Chapter 4 Denial of Service Attacks
Dr. Chuck Easttom, Computer Security Fundamentals, Fourth Edition. Pearson Education, Inc, 2020.
Chapter Objectives
- Understand how DoS attacks happen
- Examine specific DoS attacks such as SYN flood, Smurf, and DDoS
- Protect yourself against DoS attacks
- Defend yourself against specific types
Introduction
DoS is an abbreviation of Denial of Service – when attackers prevent your website from working properly. This can cause huge financial loss for companies who make their money through their website. The website will go down preventing sales and damaging the company reputation.
This chapter focuses on how DoS attacks occur and what you can do to defend yourself.
In information security, the old adage that “knowledge is power” is not only good advice but also an axiom upon which to build your entire security outlook. p96
DoS Attacks
The DoS is a popular and easy way to attack a system. A DoS stops users being able to access a system hence the name, Denial of Service.
Any real-world device has a maximum specification – you cannot store 2TB worth of data on a 1TB drive. A car will usually have warning signs stating the combined weight of cargo and passengers cannot exceed a certain amount. Otherwise, the car will break down.
For a computer system, the maximum capacity will depend on:
- number of users
- file size
- data transmission speed
- data storage space
If any of these are too large for the system to handle, it will fail.
A DoS floods a web server with requests, making it unable to deal with the requests and effectively has to refuse them – any legitimate requests on the server will result in a server error.
A great analogy is Metabolical’s comment on this Reddit thread about a pizza store: https://www.reddit.com/r/explainlikeimfive/comments/4vvo9g/eli5why_isnt_there_a_good_defense_for_companies/
Illustrating an Attack
The book includes an example of a DoS attack using the ping command.
You can configure your ping by typing in ping /? and viewing the available options:
- -l changes the size of the packet, we want the largest possible
- -w is how long ping will wait for a response; setting this to -0 means the request will not wait at all, forming a queue at the target
- -t copies the ping so it will continually send packets until it is cancelled
An example command would be: ping IPaddress -l 65000 -w 0 -t
This will ping target repeatedly with a packet size of 65000 and a wait time of 0.
Note this is a very simple example and will likely not work against the latest servers. Real world attacks are a lot more sophisticated: a hacker may program a virus to work on hundreds of computers which then work together to attack a system – using many computers in this fashion is known as a DDoS, or Distributed Denial of Service.
The video below shows an example attack in action:
You can read about examples of real-world DDoS attacks here: https://www.cloudflare.com/en-gb/learning/ddos/famous-ddos-attacks/
Distributed Reflection Denial of Service Attacks
A special kind of DDoS is a Distributed Reflection of Service attack, where routers themselves are tricked into attacking a system. Instead of sending the packets to an individual computer, it sends them to the router instead using a backbone (these are the main lines smaller networks connect to, like the motorway). Routers are connected to the backbone using port 179, and because this is often left ‘open’, it can be used by hackers to attack the routers. A very technical guide: https://www.senki.org/protect-your-bgp-sessions-from-ddos-attacks/
The packet headers are edited to show the packet coming from the target IP, so the routers send the packets to this device resulting in overwhelm.
Common Tools Used for DoS Attacks
Why do these tools exist and why are they widely available? Many have been created to legitimately stress-test networks, others have been developed for malicious intent. Here we look at some of the most popular tools used for DoS attacks:
- LOIC – Low Orbit Ion Cannon is a program downloaded from the internet which when ran, opens up a GUI where the hacker can simply type in their target URL or IP which then prompts the software to bombard the target with packets. Although easy to use, the attacker is easy to trace because the program only uses one computer to carry out the attack, meaning they can easily be caught. Similar to HOIC below.
- HOIC – High Orbit Ion Cannon is a more sophisticated version of LOIC. You can read about the differences here: https://www.imperva.com/learn/ddos/high-orbit-ion-cannon/
- XOIC – Another server stress testing tool similar to LOIC.
- TFN and TFN2K (historical) – https://packetstormsecurity.com/files/10135/TFN2k_Analysis-1.3.txt.html
- Stacheldraht – German for ‘Barbed Wire’, Stacheldraht combines the functions of Trinoo https://www.f-secure.com/v-descs/trin00.shtml and TFN to perform various attacks such as UDP flood, ICMP flood, TCP SYN flood and Smurf attacks.
DoS Weaknesses
Although DoS attacks are relatively easy to do, there are disadvantages for the hacker:
- Bombarding target with packets must be sustained: as soon as it stops, the service is back up and running
- DDoS uses a virus to conduct an attack, which is unknowingly installed on a user’s machine. Once aware of the virus, it is removed and allays the attack.
- A simple DoS attack from a hacker’s own computer can be easily traced.
