AdminXP.com: Denial of Service (DoS), Distributed DoS (DDoS)

Denial of Service (DoS), Distributed DoS (DDoS)

Denial of Service - DoS - This term donotes a group of various ways to prevent legitimate users of a computer system from using that system; they are called attacks. The attacks are organized by attackers (also called hackers) and can partly or completely disable your server, network or other services (web, mail, ftp,..), which can result in system collapse, instability or restart.
The goal of these attacks is to flood a system or a network. Typically, the attacker sends a huge amount of requests to the server that is unable to process them. In case the system does not collapse, the system resources are exhausted or the line gets overloaded, which results in denial of the service for legitimate users. Such an attack is a very simple thing. The tools needed for executing an attack are available on the Internet and the attacker even need not have any special knowledge. But the prevention is not so easy because if one or several computers are used to orchestrate an attack, the server and the network become inaccessible. Sometimes, the DoS attack can be used to camouflage some other activity - e. g. to cover the footprints of some other hacker´s attack or as the last chance to cause a demage when the attack does not succeed. In most cases, the security is not broken, however, great damages can be caused through the server inaccessibility which results in the loss of time, money and trust.
Sometimes, a DoS attack can be used in case the hacker needs the remote system to be restarted. If the hacker penetrates to the system and make some changes in the configuration, he might need to restart the system in order the changes to take effect. The restart can sometimes help to cushion the DoS attack, to recover from the attack or in order the changes made by the administrator to take effect.

Basic Terms

Client - an application used to start the attack by sending a command to other components starting the attack
Daemon - a process running on agents. It is responsible for executing the commands sent by the client.
Master (Handler) - is the infected system that is such an intermediator between the attacker and the agents in a 3-level control system. It provides communication between particular levels and its task is to obtain new agents. It also carries out the functions of the Cilent.
Agent (Zombie) - an infected computer executing an attack on a target by running the process called daemon.
Target - attack´s victim (computer, service, network)

Means of the DoS and DDoS attacks and their targets:

Attack against network connectivity - The attacker uses a high-speed connection to the Internet or gains the access to one or several systems that provide sufficient capacity for fast sending of data in order to flood the target system that is using a slower transfer capacity. It results in access denial or limitation for common users. It is not necessary to have a higher transfer capacity than the target system has in order to execute an attack because the most important thing about attacks is how the attack is prepared and carried out. The line capacity can be several times lower and the attack can still be successful. While the systems can be protected from some types of attacks, the lines cannot be protected from overload at all.
Consumption of system resources - The goal of the attacker is to make the system busy and to limit the performance of the processor, to inundate the main memory and the disk space. It can result in system breakdown, frozing and access limitation.
Using the errors of the system - Err is human and the systems are made by human. And so there appear errors in operating systems, protocols (imperfect specification or an error in the implementation into the system), programs, hardware and in other parts of the system. It is very difficult to monitor all newly detected errors. Additionaly, the solution of such an error is not an easy thing. But hackers usually monitor this field very carefully which they utilize for the attacks.
Exploitation of a remote system - When an attacker penetrates to the system and changes the routing table or the data in the DNS systems, he can redirect the network traffic to his own sites or to any existing or non-existing server. The attack on an DNS server is one of the ways to make the target computer inaccessible without the need to directly attack the target computer (if the DNS server is not the same computer as the target one). When an SW like Zombie is installed, the system can be used for executing a DDoS attack.
Viruses - They can contain a program like Zombie or another code that is able to force the infected computer to attack other systems.
Physical disconnetion of the network - The system can be casually or purposely disconnected from the network by breaking the cable or by damaging the router. Large companies usually use several ways of connection to the Internet or they have emergency solutions prepared for such cases. In case of a DoS attack, the administrator can disconnect the network and so disable the attacker to take action until the appropriate solution is found.
Inconvenient behaviour of users can also cause the denial or the limitation of services - 1. FTP servers can get flooded with useless data. Each user should be limited somehow. 2. Mail servers - besides the classical attack (when the attacker uses several dozens of computers to send hundreds and thousands of messages), the second way to inundate a server is to send large messages or messages with large attachments. That is the reason why the servers apply limits on each user for an attachment. 3. Indundation of the data or the main servers with a huge amount of data. Today, when the data are being stored to CDs and DVDs and particular files contain whole films, large photos or other data consuming dozens of MB or GB, it is very easy for a larger amount of users to flood these servers just by storing data. So the servers have to use programs that can watch and limit users. This is made using quotes - e. g. one user can save the maximum of 100MB of data on the server.
Buffer Overflows - It is a programming flaw that allow users to run commands on an operating system by inputting data that is greater than expected by the application. Practically, an application is set to accept data not larger than 256B, but unfortunately, the application does not check if the inputted data really has 256B or if it is larger. If a larger data file is inputted, the attacker can run a code and so break the application´s security (Internet server). This attack can also cause that the application or the system collapse. The Buffer Overflows is frequently used by Ping of Death attacks, but it can also be used for other ones.

