1 1 00:00:00,320 --> 00:00:02,320 Denial of service attacks. 2 2 00:00:02,320 --> 00:00:05,150 In this lesson, we're going to discuss a network-based attack 3 3 00:00:05,150 --> 00:00:07,640 that you may come across while working in the field. 4 4 00:00:07,640 --> 00:00:11,040 This is known as a denial of service. or DoS, attack. 5 5 00:00:11,040 --> 00:00:12,580 Now a denial of service occurs 6 6 00:00:12,580 --> 00:00:15,420 when one machine is continually flooding a victim 7 7 00:00:15,420 --> 00:00:17,080 with requests for services. 8 8 00:00:17,080 --> 00:00:19,550 That victim's system simply won't be able to keep up 9 9 00:00:19,550 --> 00:00:22,330 and so it'll run out of memory and eventually crash. 10 10 00:00:22,330 --> 00:00:24,140 For example, if I have a workstation 11 11 00:00:24,140 --> 00:00:25,670 that begins to send 10 or 20 12 12 00:00:25,670 --> 00:00:27,910 or 30 different packets of information at once 13 13 00:00:27,910 --> 00:00:29,420 to a low-powered server, 14 14 00:00:29,420 --> 00:00:31,690 that server may be able to crash 15 15 00:00:31,690 --> 00:00:34,050 because it won't be able to handle all those requests. 16 16 00:00:34,050 --> 00:00:35,410 Now, this was a big problem 17 17 00:00:35,410 --> 00:00:38,250 when we're dealing with networks 10 or 20 or 30 years ago, 18 18 00:00:38,250 --> 00:00:39,650 but since that time, 19 19 00:00:39,650 --> 00:00:42,160 computers and servers have gotten much faster 20 20 00:00:42,160 --> 00:00:44,730 and so it is now very difficult for one computer 21 21 00:00:44,730 --> 00:00:47,210 to cause a denial of service all by itself 22 22 00:00:47,210 --> 00:00:49,640 by being able to send enough traffic to a server. 23 23 00:00:49,640 --> 00:00:51,850 But it is important to understand this concept 24 24 00:00:51,850 --> 00:00:53,400 from a historical perspective 25 25 00:00:53,400 --> 00:00:56,310 because what is old tends to become new again over time 26 26 00:00:56,310 --> 00:00:57,500 when it comes to network attacks 27 27 00:00:57,500 --> 00:00:59,070 and protecting ourselves from them. 28 28 00:00:59,070 --> 00:01:01,840 To achieve a denial of service attack with a single machine, 29 29 00:01:01,840 --> 00:01:04,580 attackers are going to use either a TCP SYN flood 30 30 00:01:04,580 --> 00:01:06,510 or an ICMP flood. 31 31 00:01:06,510 --> 00:01:08,760 A TCP SYN flood is a specific type 32 32 00:01:08,760 --> 00:01:11,240 of denial of service attack that occurs when an attacker 33 33 00:01:11,240 --> 00:01:13,270 initiates multiple TCP sessions 34 34 00:01:13,270 --> 00:01:15,750 but they never complete those sessions. 35 35 00:01:15,750 --> 00:01:18,110 So remember, TCP operates 36 36 00:01:18,110 --> 00:01:19,830 by conducting a three-way handshake 37 37 00:01:19,830 --> 00:01:21,500 to establish communication. 38 38 00:01:21,500 --> 00:01:23,810 This happens by the requester first sending a packet 39 39 00:01:23,810 --> 00:01:25,350 with a SYN flag set. 40 40 00:01:25,350 --> 00:01:27,230 Then the server sends back a packet 41 41 00:01:27,230 --> 00:01:29,460 with both the SYN and the ACK flag set. 42 42 00:01:29,460 --> 00:01:31,330 And finally that server sits there 43 43 00:01:31,330 --> 00:01:34,060 and waits for the client to send back a final packet 44 44 00:01:34,060 --> 00:01:35,720 with just the ACK flag set 45 45 00:01:35,720 --> 00:01:37,600 and this will complete the handshake. 46 46 00:01:37,600 --> 00:01:40,000 Well, in a TCP SYN flood attack, 47 47 00:01:40,000 --> 00:01:42,300 the attacker sends a bunch of requests to the server 48 48 00:01:42,300 --> 00:01:43,760 to establish those connections 49 49 00:01:43,760 --> 00:01:45,950 by sending out the first part of the handshake. 