Classic Denial-of-Service Attacks
Flooding ping command Simplest classical DoS attack Aim is to overwhelm the capacity of the network connection to the target organization Traffic can be handled by higher capacity links on the path, but packets are discarded as capacity decreases
The attacker might use the large company’s Web server to target the medium-sized company with a lower-capacity network connection
When a large number of packets are sent to the target system, valid traffic will have little chance of surviving discard
Classic Denial-of-Service Attacks
Disadvantage of flooding attackers Source of the attack is clearly identified unless a spoofed address is used since its address is used as the source address in the ICMP echo request packets 1. Increase the chance that the attacker can be identified and legal
action taken in response
2. Reflect attack back at the source system The targeted system will attempt to respond to the packets being sent (the server would respond to each ICMP request with echo response packet directed back to the sender)
Network performance is noticeably affected
Source Address Spoofing
Use forged source addresses Usually via the raw socket interface on operating systems
Greatly eases the task of attacker to generate packets with forged attributes
Attacker generates large volumes of packets that have the target system as the destination address
Congestion would result in the router connected to the final, lower capacity link
However, ICMP echo response packets would be scattered across the Internet to all the various forged source addresses
Making attack systems harder to identify Requires network engineers to specifically query flow information from their routers (manual process) Useful side-effect: backscatter traffic
Security researchers advertise routes to unused IP addresses to monitor attack traffic
SYN Spoofing
Common DoS attack
Attacks the ability of a server to respond to (future) TCP connection requests by overflowing the tables used to manage them
Thus legitimate users are denied access to the server
Hence an attack on system resources, specifically the network handling code in the operating system
TCP Connection Handshake
Identify client’s address, port number
Recordinformation In the table
Mark connectionas established
Mark connectionas established
Data transfer
TCP SYN Spoofing Attack
TCP connection handshake sometimes fail due to… Packets are transported using unreliable IP network protocol Packets might be lost in transit due to the congestion
TCP protocol Advantage: reliable protocol
If no response is received, client or server resends those packets
Disadvantage Impose an overhead on the system in managing the reliable transfer
Attack Point!!!
TCP SYN Spoofing
Attack
Which one is under attack?Server? Spoofed client? (if there exists such a client)
TCP SYN Spoofing Attack
The attacker directs a very large number of forged connection requests at the target server
These rapidly fill the table of known TCP connection requests at the server
Once this table is full, any further requests are rejected
Flooding Attacks
Classified based on network protocol used Intent is to overload the network capacity on some link to a server
Alternatively aim to overload the server’s ability to handle and respond to this traffic Flood the network link to the server with a torrent of malicious packets to the server Valid traffic has a low probability of surviving discard, and hence of accessing the server
Flooding Attacks
Ping flood using ICMP echo request packets Traditionally network administrators allow such packets into their networks because ping is a useful network diagnostic tool
ICMP flood
Uses UDP packets directed to some port number on the target system A common choice was a packet directed at the diagnostic echo service
UDP flood
Sends TCP packets to the target system (with real or spoofed source address) Similar to SYN spoofing attack Difference: total volume of packets is the aim of the attack rather than the system code
TCP SYN flood
Virtually any type of network packet can be used Any of the ICMP, UDP, or TCP SYN The larger the packet, the more effective is the attack
Flooding Attack
What’s the problem with these attack variants? Limited in the total volume of traffic if just a single system is used The attacker is easier to trace
Multiple and indirect attacking systems Significantly scale up the volume of traffic The attacker is further distanced from the target and significantly harder to locate and identify
1. Distributed denial-of-service (DDoS) attacks 2. Reflector attacks 3. Amplifier attacks
DDoS Attacks
Use of multiple systems to
generate attacks
Attacker uses a flaw in operating
system or in a common
application to gain access and installs their program on it
(zombie)
Large collections of such systems under the control of one attacker’s control
can be created, forming a botnet
DDoS Attack Architecture
• Automatically grow suitable botnets using Handler Zombies
• Obscure the path backto the attacker
DDoS Attack Tools
Tribe Flood Network (TFN) One of the earliest and best known DDoS tools Written by the hacker known as Mixter (original variant from 1990s) Exploited Sun Solaris systems Later rewritten as Tribe Flood Network 2000 (TFN2K) Agent was a Trojan program, capable of implementing ICMP flood, SYN flood, UDP flood, ICMP amplification Rely on the layered command structure
Trinoo, Stacheldraht, …