Types of DoS attacks

1. Ping of Death

The Ping of Death attack is caused by an attacker that sends an echo request packet to a remote system. The packet is larger than the 64kB bytes allowed by the IP protocol.
Not only computers can be attacked by the Ping of Death attack, but also some routers and network printers are sensitive to this type of atack. Most systems are resistant to this attack because it is quite old and so very well-known, but still, some systems use the protection - it is the limitation of the ICMP requests (5-10) and the limitation of broadcast messages from the Internet.

2. SYN Flood

The SYN Flood happens when hundreds of spoofed SYN (Synchronization) requests are sent to the target system. These requests are normally used for synchronization when initiating connection. Then the system reserves a very small buffer space to handle the particular connections and to send the ACK-SYN reply. Normally, the system should send a reply (ACK) containing information that the connection was successfully established, but this does not happen and no reply is sent because the spoofed IP address does not exist or is inactive. The target system tries to send the ACK-SYN reply again and after a certain period of time closes particular connections (dozens of seconds). When a larger amount of requests is sent, a large amount of half-open connections is opened, so the memory gets flooded and the legitimate users cannot be served.
The protection against this attack actually does not exist. From the server´s view, it is a common communication based on the IP protocol specification. Eventual troubleshooting (not 100% efficient): 1. Update of systems for detection and limitation of SYN attacks. 2. Reducing the timeout ACK-SYN - but then it can happen that the users who have a slower connection will not be able to connect to the server. 3. Reservation of a larger amount of system resources for connection establishment - danger is reduced (sometimes, it can also lead to reduction of server´s performance).

3. LAND Attack

The Land Attack is a variation of the SYN Flood attack. A Land Attack is performed by launching TCP/IP packets with the same source and destination IP address and port. Most OS and devices are protected and so the attack is ineffective. If there is no protection used, the system will collapse.

4. Teardrop (fragmentation attack)

This type of denial of service attack utilises the weakness of the datagram fragmentation in the IP protocol. The datagrams travel on the Internet and go through many routers that can differ in the MTU (Maximum Transmittion Unit) value for the maximum datagram size. If the datagram goes through a router with a smaller MTU than for which it has been created for it is divided (fragmented) into several small fragments. They are distinguished by offsets (Fragment Offsets). The offset defines how many bytes were inputted to the previous fragmented datagram. Practically, 1. datagram offset = 0, 2. datagram offset = 1400, 3. datagram offset = 2800,... Teardrop generates packets where the offsets of particular datagrams are overlapping, and when the target system tries to reassemble the datagram, it collapse or reboot. This type of attack has also been around for some time and most operating system vendors have patches available to guard against this sort of malicious activity.
There also exist adjusted variations of the Teardop attacks: Boink, Newtear, SynDrop.

5. Smurf (Fraggle)

The Smurf attack is similar to the Ping of Death attack, but the Smurf attack is more malicious.
The perpetrator sends a large amount of ICMP echo (ping) traffic at broadcast addresses, all of it having a spoofed source IP address of the target computer (usually in the same network). As the broadcast address is used, the datagram is sent to all systems in the subnet that are sending replies. Then the amount of traveling datagrams is so high (ICMP echo response) that it floods the target system. There are two victims - the network used for executing the attack and the target system to which the replies are sent (if the computer is not in the same subnet). The attack is most dangerous when hundreds of replies to one datagram are generated in hundreds of systems in the subnet.
To protect against the Smurf attack, the routers block receiving of broadcast messages from the Internet, or they block all broadcast messages. It also helps to use an appropriately configured Firewall. Directly in the operating system, the ICMP echo at broadcast addresses can be blocked or the ICMP echo messages can be blocked completely. The Internet Service provider can also set filters on the router.
Fraggle - a variation of the Smurf attack, the difference is in UDP packet genereting.

Distributed DoS - DDoS

The Distributed DoS uses similar techniques as the classical DoS, but the DDoS uses dozens, hundreds of even thousands of infiltrated computers for the attack. They are called zombie or daemons. Zombie is a program remote-controlled by the hacker or by infected systems called Masters, using three-level architecture. The zombie program can be installed to a computer in several ways - it can be installed together with a virus or upon penetration of a hacker to the system using tools automatizing this process. The user or owner of the computer usually does not know about the program and so the program waits for the hacker´s command or for a preset time to start the flooding of the target system.
The best known DDoS attack was realized in 2000 which caused that the gratest servers like Yahoo, CNN.com, eBay and some others got stuck.