50 50 00:01:45,950 --> 00:01:48,900 Those packets will just have the SYN flag set. 51 51 00:01:48,900 --> 00:01:52,020 The server will then respond and reserve some resources 52 52 00:01:52,020 --> 00:01:55,030 like network capacity or memory for each of the requests 53 53 00:01:55,030 --> 00:01:56,720 and it sends back the packet 54 54 00:01:56,720 --> 00:01:59,690 that has SYN and ACK flags both being set. 55 55 00:01:59,690 --> 00:02:00,690 Now up to this point, 56 56 00:02:00,690 --> 00:02:03,790 everything is operating like a normal TCP handshake, right? 57 57 00:02:03,790 --> 00:02:05,960 But instead of the attacker acknowledging 58 58 00:02:05,960 --> 00:02:07,380 that SYN ACK packet, 59 59 00:02:07,380 --> 00:02:09,280 they're not going to send back an ACK packet. 60 60 00:02:09,280 --> 00:02:11,280 Instead, they're just going to ignore it 61 61 00:02:11,280 --> 00:02:14,270 and so we end up with a bunch of these half-open connections 62 62 00:02:14,270 --> 00:02:16,400 that are consuming resources on the server. 63 63 00:02:16,400 --> 00:02:18,570 If you have too many of these half-open connections, 64 64 00:02:18,570 --> 00:02:20,020 you could overwhelm the server 65 65 00:02:20,020 --> 00:02:21,730 and therefore you could crash it 66 66 00:02:21,730 --> 00:02:24,180 through this process of resource exhaustion. 67 67 00:02:24,180 --> 00:02:25,780 To execute this type of an attack, 68 68 00:02:25,780 --> 00:02:28,210 the attacker is usually going to spoof their source IP 69 69 00:02:28,210 --> 00:02:30,370 when conducting their three-way handshake. 70 70 00:02:30,370 --> 00:02:32,850 This way, when they send the SYN packet over, 71 71 00:02:32,850 --> 00:02:36,100 the sever will respond with the SYN ACK to a spoofed IP 72 72 00:02:36,100 --> 00:02:37,900 and that person isn't expecting it 73 73 00:02:37,900 --> 00:02:39,610 and therefore they're not going to answer it 74 74 00:02:39,610 --> 00:02:41,400 and they're just going to drop that packet. 75 75 00:02:41,400 --> 00:02:43,250 This leaves the connection half open 76 76 00:02:43,250 --> 00:02:44,560 for the default length of time 77 77 00:02:44,560 --> 00:02:46,640 until the server closes that connection. 78 78 00:02:46,640 --> 00:02:48,910 Normally this will be around three minutes. 79 79 00:02:48,910 --> 00:02:50,980 So in that three-minute period, 80 80 00:02:50,980 --> 00:02:53,520 you can get a lot of these half-open connections 81 81 00:02:53,520 --> 00:02:54,910 and if you get too many of them, 82 82 00:02:54,910 --> 00:02:57,580 it will be resource exhaustion on that server 83 83 00:02:57,580 --> 00:02:59,300 that could cause it to crash. 84 84 00:02:59,300 --> 00:03:00,930 You could see an example of that here 85 85 00:03:00,930 --> 00:03:03,400 with four different spoofed IPs being sent to the server 86 86 00:03:03,400 --> 00:03:04,560 by the attacker. 87 87 00:03:04,560 --> 00:03:07,680 Now, when the server sends back its responses to those IPs, 88 88 00:03:07,680 --> 00:03:09,550 which never respond because they weren't starting 89 89 00:03:09,550 --> 00:03:11,120 a three-way handshake after all, 90 90 00:03:11,120 --> 00:03:13,100 that server is now just going to sit there 91 91 00:03:13,100 --> 00:03:15,760 and wait with a bunch of half-open connections. 