NYCU-LYX

7-Denial-of-Service Attacks

7.1  Denial-of-Service Attacks

The Nature of Denial-of-Service Attacks

A denial of service (DoS) is an action that prevents or impairs the authorized use of networks, systems, or applications, by exhausting resources such as central processing units (CPU), memory, bandwidth, and disk space.

Categories of Resources

Figure 7.1, the attacker might use the large company’s Web server to target the medium-sized company with a lower-capacity network connection

The attack might be as simple as using a flooding ping1 command directed at the Web server in the target company. This traffic can be handled by the higher-capacity links on the path between them, until the final router in the Internet cloud is reached. At this point, some packets must be discarded, with the remainder consuming most of the capacity on the link to the medium-sized company. Other valid traffic will have little chance of surviving discard as the router responds to the resulting congestion on this link.

Classic Denial-of-Service Attacks

Source Address Spoofing

SYN Spoofing

Normal TCP Handshake

  1. client system initiates the request for a TCP connection by sending a SYN packet to the server
    1. (client’s address, port, initial sequence number, or request for other TCP options)
  2. server responds to the client with a SYN-ACK packet
    1. sequence number for the server, increments the client’s sequence number(confirm receipt of the SYN packet)
  3. client receives, sends an ACK packet to the server
    1. incremented server sequence number, marks the connection as established
  4. server receives this ACK packet, it also marks the connection as established

TCP SYN spoofing

7.2  Flooding Attacks

ICMP Flood

UDP Flood

TCP SYN Flood

TCP SYN Flood 跟 SYN spoofing attack 差別

  1. SYN Flood 攻擊
    • 攻擊機制: 大量發送SYN請求封包,但不回應伺服器的SYN-ACK封包,導致伺服器大量半開連線堆積,資源耗盡。
    • 不需要IP欺騙,使用真實IP即可發動攻擊。
    • 主要耗盡目標伺服器TCP連線資源和計算資源。
  2. SYN spoofing attack
    • 攻擊機制: 使用欺騙的源IP發送SYN請求封包,導致伺服器的SYN-ACK封包發送到不存在的IP,連線打開失敗。
    • 依賴IP源地址欺騙,使SYN-ACK發送到虛假IP。
    • 主要耗盡目標伺服器的網路頻寬資源。

7.3  Distributed Denial-of-Service Attacks

IRC is one of the earlier instant messaging systems developed, with a number of open source server implementations. It is a popular choice for attackers to use and modify as a handler program able to control large numbers of agents. Using the standard chat mechanisms, the attacker can send a message that is relayed to all agents connected to that channel on the server. Alternatively, the message may be directed to just one or a defined group of agents.

7.4  Application-Based Bandwidth Attacks

SIP Flood

SIP(Session Initiation Protocol)是一種用於建立和終止多媒體通話(例如VoIP語音通話)連接的信令協議。

SIP Flood攻擊的具體機制是:

  1. 攻擊者產生大量假SIP INVITE請求,發送給VoIP伺服器。
  2. VoIP伺服器啟動了為每個INVITE請求建立新的SIP會話。
  3. 攻擊者並不回應伺服器的響應,導致大量半開的SIP會話積累。
  4. 當累計的半開會話數達到伺服器的負載極限時,新請求就會被丟棄,從而實現DoS效果。
  5. 攻擊者可以利用僞造的來源IP進行擴大式的DDoS攻擊。

SIP Flood最終導致VoIP提供商的語音服務不可用。它可以通過消耗VoIP伺服器的計算和記憶體資源來實現DoS效果。

防禦方法包括限制會話數量、檢測異常流量模式等。SYN Flood是類似的TCP連接洪水攻擊。

HTTP-Based Attacks

Http Flood

HTTP洪水型DoS/DDoS攻擊。具體機制是:

Spidering攻擊是一種針對網站的DoS攻擊手段,攻擊者利用自動爬蟲程序模擬搜索引擎蜘蛛的正常訪問,消耗目標網站的資源。具體特徵包括:

防禦手段:

SLOWLORIS

Slowloris攻擊是一種HTTP洪水型DoS攻擊,其攻擊機制如下:

  1. 攻擊者建立向目標網站的多個HTTP連接,並發送初始化的HTTP請求。
  2. 每個請求在頭部包含Content-Length字段指示非常大的請求內容。
  3. 但是攻擊者每次只發送非常小的內容片段,遠小於Content-Length所宣稱的大小。
  4. 服務器會等待完整內容到達,以完成請求,這使連接長時間保持打開狀態。
  5. 攻擊者不斷重複這一過程,消耗目標網站所有的連接資源。
  6. 當連接用盡時,正常用戶就無法訪問網站,達到DoS效果。