Specific DoS Attacks
TCP SYN Flood Attacks
A session is when a client connects with a server over TCP, and transfers packets between them. The packets contain control flags which tell the computers what to do with the packet; the beginning of this process is called the ‘three-way handshake’ https://www.geeksforgeeks.org/tcp-3-way-handshake-process/, simply put:
- Client sends packet with SYN flag
- Memory is allocated for client. Server responds with SYN and ACK flags
- Client responds with ACK, session begins
This process can be interrupted by flooding a server with SYN flag only packets, resulting in the server constantly responding to these and never receiving an ACK from the client. As a result, legitimate packets cannot be processed.
TCP is a protocol that sends packets across the internet. Any computer using TCP is vulnerable to TCP SYN attacks – this is how routers work, therefore all machines can be compromised. DoS attacks can be blocked using firewalls, which filter packets to ensure they are legitimate.
Although a well-configured firewall can mitigate against DDoS attacks, it is worth taking a combined approach on individual servers for better protection. These techniques are listed in the next section.
Defensive techniques against TCP SYN Flood attacks
There are other defensive techniques that can be used against DoS attacks. These are:
- Micro blocks – instead of allocating an entire buffer segment to a SYN packet, a micro block is used instead making it more difficult to flood the system. In simple terms, less memory is allocated to the attacker’s packets giving the server more memory to deal with other requests.
- SYN cookies – uses cryptographic hashing to create a cookie. Instead of allocating memory at the second step in the three-way-handshake, it is allocated at the point of acknowledgement. The SYN-ACK sent by the server contains the cookie which, when responded to by the client, is evidenced in the returning ACK. The server then knows this is a legitimate request and can start the session.
- RST cookies – the server will send a malformed SYN-ACK to the client, resulting in the client responding with an RST packet requesting to start again. This proves to the server the client is legitimate.
- Stack tweaking – a complicated method which involves configuring the TCP stack (not quite the same as the OSI model) making the server time out faster after receiving a SYN request so it removes unresponsive packets. This makes attacks more difficult, but not impossible.
There’s a lot of technical jargon here, so the following articles may help assist comprehension:
- https://www.purevpn.com/ddos/syn-flood-attack
- https://www.imperva.com/learn/ddos/tcp-transmission-control-protocol
SPI firewalls
SPI stands for Stateful Packet Inspection. Firewalls have greatly reduced DoS attacks, simply by having the firewall inspect the packets on arrival. Because we are aware of how SYN flood attacks work SPI firewalls can easily tell the difference between users and attackers, and block multiple SYN packets from the same IP address. NGFW or Next Generation Firewalls combine methods such as SPI and Intrusion Detection Systems (IDS).
Smurf IP Attacks
Based on directed broadcasts. Many modern networks disable this feature as they can be easily exploited for DoS attacks. We spoke about IP classes in Chapter 2, where a range of IP addresses are assigned to certain organisations for their own use. For example, HP own the 15. network, which has the capacity of 16 million IP addresses.3
A hacker using the Smurf attack can send an ACK request to 15.255.255.255 and receive requests from all addresses on the 15. network. This is a form of bandwidth amplification.
UDP Flood Attacks
We already know about TCP. UDP is another faster but not as reliable form of transport protocol. The difference between them is that TCP will establish a connection using the ‘three-way handshake’. More info here: https://www.cloudflare.com/en-gb/learning/ddos/glossary/user-datagram-protocol-udp/
A UDP is a User Datagram Protocol packet, used to speed up transmission by not establishing a formal connection with the server. It will quickly send packets sequentially without checking if they are being received.
A UDP Flood attack is where an attacker repeatedly sends UDP packets to a specific port. The computer checks to see if any programs are using that port and requesting information. It will find none, and will then send an ICMP packet back to what it thinks is the sender of the UDP but is actually a spoofed address. So we have a web server constantly receiving UDP and sending ICMP packets in response to the attack, resulting in system overload.
This video has a simulation of a UDP flood attack.2
ICMP Flood Attacks
Attackers use pings or UDP packets to flood a computer to put it out of server. There are two types: floods and nukes. A nuke is a packet designed to disable an operating system by sending a packet that cannot be processed by that particular OS, either due to specification or a known vulnerability.
The Ping of Death
When an attacker sends a single packet that is too large for the target computer to handle.
Teardrop Attacks
A fragmented message is sent which is impossible to merge. When the computer tries to reconstruct the message the system crashes.
DHCP Starvation
DHCP stands for Dynamic Host Configuration Protocol. An attacker can flood DHCP servers with too may requests, disabling the system.
HTTP POST DoS Attacks
A legitimate POST message is sent, and contains the size of the content which follows. However, instead of the content following immediately, it is sent very slowly causing the web server to ‘hang’ waiting for the rest of the message.