92 92 00:03:15,760 --> 00:03:17,190 To help you remember this concept, 93 93 00:03:17,190 --> 00:03:19,940 I think there's a good analogy that I can give you here. 94 94 00:03:19,940 --> 00:03:21,370 Let's pretend that you have some kids, 95 95 00:03:21,370 --> 00:03:22,203 and if you have kids, 96 96 00:03:22,203 --> 00:03:24,000 you're probably going to relate well to this. 97 97 00:03:24,000 --> 00:03:25,760 Now, when my kids were really little, 98 98 00:03:25,760 --> 00:03:27,880 my wife would sometimes get really stressed out 99 99 00:03:27,880 --> 00:03:29,370 and overwhelmed by them. 100 100 00:03:29,370 --> 00:03:31,140 This would occur because both kids would try 101 101 00:03:31,140 --> 00:03:33,120 to get her attention at one time. 102 102 00:03:33,120 --> 00:03:35,510 For example, my two kids would go running over to her 103 103 00:03:35,510 --> 00:03:37,807 and go, "hey, Mommy, Mommy, Mommy, I have a question. 104 104 00:03:37,807 --> 00:03:39,597 "Mommy, Mommy, Mommy, I want a snack. 105 105 00:03:39,597 --> 00:03:40,830 "Mommy, Mommy, Mommy!" 106 106 00:03:40,830 --> 00:03:42,080 And things like that. 107 107 00:03:42,080 --> 00:03:44,080 Now, if one of the kids did this to Mom, 108 108 00:03:44,080 --> 00:03:44,913 Mom could handle it. 109 109 00:03:44,913 --> 00:03:46,950 She can take care of one kid with no issues. 110 110 00:03:46,950 --> 00:03:48,750 But if both of them did at the same time, 111 111 00:03:48,750 --> 00:03:51,310 she would have to balance her efforts between the two kids. 112 112 00:03:51,310 --> 00:03:53,190 And so if my kids had a few friends over 113 113 00:03:53,190 --> 00:03:54,630 and now we have five or six kids 114 114 00:03:54,630 --> 00:03:56,770 who are asking for Mom's attention all at once, 115 115 00:03:56,770 --> 00:03:59,720 she could quickly become overwhelmed and crash. 116 116 00:03:59,720 --> 00:04:01,920 And that is using the terminology of an overloaded server, 117 117 00:04:01,920 --> 00:04:03,240 but you get the idea. 118 118 00:04:03,240 --> 00:04:05,370 Basically she could become exhausted 119 119 00:04:05,370 --> 00:04:06,760 and she wouldn't be able to function anymore 120 120 00:04:06,760 --> 00:04:08,580 and answer all their queries. 121 121 00:04:08,580 --> 00:04:11,150 This is basically a denial of service. 122 122 00:04:11,150 --> 00:04:13,390 Now another form of denial of service attack we have 123 123 00:04:13,390 --> 00:04:15,000 is known as a smurf attack 124 124 00:04:15,000 --> 00:04:16,980 and, again, this is an older type of attack. 125 125 00:04:16,980 --> 00:04:19,120 It's known as an ICMP flood. 126 126 00:04:19,120 --> 00:04:20,950 This occurs against the victim's server 127 127 00:04:20,950 --> 00:04:24,240 by using ICMP traffic instead of TCP traffic. 128 128 00:04:24,240 --> 00:04:27,080 An ICMP flood occurs when an attacker sends a ping 129 129 00:04:27,080 --> 00:04:30,340 to a subnet broadcast address with the source IP spoofed 130 130 00:04:30,340 --> 00:04:32,540 and that source IP is now going to be showing 131 131 00:04:32,540 --> 00:04:34,110 as the victimized server. 132 132 00:04:34,110 --> 00:04:36,500 By doing this, all of the devices on that subnet 133 133 00:04:36,500 --> 00:04:38,260 are going to respond back to the server 134 134 00:04:38,260 --> 00:04:40,900 and this can start using up all their processing power, 135 135 00:04:40,900 --> 00:04:42,510 their memory, and their bandwidth, 136 136 00:04:42,510 --> 00:04:44,320 and this could lead to resource exhaustion 137 137 00:04:44,320 --> 00:04:46,370 and, again, a possible server crash. 138 138 00:04:46,370 --> 00:04:49,090 In this example, an attacker spooks their source address 139 139 00:04:49,090 --> 00:04:51,010 and pretends that they are the server. 140 140 00:04:51,010 --> 00:04:53,340 Now, this attacker sends out a single packet 141 141 00:04:53,340 --> 00:04:58,040 to the subnet broadcast address of 192.168.1.255 142 142 00:04:58,040 --> 00:05:02,020 And it says, Hey, I'm the server at 10.1.1.2. 