Slowloris特點是每個連接流量非常小,不易檢測,但可以長時間佔用連接。例如只發送1字節內容,但聲稱總長1GB。它消耗的主要是連接資源而不是頻寬。

連接資源(Connection Resources):
1. 指系統可以建立的並發TCP連接總數量。
2. 每個TCP連接會佔用服務器一定的內存和處理資源。
3. 連接資源受限制最大并發連接數决定。
頻寬(Bandwidth):
1. 指網絡的資料傳輸容量,單位可以是Mbps。
2. 受限於網絡接口的物理特性,例如千兆網卡的頻寬。
3. 頻寬受流量大小影響,但多個小流量連接也可以耗盡。

Reference: https://www.ntu.edu.sg/home/ehchua/programming/webprogramming/HTTP_Basics.html

7.5  Reflector and Amplifier Attacks

Reflection Attacks

Amplification Attacks

DNS Amplification Attacks

7.6  Defenses Against Denial-of-Service Attacks

7.7  Responding to a Denial-of-Service Attack

7.8  Key Terms, Review Questions, and Problems

7.1 Define a denial-of-service (DoS) attack.

A denial-of-service (DoS) attack is an attempt to make a computer resource unavailable to its intended users. This can be done by overwhelming the system with traffic, or by sending it information that triggers a crash.

7.2 State the difference between a SYN flooding attack and a SYN spoofing attack.

A SYN flooding attack overwhelms a target system with SYN packets, which are the first stage of a TCP connection. This can cause the target system to run out of resources and become unavailable.

A SYN spoofing attack is a type of SYN flooding attack in which the attacker spoofs the source address of the SYN packets. This makes it more difficult to trace the attack back to its source.

7.3 What is the goal of an HTTP flood attack?

The goal of an HTTP flood attack is to overwhelm a web server with HTTP requests, causing it to crash or become unresponsive.

7.4 What is a poison packet attack? Give two examples of such an attack.

A poison packet attack is an attack that sends malformed packets to a target system in an attempt to disrupt its operation. Two examples of poison packet attacks are:

7.5 Why do many DoS attacks use packets with spoofed source addresses?

Attackers spoof the source addresses of packets in DoS attacks to make it more difficult to trace the attacks back to their sources. This can allow the attackers to remain anonymous and avoid being caught.

7.6 What is “backscatter traffic?” Which types of DoS attacks can it provide information on? Which types of attacks does it not provide any information on?

Backscatter traffic is the traffic that is generated by a target system in response to a DoS attack. This traffic can be analyzed to identify the source of the attack, as well as the type of attack that was used.

Backscatter traffic can provide information on the following types of DoS attacks:

Backscatter traffic cannot provide information on the following types of DoS attacks:

7.7 What is the difference between a DDoS attack and a classic DoS attack? Why are DDoS attacks considered more potent than classic DoS attacks?

A DDoS attack is a distributed denial-of-service attack. In a DDoS attack, the attacker uses multiple computers to launch the attack, which can overwhelm the target system more easily than a classic DoS attack.

DDoS attacks are considered more potent than classic DoS attacks because they can generate more traffic and are more difficult to trace back to their sources.

7.8 What architecture does a DDoS attack typically use?

A DDoS attack typically uses a botnet architecture. A botnet is a network of compromised computers that are controlled by the attacker. The attacker can use the botnet to send large amounts of traffic to the target system.

7.9 Define an HTTP flood.

An HTTP flood is a type of DoS attack in which the attacker sends HTTP requests to the target system with spoofed source addresses. This can overwhelm the target system and cause it to become unresponsive.

7.10 Define a Slowloris attack.

A Slowloris attack is a type of DoS attack in which the attacker sends a small number of HTTP requests to the target system, but keeps the connections open for a long period of time. This can overwhelm the target system and cause it to become unresponsive.

7.11 From an attacker’s perspective, what are the drawbacks of a classic ping flood attack?

From an attacker’s perspective, the drawbacks of a classic ping flood attack are:

7.12 What defenses are possible against nonspoofed flooding attacks? Can such attacks be entirely prevented?

There are a number of defenses that can be used against nonspoofed flooding attacks. These include:

It is not possible to entirely prevent nonspoofed flooding attacks, but these defenses can make it more difficult for attackers to launch successful attacks.

