwidth wastage: Resources we share with other parties (upstream bandwidth) may be consumed by an attack on someone else—another customer of our Internet service provider is attacked, so our upstream connections and routers are not as available to handle our legitimate traffic. Thus, even when we are not the target of an attack, we might experience increased network latency and packet loss, or possibly a complete outage.

Damage & Costs Damage & Costs (contd.)(contd.)

• Logging costs: We may have additional costs because of the need to size notification resources (such as logs, mail spools, and paging services) to absorb attack-related events. Logging systems need to cope with significant deviations in the amount of data logged during attacks.

• Extra network channels: Ideally, logging systems should use an out-of-band channel so that logging traffic does not add to the volume of DoS traffic that may be passed to the internal network. Centralized logging systems, considered a best security practice, may be stressed by receiving log data from multiple locations. Mail queues may fill up during a prolonged outage.

Damage & Costs Damage & Costs (contd.)(contd.)

• Insurance & Bandwidth cost: Network traffic generated by the attack can result in incremental bandwidth costs—when we pay per byte, we also pay for the increased traffic caused by the attack.

• In addition, our upstream Internet provider might or might not be amenable to waiving penalty charges caused by flood traffic.

• Other issues that create hidden costs are insurance or legal fees or possible third-party liability resulting from our involvement in an attack.

How to handle DoSHow to handle DoS• Protecting – Among the aspects of protecting our systems and our

business, are looking at network design, discussing our agreement with your ISP, putting detection mechanisms and a response plan in place, and perhaps taking out an insurance policy. Proper preparation is essential for effective detection and reaction. Unfortunately, some sites begin their cycle with detection and reaction, triggering preparation steps after a “lessons learned” experience.

• Detecting – Our ability to detect attacks directly affects our ability to react appropriately and to limit damages. Among the approaches we can take are instituting procedures for analyzing logs and using automated intrusion detection systems.

• Reacting – Reaction steps, hopefully put in place as part of preparing for an attack, include following our response plan, implementing specific steps based on the type of attack, calling our ISP, enabling backup links, moving content, and more. Technical steps include traffic limiting, blocking, and filtering.

Real world targets and metricsReal world targets and metrics

Following are few real world examples of various targets of DOS attacks:

• A worm called MyDoom started propagating which had a real target in mind - www.sco.com. It was engineered to launch a Denial Of Service (DOS) attack against SCO starting on February 1. Damage and total cost estimates from MyDoom are still in progress, but CEI now estimates the total may exceed $ 4 billion, making it one of the most costly cyber attacks on record.

• In January 2001 a series of DoS attacks overwhelmed the multicast infrastructure with an unusually large number of Source Active messages. An Internet worm, called the Ramen Worm, triggered these attacks with the simple attack mechanism.

SummarySummary

Flood Attacks

Dos Attack Types

Logic / SoftwareAttacks

SummarySummary

Flood Attacks

TCP SYN Flood Attack

Smurf IP Attack

UDP Flood Attack

ICMP Flood Attack

SummarySummaryTCP SYN

Flood Attack

Graphic: http://www.narizone.it/sezioni/firewall/Immagini/SYN_sequence.gif

Taking advantage of the flaw of TCP three-way handshaking behavior, an attacker makes connection requests aimed at the victim server with packets with unreachable source addresses. The server is not able to complete the connection requests and, as a result, the victim wastes all of its network resources. A relatively small flood of bogus packets will tie up memory, CPU, and applications, resulting in shutting down a server.

SummarySummarySmurf IP Attack

An attacker sends forged ICMP echo packets to broadcast addresses of vulnerable networks. All the systems on these networks reply to the victim with ICMP echo replies. This rapidly exhausts the bandwidth available to the target, effectively denying its services to legitimate users.

SummarySummaryUDP Flood

Attack

UDP is a connectionless protocol and it does not require any connection setup procedure to transfer data. A UDP Flood Attack is possible when an attacker sends a UDP packet to a random port on the victim system. When the victim system receives a UDP packet, it will determine what application is waiting on the destination port. When it realizes that there is no application that is waiting on the port, it will generate an ICMP packet of destination unreachable to the forged source address. If enough UDP packets are delivered to ports on victim, the system will go down.

SummarySummaryICMP Flood

Attack

An ICMP flood occurs when ICMP pings overload a system with so many echo requests that the system expends all its resources responding until it can no longer process valid network traffic.

icmpicmp

icmp

icmpicmpicmp

icmpicmp

icmp

SummarySummary


Flood Attacks

Dos Attack Types

SummarySummary

Ping of Death Teardrop Land Echo/Chargen


SummarySummaryPing of Death

An attacker sends an ICMP ECHO request packet that is much larger than the maximum IP packet size to victim. Since the received ICMP echo request packet is bigger than the normal IP packet size, the victim cannot reassemble the packets. The OS may be crashed or rebooted as a result.