143 143 00:05:02,020 --> 00:05:04,950 Now in response to this, all the clients in the broadcast, 144 144 00:05:04,950 --> 00:05:05,783 in this example, 145 145 00:05:05,783 --> 00:05:08,900 a class C subnet with up to 254 clients on it, 146 146 00:05:08,900 --> 00:05:11,470 will start sending back a response to that server 147 147 00:05:11,470 --> 00:05:13,900 since they all saw the source IP of this request 148 148 00:05:13,900 --> 00:05:16,380 as that of the server and not the attacker. 149 149 00:05:16,380 --> 00:05:19,080 This essentially is going to amplify the denial of service 150 150 00:05:19,080 --> 00:05:20,270 against the server 151 151 00:05:20,270 --> 00:05:23,230 because the attacker can now speed up this process even more 152 152 00:05:23,230 --> 00:05:25,100 by sending out more of these requests. 153 153 00:05:25,100 --> 00:05:27,380 They can send the same type of requests over and over 154 154 00:05:27,380 --> 00:05:28,800 to multiple different subnets 155 155 00:05:28,800 --> 00:05:30,800 and they can use different broadcast addresses 156 156 00:05:30,800 --> 00:05:32,610 to get all these things amplified back 157 157 00:05:32,610 --> 00:05:34,140 towards that first victim. 158 158 00:05:34,140 --> 00:05:35,130 Now, because of this threat 159 159 00:05:35,130 --> 00:05:37,560 of a denial of service using ICMP traffic, 160 160 00:05:37,560 --> 00:05:40,000 which is the same traffic that's used by the ping tool, 161 161 00:05:40,000 --> 00:05:42,310 a lot of networks will block providing responses 162 162 00:05:42,310 --> 00:05:43,220 to ping requests 163 163 00:05:43,220 --> 00:05:46,420 and instead they'll just drop or ignore these requests. 164 164 00:05:46,420 --> 00:05:47,450 For this reason, 165 165 00:05:47,450 --> 00:05:50,140 ICMP floods are not as common as they used to be, 166 166 00:05:50,140 --> 00:05:52,120 but if you misconfigured your network, 167 167 00:05:52,120 --> 00:05:54,130 it still could be a viable attack method 168 168 00:05:54,130 --> 00:05:56,240 for an attacker to use on your network. 169 169 00:05:56,240 --> 00:05:57,980 All right, let's take this concept 170 170 00:05:57,980 --> 00:06:00,110 of a denial of service one step further 171 171 00:06:00,110 --> 00:06:02,010 and add more attacking machines 172 172 00:06:02,010 --> 00:06:04,460 that are focused on overwhelming a single server 173 173 00:06:04,460 --> 00:06:05,810 all at the same time. 174 174 00:06:05,810 --> 00:06:08,280 This is known as a distributed denial of service, 175 175 00:06:08,280 --> 00:06:10,180 or DDoS attack. 176 176 00:06:10,180 --> 00:06:12,420 Now, in a distributed denial of service attack, 177 177 00:06:12,420 --> 00:06:14,540 the attacker will use 100, 1,000, 178 178 00:06:14,540 --> 00:06:17,430 or even 100,000 computers all at the same time 179 179 00:06:17,430 --> 00:06:20,020 asking for access to a single server. 180 180 00:06:20,020 --> 00:06:21,500 This way they can consume up 181 181 00:06:21,500 --> 00:06:23,000 all of that server's processing, 182 182 00:06:23,000 --> 00:06:24,770 memory, and bandwidth resources, 183 183 00:06:24,770 --> 00:06:28,370 leading to that server exhaustion and a server crash. 184 184 00:06:28,370 --> 00:06:31,200 Now, often these machines can become part of the attack 185 185 00:06:31,200 --> 00:06:33,140 and they won't even know they're part of that attack 186 186 00:06:33,140 --> 00:06:35,400 because they are essentially part of a botnet 187 187 00:06:35,400 --> 00:06:37,680 and they're now being controlled as a zombie. 