DoS/DDoS attack essentials 101

First, off lets begin by understanding the intent of DoS(Denial of Service) attack.             
              Intent of DoS is to make the webserver unavailable for legitimate traffic from hosts trying to access resources from the webserver. So essentially, it makes a service unavailable to legitimate users.

Now, lets understand how DoS can be carried out. What are the different ways?

1. ICMP flooding via Ping

          ICMP is an internet layer protocol used by network devices to communicate. An ICMP request requires some server resources to process each request and to send a response.  By sending many ICMP requests from many hosts, an attacker can exhaust the webserver's network resources by overwhelming it with bogus traffic, since it tries to respond to all ICMP requests.



For more info on the same, refer to below link
https://www.cloudflare.com/learning/ddos/ping-icmp-flood-ddos-attack

2. HTTP requests to web server
                    Essentially, this is a layer 7 technique which overwhelms the webserver with tons of HTTP requests simulated from bots. The attack type could be either HTTP GET or HTTP POST.
In HTTP GET flood attack, bots request for many files, images, etc and inundate the target webserver.
In HTTP POST, bots submit many forms. The webserver has to push data to the database for achieving persistence and this process takes some time. By sending more POST requests to the target than it can handle, bots inundate the webserver. 


For more info, refer to the following link
https://www.cloudflare.com/learning/ddos/http-flood-ddos-attack/

Essentially what is the difference between DoS and DDoS?
         DoS originates from a single source, where DDoS originates from a cluster of computers(botnets) that are infected by an attacker's malware.
Nowadays, single origin DOS attacks are detected easily by firewall.

How is DDoS implemented?
              To answer this question, we need to understand the intent for launching a DDoS attack.
Was it launched to exhaust the target computer's resources or was it intended to exhaust the network resources?
An example each for both : 
1. HTTP request flooding exhausts computer's resources(10k requests per second)
2. SYN flooding exhausts network resources(unacknowledged packets)
SYN flooding exploits the TCP Connection Handshake principle. A bot spoofs an IP address and sends SYN packet. The server responds with a SYN-ACK and waits for an ACK from the source(here, the bot). But the bot keeps the server waiting and never responds. The server waits with a port listening for an ACK and a half open connection.
The bot repeatedly spoofs IP addresses and exhausts the target's network resources over time.


For more info on SYN flooding, please refer to the link below
https://www.cloudflare.com/learning/ddos/syn-flood-ddos-attack/
That's it for today folks. We will be back with more interesting content on Denial of Service.


The next post will elaborate on other ways to implement DDoS/DoS attack and some countermeasures for the attack.

Comments

Post a Comment

Popular posts from this blog

Day 12: Master Slave SDN Controller Architecture

In the previous post, I was struggling to figure out why all controllers can install flows in all switches irrespective of the code. Well, today the mystery is getting resolved. I found this book that explains beautifully the various roles that a controller can play. The three roles are: Equal : this happens by default all the equal controllers in a network that are connected to the switch can add and delete flows from it Slave: it has a read-only limitation to the switch openflow tables Master: very similar to the switch, but only 1 master can be connected to the switch at that point of time, and no other flows can intercept the communication between switch and master. I highly recommend you go through the above link to get a better picture. Since the default role of any controller is "Equal", we couldn't really differentiate between the three controller flows yesterday. But one good news from this is that we don't really need extensive coding to assi...
Read more

Day 1: Understanding Ransomware and how to detect them?

Image
To start this journey, let’s begin at the basics and learn about what ransomwares are, what is the meaning of a ransomware attack, how have other people detected it so far? By learning the above, we will be in a position to analyze any ransomware attack and devise methods to detect, mitigate and prevent them. Definition: Ransomware is a type of malicious software from cryptovirology that threatens to publish the victim's data or perpetually block access to it unless a ransom is paid. To continue understanding and addressing the threats posed by ransomware, let us dig a little deeper. As the definition specifies, ransomware is a type of malicious software. Now, what is a malicious software? Definition: Malware (= Malicious + Software) is a software which is specifically designed to disrupt, damage, or gain authorized access to a computer system. These malwares (or simply dangerous content that can corrupt your system), can enter your system from various s...
Read more

Day 50: Tcpreplay and tcpliveplay approach

Today we shall be exploring how to copy and redirect the OpenFlow packets to more than one controller from the load balancer. The load balancer is anyway sending the OpenFlow packets to one of the slave controllers - c1 or c2. The packets sent to these two controllers needs to be sent to master controller so the master controller can update the new flows added by c1 or c2 on the switches. This ensures synchronization between controllers. There are two implementation methods to achieve the same: Copy all packets generated from the load balancer to the controller side. Only the packets having destination IP address of c1 and c2 can be redirected to the master controller. Thus we can prevent the packets which already are reaching the master controller to be sent as duplicates Copy and redirect packets from the slave controllers - c1 and c2. We need not take care of duplicate packets reaching master controller. This will reduce the time taken to redirect packets. Since the second a...
Read more