Distributed DOS Attacks

DOS attacks are not new, in fact they have been aroun for a long time. However, there has been a recent wave of Distributed Denial of services attacks, which pose a great threat to security and are on the verge of overtaking Viruses/Trojans to become  the deadliest threat to Internet security.

In a distributed DOS Attack, a group of say, five hackers join and decide to bring a Fortune 500 company's server down. Now, each one of them breaks into a smaller less-protected network and takes control. So, now they have five networks and supposing there are around 20 systems in each network, it gives these hackers, around 100 systems in all to attack from. They now connect to the network, install a Denial of Service tool on the hacked networks and using these hacked systems launch attacks on the Fortune 500 company. This makes the hackers less easy to detect and helps them do what they wanted to do without getting caught. As they have full control over the smaller less-protected networks, they can easily remove all traces before the authorities get there.

Read More

UDP-flood attack

A UDP-flood attack typically exploits the target system's chargen or echo services to create an infinite loop between two or more UDP services. CERT describes UDP-flood attacks as follows:

When a connection is established between two UDP services, each of which produces output, these two services can produce a very high number of packets that can lead to a denial of service on the machine(s)where the services are offered. Anyone with network connectivity can launch an attack; no account access is needed.

For example, by connecting a host's chargen service to the echo service on the same or another machine, all affected machines may be effectively taken out of service because of the excessively high number of packets produced. In addition, if two or more hosta are so connected, the intervening network may also become congested and deny service to all hosts whose traffice traverses that network.

Countermeasure : To counteract a UDP-flood attack, it's a good idea to disable the chargen and echo services unless and until you really need them. In addition, try to disable as many other UDP services (which are not really important) as possible.

Read More

Land Attacks

A land attack is similar to a SYN attack, the only difference  being that instead of including an invalid IP address, the SYN packets include the IP address of the target system itself. More specifically, the source IP address and port number are identical to the destination IP address and port number. As a result, an infinite loop is created within the target system, which ultimately hangs and crashes.

Countermeasure :- The easiest way to protect your system against land attacks is to install a firewall or filtering utility that filters out outgoing packets whose destination IP address is the same as the IP address of the local system.

-------------------------------------------------------------------------------------------------------
Next Post   ------>>>   Smurf Attacks
-------------------------------------------------------------------------------------------------------

Read More

SYN-Flood Attacks

This post focuses on one of the most common and easiest to execute DOS attacks, known as SYN flooding. The idea behind SYN flooding is to flood the target system with connection requests from spoofed source addresses. As the target system tries to establish full connections with all these requests, its memory is hogged. As a result, the target system is unable to provide services to legitimate users or clients.

The further clarify, suppose you have a single telephone connection with 10 parallel lines --- that is, 10 lines with the same telephone number. If you use 10 different telephones to simultaneously dial this number, then all 10 parallel lines of the target connection will be used to answer your 10 calls. Even if a legitimate client is trying to call the number (which is under attack by you), he will not be able to get through. SYN flooding is like this, but even better; in the case of SYN flooding, the "calls" are made from a spoof source address, making it difficult (but not impossible) to trace.

How It Works

 SYN flooding works by exploiting the three-way handshake that occurs any time two systems across the network initiate a TCP/IP connection. Here's what happens in a tpical three-way handshake:

1. The source system (client) sends a SYN packet to the destination system (host).
2. The destination system replies with a SYN packet and acknowledges the source system's SYN packet by sending an ACK packet by sending an ACK packet.
3. The source system sends an ACK packet to acknowledge the SYN/ACK packet sent by the host.

 Only when these three steps are completed is a TCP/IP connection established between the  source system and the host.

More about SYN/ACK Packets

In a SYN-flooding attack, several SYN packets are sent to the target host, all with an invalid source IP address. When the target system receives these SYN packets, it tries to respond to each one with SYN/ACK packet, but because the source IP address in the original SYN packet is invalid, these SYN/ACK packets are simply sent into the void. Even so, the target host waits in vain for an ACK message from the source system, and as it does, additional requests with invalid IP addresses queue up behind the original once, and the whole cycle starts again. Eventually, due to the large number of connection requests, the target system's memory is consumed, and that system is therefore unable to cater to requests for information made by legitimate users.