188 188 00:06:37,680 --> 00:06:40,520 A botnet is simply a collection of compromised computers 189 189 00:06:40,520 --> 00:06:42,950 under the control of a single master node. 190 190 00:06:42,950 --> 00:06:44,180 A zombie, on the other hand, 191 191 00:06:44,180 --> 00:06:47,210 is any one of these individually compromised computers. 192 192 00:06:47,210 --> 00:06:49,240 Once the device becomes part of a botnet, 193 193 00:06:49,240 --> 00:06:50,840 it can be controlled by a master node, 194 194 00:06:50,840 --> 00:06:54,120 known as a C2 or command and control server. 195 195 00:06:54,120 --> 00:06:56,120 An attacker who controls the C2 server 196 196 00:06:56,120 --> 00:06:58,410 will also control all the zombies that operate 197 197 00:06:58,410 --> 00:06:59,950 as part of this botnet. 198 198 00:06:59,950 --> 00:07:02,040 This isn't just a single computer anymore, 199 199 00:07:02,040 --> 00:07:04,870 but instead it could be hundreds of thousands of machines, 200 200 00:07:04,870 --> 00:07:06,610 all with the ability to be coordinated 201 201 00:07:06,610 --> 00:07:08,800 into attacking a single target. 202 202 00:07:08,800 --> 00:07:10,530 So when the attacker wants to launch 203 203 00:07:10,530 --> 00:07:12,340 a distributed denial of service attack 204 204 00:07:12,340 --> 00:07:14,410 against a website like the Wall Street Journal, 205 205 00:07:14,410 --> 00:07:16,400 they simply send a command from their computer 206 206 00:07:16,400 --> 00:07:17,670 to the C2 server 207 207 00:07:17,670 --> 00:07:20,520 and then the C2 server will then relay that command 208 208 00:07:20,520 --> 00:07:23,650 down to some or all of the zombies under its control. 209 209 00:07:23,650 --> 00:07:25,890 This allows them to conduct a massive attack 210 210 00:07:25,890 --> 00:07:28,340 that can even take down some really large websites 211 211 00:07:28,340 --> 00:07:29,970 if they have enough zombies. 212 212 00:07:29,970 --> 00:07:31,540 Now, the challenge for an attacker here 213 213 00:07:31,540 --> 00:07:34,250 is that as more and more organizations move to the cloud, 214 214 00:07:34,250 --> 00:07:37,360 it becomes harder and harder to overwhelm their servers. 215 215 00:07:37,360 --> 00:07:40,070 After all, if you're using elastic cloud servers, 216 216 00:07:40,070 --> 00:07:41,810 you can simply horizontally scale out 217 217 00:07:41,810 --> 00:07:43,660 to answer up for all this new demand 218 218 00:07:43,660 --> 00:07:46,080 that's being sent to you from all these different zombies 219 219 00:07:46,080 --> 00:07:48,280 during a distributed denial of service attack. 220 220 00:07:48,280 --> 00:07:49,580 But that doesn't mean 221 221 00:07:49,580 --> 00:07:50,940 you shouldn't try to prevent these types 222 222 00:07:50,940 --> 00:07:53,290 of distributed denial of service attacks from happening. 223 223 00:07:53,290 --> 00:07:55,310 After all, with cloud-based resources, 224 224 00:07:55,310 --> 00:07:57,160 you're still paying for all that compute 225 225 00:07:57,160 --> 00:07:59,260 and bandwidth resources that are being used 226 226 00:07:59,260 --> 00:08:01,570 to answer up for all these attacking requests, 227 227 00:08:01,570 --> 00:08:04,900 so even if you can withstand the attack and outlast it 228 228 00:08:04,900 --> 00:08:07,280 by horizontally scaling out on your servers, 229 229 00:08:07,280 --> 00:08:09,920 it could result in a huge bill at the end of the month 230 230 00:08:09,920 --> 00:08:11,050 and none of that bandwidth 231 231 00:08:11,050 --> 00:08:12,850 was actually doing anything useful for you 232 232 00:08:12,850 --> 00:08:15,470 because it wasn't from legitimate customers or users, 233 233 00:08:15,470 --> 00:08:17,440 it was just from people who were attacking you 234 234 00:08:17,440 --> 00:08:18,990 and you're still paying for it.