Expected Packet Size

Actual Packet Size

SummarySummaryTeardrop

An attacker sends two fragments that cannot be reassembled properly by manipulating the offset value of packet and cause reboot or halt of victim system. Many other variants such as targa, SYNdrop, Boink, Nestea Bonk, TearDrop2 and NewTear are available.

SummarySummaryLand

An attacker sends a forged packet with the same source and destination IP address. The victim system will be confused and crashed or rebooted

198.215.34.56 198.215.34.56

SummarySummaryEcho/Chargen

• The character generator (CharGen) service is designed is primarily used for testing purposes. • Remote users/intruders can abuse this service by exhausting system resources. • Spoofed network sessions that appear to come from that local system's echo service can be pointed at the CharGen service to form a "loop." • This session will cause huge amounts of data to be passed in an endless loop that causes heavy load to the system.• When this spoofed session is pointed at a remote system's echo service, this denial of service attack will cause heavy network traffic/overhead that considerably slows your network down.

Conclusion / QuestionConclusion / Question

What makes DoS attacks possible?

What makes DoS attacks possible?What makes DoS attacks possible?

• middle is passive (packet forwarding)• sender and receiver to all the work

end-to-end paradigm

• Keeping your machine secure may not be enough• Your security relies too much on other machines on the

net


Internet security is highly interdependent.

• Each Internet entity (host, network, service) has limited resources that can be consumed by too many users.


Internet resources are limited.

• Intelligence mostly in the hosts• middle mostly worried about high throughput, not

decision making (like filtering)


Intelligence and resources are not collocated

• IP spoofing gives attackers a powerful mechanism to escape accountability


Accountability is not enforced.

• Internet management is distributed• each network is run according to local policies• no way to enforce global deployment of a particular

security mechanism or security policy• often impossible to investigate cross-network traffic

behavior


Control is distributed.

Dos DefenseDos Defense

How do we defend against a Dos attack??

• The IP address space can be divided into a set of client addresses and a set of server addresses.

• allow clients to initiate connections to servers, but not vice versa

• nor servers to initiate connections to servers.


Separate Client and Server Addresses


– path based addressing

Nonglobal Client Addresses

– Using path-based client addresses severely restricts source-address spoofing by a client, but it does not restrict spoofing by servers.

– Reverse Path Forwarding largely prevents a server from spoofing the address of a server in a different domain.


RPF Checking of Server Addresses

• simple special-purpose high-speed firewalls being deployed in the core of the Internet at inter-domain boundaries to serve as a filter of sorts

• Gives Upstream access control to a server under stress


Middlewalls

• Susceptibility to attacks could be alleviated with better Internet Architectures (goal of class).

• Don’t leave all the decision making to the machines on either end of a connection

• Provide ‘intelligent’ support along the path (e.g.

No Blind forwarding of packets)• Create “Hardened” networks

ConclusionConclusion

ReferencesReferences• http://www.google.co.in• http://www.itoc.usma.edu/workshop/2005/Papers/Follow%20ups/Making%20Garbage

%20Collection%20Dependable.pdf• http://www.cert.org/archive/pdf/Managing_DoS.pdf• http://en.wikipedia.org/wiki/Smurf_attack• http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci822096,00.html• http://www.computereconomics.com/article.cfm?id=932• www.caida.org/tools/measurement/Mantra/mantra-publications/INFOCOM-

03b.ps.gz• http://www.iss.net/security_center/advice/Exploits/TCP/SYN_flood/default.htm• http://www.cert.org/tech_tips/denial_of_service.html• http://www.cs.ucl.ac.uk/staff/m.handley/papers/dos-arch.pdf• A taxonomy of DDoS attack and DDoS defense mechanisms • http://cactus.eas.asu.edu/Partha/Papers-PDF/2003/Shu-ICCCN.pdf• advanced.comms.agilent.com• http://www.anml.iu.edu/ddos/types.html#flood

http://www.google.co.in/

http://www.google.co.in/

http://www.itoc.usma.edu/workshop/2005/Papers/Follow%20ups/Making%20Garbage%20Collection%20Dependable.pdf

http://www.itoc.usma.edu/workshop/2005/Papers/Follow%20ups/Making%20Garbage%20Collection%20Dependable.pdf

Documents

Denial of Service (DoS) By Vijay C Uyyuru, Prateek Arora, & Terry Griffin