In accordance with the rules of TCP/IP, the system will time out after a certain period of time has passed. when this happens, the connections requests queued up on the target system are discarded, thereby freeing a large part of the hogged-up memory. In a typical SYN-flood attack, however, the attacker sends connection requests from spoofed addresses more quickly than the earlier connection requests can be timed out. Because the attacker continuously sends more and more connection requests, the target system's memory is continuously consumed.

Countermeasure  1 :- In order to actually affect the target system, a large number of SYN packets with invalid IP addresses must be sent.

Countermeasure  2 :- SYN flooding is commonly used in the process of IP spoofing. IP spoofing is discussed later in this chapter in the section titled  "IP spoofing Attacks"

-------------------------------------------------------------------------------------------------------

-------->>      Detecting a SYN-Flood Attack

-------------------------------------------------------------------------------------------------------

Read More

Teardrop Attacks

Whenever data is sent over the Internet, it is broken into fragments at the source system and reassembled at the destination system. For example, suppose you need to send 4,000 bytes of data from one system to another. Rather than sending the entire chunk in a single packet, the data is broken down into smaller packets, each packet carrying a specified range of data like so:

• Packet 1 will carry bytes       1-1500.
• Packet 2 will carry bytes 1501-3000.
• Packet 3 will carry bytes 3001-4000.

Each packet has an Offiset field in its TCP header part that specifies the range of data (that is, the specific bytes of data) being carried by that particular data packet. This along with the value in the Sequence Number field, helps the desination system reassemble the data packets in the correct order.

In a teardrop attack a series of data packets is sent to the target system with overlapping Offer field values. As a result, the target system cannot reassemble the packets and is forced to crash, hang, or reboot.

Still not quite clear on how this works? Let's examine how a system receives data packets under normal circumstances. (Note that the underscore character ( _ ) equals one data packet.) As you can see here, no bytes overlap between packets:

- - - - - - - - - - - -
(Bytes 1-1500) (Bytes 1501-3000) (Bytes 3001-4500)

In a teardrop attack, however, the data packets sent to the target computer contain bytes that overlap with each other:

- - - - - - - - - - - - -
(Bytes 1-1500) (Bytes 1501-3000) (Bytes 1001-3600)

When the target system receives a series of packets like the one shown here, it cannot reassemble the data and, therefore, will crash, hang or reboot.

Countermeasure :-  To protect your system from teardrop attacks, make sure you have the latest patches from your vendor, For more information about these types of attacks and the countermeasures you can take.

-------------------------------------------------------------------------------------------------------
Next Post   ---------->>>   SYN-Flood Attacks
-------------------------------------------------------------------------------------------------------

Read More

Ping of Death

The ping command makes use of the ICMP echo request and echo reply messages and is commonly used to determine whether the remote host is alive. In a Ping of Death attack, however, ping causes the remote system to hang, reboot, or crash. To do so, the attacker uses the ping command in conjunction with the -l argument (used to specify the size of the packet sent) to ping the target system with a data packet that exceeds the maximum bytes allowed by TCP/IP (65,536). For example, the following ping command creates a giant datagram  that is 65,540 bytes in size (the output follows):

C:\windows>ping -l 65540 hostname
Pinging hostname [xx.yy.tt.pp] with 65,540 bytes of data:

Reply from 203.94.243.71: bytes = 65540 time = 134ms TTL = 61
Reply from 203.94.243.71: bytes = 65540 time = 134ms TTL = 61
Reply from 203.94.243.71: bytes = 65540 time = 134ms TTL = 61
Reply from 203.94.243.71: bytes = 65540 time = 134ms TTL = 61

Countermeasure :- Fortunately, nearly all systems these days are not vulnerable to the Ping of Death. Unless you are running an ancient system with an equally ancient operating system, you are almost sure to be protected from this type of DOS attack. To make sure that your software is patched, however, visit your vendor's Web site and check.

-------------------------------------------------------------------------------------------------------
Next Post   ------>>>   Teardrop Attacks
-------------------------------------------------------------------------------------------------------

Read More

DOS attacks

A denial of service (DOS) attack is an attack that clogs up so much memory on the target system that it cannot serve its users, or it causes the target system to crash, reboot, or otherwise deny services to legitimate users. These days, DOS attacks are very common; indeed, just about every server is bound to experience such an attack at some time or another.
There are several different kinds of DOS attacks, the most popular of which are follows:

• Ping of Death
• Teardrop attacks
• SYN-flood attacks 
• Land attacks
• Smurf  attacks
• UPD-flood attacks
• Distributed DOS attacks
• Modem-disconnect attacks

Read More