Best-known tools:

TFN (Tribal Flood Network)

Created by a hacker nicknamed Mixter. He used a two-level architecture with a client and agents. The TFN offers a wide range of classical DoS attacks - Ping of Death, Smurf, SYN Flood, especially for Unix servers.

Trinoo (Trin00)

An easy program for the UDP Flood attack with unencrypted communication. Unlike the TFN, it uses three-level architecture with a client, several master computers and many remote-controlled computers flooding the target system with the UDP packets, generating various UDP port numbers.
Ports used for communication:1524 tcp , 27665 tcp , 27444 udp , 31335 udp

TFN2K (Tribal Flood Network 2000)

Improved TFN. The TFN2K adds some new attacks. It uses an encryption algorithm Base65 and random ports for the communication between the client and the server (zombie / daemons). This tool can be used for Unix and also for Windows. The TFN2K also supports a large amount of attacks.

Stacheldraht

The tool called "barbed wire" is based on TFN and Trinoo. Here, encryption is used for communication between masters and clients. It uses various types of attacks. A very strong new feaure of this tool is the auto-update of clients when a newer version is available.

DRDoS (Distributed Reflection Denial of Service)

New form of a SYN attack. Here, an attacker broadcasts the target´s IP address to hundrends or thousands of Internet devices requesting a SYN connection. These device respond to the target IP address with ACK packets and so floods the access line. As the connection is not initiated, the target computer thinks the reqeusts were lost in cyberspace and so sends another packets which leads to the flood. There are many different addresses that cannot be filtered so easily and the filtering of packets would rapidly lower the accessibility of the server.

Protection

The protection depends on the type of attack.
Update - It is important to update the firmware in routers and in other network elements. The operating systems and other SW require updates because they contain solutions of some problems and often bring new features.
Quality and well-configured routers. Many companies have the tools protecting from the attacks built in the routers or in the systems, but they often even do not know that and rarely know how to configure them. The router should meet the requirements and recommendations of RFC 2827 and 2644, and should use filters for private networks (RFC 1918).
Ingress Filtering (RFC 2827) - is a process of examining all of the packets entering a subnet through a router and dropping the packets that are not allowed. The availability of the source IP address is checked trhough the interface from which it comes. Packets with spoofed IP address are ignored. The filtering´s task is to prevent from attacks using the packets that contain spoofed source IP addresses used in internal subnets or on private networks.
Egress Filtering - is a process of examining all packets leaving your network through a router. If the source address is illegal, the packets are ignored. The filter should limit the danger of exploiting the network. The filter cannot be used for checking the spoofed internal addresses, so the Ingress Filtering is more frequently used.
Firewall - Permissions can be set up for certain ports and the ICMP packet can be limited or completely banned.
Anti-virus programs - Protection against viruses and against installations of unauthorized programs.
Disconnection of the system from the network - Sometimes there is no other choice than to temporarily disconnect the system from the network and to pray. It is necessary to quickly make steps to reduce the effects of the attack and connect the system to the network again.
IDS (Intrusion Detection System) - IDS examines all packets and checks if they are not used for an attack or for other illegal activity. The IDS is sometimes being confused with Firewall, but IDS is rather its extension. The Firewall itself usually only allows or block access according to certain rules. The IDS informs you in case there suspiciously increases the amount of SYN packets on the network ( / computer) or if there is a large amount of SYN packets using a lot of ports because both can denote an attack or system scanning. The principle is to detect abnormal (unusual) activities (e. g. unusually great traffic, great consumption of system resources,..) or to detect the best known attacks. It can be setup in the IDS that if there is an attack detected, a warning is sent and the Firewall is reconfigured.

Notes

To scan the Windows system for eventual DoS attacks, use this command: netstat -n -p tcp. If the system is attacked, there appear a lot of connections having this status: SYN_RECEIVED.
In Windows, when you are attacked, you can open the protocol (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ Tcpip\Parameters) and change the recorded changes in keys: SynAttackProtect, TcpMaxConnectResponseRetransmissions, TcpMaxHalfOpen, or to make some other changes in the system configuration.
In most attacks, spoofed IP addresses are used - either to intensify the effects of the attack or to hide attacker´s identity, so it is not easy to catch the perpetrator.
The attacks are only dangerous for some systems. Different systems react variously (it depends on the OS, application or router). Example: a line or a mail server can get flooded with a huge amount of messages.
You can also use special programs for computer remote control in local or remote network. These programs are usually designed for certain security holes or for universal port scanning (e. g. NMap - www.insecure.org/nmap ). These tools are designed for administators, but they are also used by hackers. .