7.13 What is the purpose of SYN cookies?

SYN cookies are a technique that can be used to prevent SYN flooding attacks. In a SYN flooding attack, the attacker sends a large number of SYN packets to the target system, which can overwhelm the system and cause it to become unresponsive.

SYN cookies work by replacing the source IP address in SYN packets with a cryptographically generated hash. This means that the target system does not need to store state for each SYN packet, which can help to prevent the system from being overwhelmed.

7.14 What defences are possible against a DNS amplification attack? Where must these be implemented? Which are unique to this form of attack?

There are a number of defenses that can be used against a DNS amplification attack. These include:

In addition to these general defenses, there are a number of defenses that are unique to DNS amplification attacks. These include:

These defenses must be implemented at the DNS servers that are being targeted by the attack.

7.15 What defenses are possible to prevent an organization’s systems being used as inter- mediaries in a broadcast amplification attack?

There are a number of defenses that can be used to prevent an organization’s systems from being used as intermediaries in a broadcast amplification attack. These include:

7.16 To what do the terms slashdotted and flash crowd refer to? What is the relation between these instances of legitimate network overload and the consequences of a DoS attack?

The terms “slashdotted” and “flash crowd” refer to two legitimate instances of network overload.

These instances of legitimate network overload are related to the consequences of a DoS attack in that they both can cause a website or service to become unavailable to users. However, there are some key differences between the two.

7.17 What steps should be taken when a DoS attack is detected?

When a DoS attack is detected, it is crucial to take swift and decisive action to mitigate the damage and restore normal operations. Here’s a step-by-step guide to effectively respond to a DoS attack:

  1. Identify the type of attack: The first step is to determine the nature of the DoS attack, such as a SYN flood, UDP flood, or DNS amplification attack. This will help in implementing the appropriate defense mechanisms.
  2. Identify the source of the attack: This involves analyzing traffic patterns, network logs, and using specialized tools to pinpoint the origin of the attack traffic. This can be challenging due to spoofed IP addresses, but it’s essential for blocking the attacker and preventing future attacks.
  3. Block the source of the attack: Once the source is identified, take steps to block the attack traffic. This can be done through firewalls, access control lists (ACLs), and routing blackholes. It may also involve coordinating with upstream internet providers to block the malicious traffic.
  4. Absorb the attack: If blocking the source is not immediately feasible or the attack is too large, the network needs to be able to absorb the attack traffic. This may require increasing network capacity, adding more bandwidth or servers, or implementing load balancing and traffic shaping techniques.
  5. Monitor and analyze: Continuously monitor network traffic and analyze attack logs to identify any new or recurring attacks. This allows for proactive defense measures and quick response times.
  6. Recover and assess: Once the attack has subsided, take steps to recover from any damage caused by the attack, such as restoring lost data or repairing network infrastructure. Conduct a thorough post-mortem analysis to identify vulnerabilities, improve security measures, and prevent future attacks.

7.18 What measures are needed to trace the source of various types of packets used in a DoS attack? Are some types of packets easier to trace back to their source than others?

Tracing the source of packets used in a DoS attack can be challenging due to spoofed IP addresses and distributed attack techniques. However, there are several measures that can be employed to identify the attacker’s origin:

  1. Traffic analysis: Analyze network traffic patterns to identify anomalies, such as sudden spikes in traffic or unusual traffic patterns from specific sources. This can help narrow down the range of potential attackers.
  2. Network forensics: Collect and analyze data from network devices, such as routers, firewalls, and intrusion detection/prevention systems (IDS/IPS). This data can reveal valuable information about the attack traffic, such as source IP addresses, packet headers, and timestamps.
  3. Honeytokens: Deploy honeytokens, which are fake systems designed to attract attackers. When an attacker interacts with a honeytoken, their actions and identity can be logged, providing valuable insights into their tactics and potential location.
  4. Collaboration with ISPs: Collaborate with internet service providers (ISPs) to track the attack traffic upstream. ISPs may have access to more detailed network data and can assist in identifying the source of the attack.

The difficulty of tracing the source depends on the type of packets used in the attack:

In general, tracing the source of DoS attack packets is a complex task that requires a combination of network analysis, specialized tools, and collaboration with ISPs. The difficulty of tracing depends on the type of packets used, the attacker’s level of sophistication, and the availability of network data.