PDoS Attacks
Also known as phlashing, PDoS attacks are Permanent Denial of Service which involve permanently damaging the system.
Registration DoS Attacks
Although CAPTCHAs can be annoying, they serve a purpose, and that is to prevent bots submitting forms and spamming the receiving system. CAPTCHAs prove a user is human so they know the form being filled out is valid, and can receive the data without issue.
Login DoS Attacks
CAPTCHAs are also used to defend against Login DoS attacks, where hackers will repeatedly attempt to login to a system causing the authentication mechanism to fail or slow down substantially, making it impossible or difficult for legitimate users to log in.
Land Attacks
A land attack consists of an attacker sending a packet which contains the same IP address for both destination and source. The server becomes confused sending messages to and from itself, and causes it to crash. Modern systems are mostly immune to this type of attack.
DDoS Attacks
This entails using multiple computers to attack a target. Normally achieved by using a virus (a Trojan horse or similar tricks users into installing the virus onto their system) which is then used to spam a system.
Botnets are entire networks of computers that are under the attacker’s own control, rather than using viruses to infect random machines.
Question: wouldn’t a single network of computers used for a DDoS attack quickly be identified and shut down?
Real-World Examples of DoS Attacks
Boston Globe attack:
The Boston Globe was hit with a second day of attacks by unknown cyberassailants Thursday, leaving bostonglobe.com and the company’s other websites unavailable for parts of the day.
The Globe’s websites and internal servers were subjected to a distributed denial-of-service, or DDoS, attack, one of the most common forms of computer vandalism. DDoS attackers commandeer hundreds or thousands of computers and other digital devices that are owned by law-abiding users around the world.
These machines are secretly infected with malware that allows attackers to create a so-called botnet that can swamp a target with so much data that its networks become overwhelmed and cannot operate.
Kevin Whalen, a spokesman for digital security company Arbor Networks Inc. of Burlington, said his company has tracked 7.1 million DDoS attacks this year, or about 23,000 a day. Whalen said such attacks have become more common because almost anyone with Internet access and a few dollars can launch them.
“For very short dollars, you can hire someone with a botnet infrastructure to launch an attack against someone you’re upset with,” Whalen said.
As of Thursday afternoon, nobody knew who attacked the Globe network or why. Many DDoS attackers are never identified.
Wade Sendall, the Globe’s vice president of information technology, said the first attack came around 3 p.m. Wednesday. “We think it was a probe,” he said, aimed at testing the Globe network’s defenses and figuring out the best ways to get past them. Even so, the probe repeatedly disrupted the newspaper’s telephones and the editing system used to prepare content for print and online editions.
The attacks resumed around 11 a.m. Thursday, making it impossible for many Globe employees to do their jobs and rendering bostonglobe.com inaccessible for many readers. By mid-afternoon, Globe technicians and specialists from the company’s Internet provider had set up effective defenses.
“It’s been mitigated for the time being,” Sendall said, “but there’s no reason to think they won’t come back.”
Indeed, Internet security engineers have been fending off DDoS attacks for two decades. While they’ve gotten better at it, the risk of such attacks can never be entirely eliminated.
“It will always be possible to do this,” said Theresa Abbamondi, an Arbor director of product management. “As long as you can send traffic to someone, which is the point of the Internet, you can always send too much traffic.”
Others: https://www.tripwire.com/state-of-security/5-notable-ddos-attacks-2017
How to Defend Against DoS Attacks
- First learn about and understand various attacks and how they work, this will equip you with the knowledge to defend your network.
- Implement defensive techniques such as microblocks, SYN and RST cookies, and stack tweaking.
- Configure your firewall to block external ICMP packets.
- Disallow all traffic from outside your network.
- Use tools like NetStat for threat detection.
- Configure internal routers to disallow external traffic.
- Disable directed broadcasting.
- Install a filter on your router to examine incoming packets to verify IPs.
- Use anti-virus software.
- Keep OS and software updated.
- Request users do not download anything onto their computers.
- Employ blackholing5 and sinkholing6.
- Install an IPS (Intrusion Protection System) or IDS (Intrusion Defensive System) on your network.
Summary
In this chapter we learned a lot about DoS attacks and the various different kinds. We also learned how to protect a network from DoS attacks and different techniques to employ. The internet is designed to transfer data, and some of that data can be sent with malicious intent. It is important to understand how this is done and how it can be prevented, mitigated or fixed.
I had to watch a lot of videos to understand this chapter, especially about each of the various DoS Attacks, as it was useful to hear explained and see them in action. Instead of embedding them all in the post, here is a list of the most helpful (referenced by number):