-: Denial of service attacks. 2 2
In this lesson, we're going to discuss a network-based attack 3 3
that you may come across while working in the field. 4 4
This is known as a denial of service. or DoS, attack. 5 5
Now a denial of service occurs 6 6
when one machine is continually flooding a victim 7 7
with requests for services. 8 8
That victim's system simply won't be able to keep up 9 9
and so it'll run out of memory and eventually crash. 10 10
For example, if I have a workstation 11 11
that begins to send 10 or 20 12 12
or 30 different packets of information at once 13 13
to a low-powered server, 14 14
that server may be able to crash 15 15
because it won't be able to handle all those requests. 16 16
Now, this was a big problem 17 17
when we're dealing with networks 10 or 20 or 30 years ago, 18 18
but since that time, 19 19
computers and servers have gotten much faster 20 20
and so it is now very difficult for one computer 21 21
to cause a denial of service all by itself 22 22
by being able to send enough traffic to a server. 23 23
But it is important to understand this concept 24 24
from a historical perspective 25 25
because what is old tends to become new again over time 26 26
when it comes to network attacks 27 27
and protecting ourselves from them. 28 28
To achieve a denial of service attack with a single machine, 29 29
attackers are going to use either a TCP SYN flood 30 30
or an ICMP flood. 31 31
A TCP SYN flood is a specific type 32 32
of denial of service attack that occurs when an attacker 33 33
initiates multiple TCP sessions 34 34
but they never complete those sessions. 35 35
So remember, TCP operates 36 36
by conducting a three-way handshake 37 37
to establish communication. 38 38
This happens by the requester first sending a packet 39 39
with a SYN flag set. 40 40
Then the server sends back a packet 41 41
with both the SYN and the ACK flag set. 42 42
And finally that server sits there 43 43
and waits for the client to send back a final packet 44 44
with just the ACK flag set 45 45
and this will complete the handshake. 46 46
Well, in a TCP SYN flood attack, 47 47
the attacker sends a bunch of requests to the server 48 48
to establish those connections 49 49
by sending out the first part of the handshake. 50 50
Those packets will just have the SYN flag set. 51 51
The server will then respond and reserve some resources 52 52
like network capacity or memory for each of the requests 53 53
and it sends back the packet 54 54
that has SYN and ACK flags both being set. 55 55
Now up to this point, 56 56
everything is operating like a normal TCP handshake, right? 57 57
But instead of the attacker acknowledging 58 58
that SYN ACK packet, 59 59
they're not going to send back an ACK packet. 60 60
Instead, they're just going to ignore it 61 61
and so we end up with a bunch of these half-open connections 62 62
that are consuming resources on the server. 63 63
If you have too many of these half-open connections, 64 64
you could overwhelm the server 65 65
and therefore you could crash it 66 66
through this process of resource exhaustion. 67 67
To execute this type of an attack, 68 68
the attacker is usually going to spoof their source IP 69 69
when conducting their three-way handshake. 70 70
This way, when they send the SYN packet over, 71 71
the sever will respond with the SYN ACK to a spoofed IP 72 72
and that person isn't expecting it 73 73
and therefore they're not going to answer it 74 74
and they're just going to drop that packet. 75 75
This leaves the connection half open 76 76
for the default length of time 77 77
until the server closes that connection. 78 78
Normally this will be around three minutes. 79 79
So in that three-minute period, 80 80
you can get a lot of these half-open connections 81 81
and if you get too many of them, 82 82
it will be resource exhaustion on that server 83 83
that could cause it to crash. 84 84
You could see an example of that here 85 85
with four different spoofed IPs being sent to the server 86 86
by the attacker. 87 87
Now, when the server sends back its responses to those IPs, 88 88
which never respond because they weren't starting 89 89
a three-way handshake after all, 90 90
that server is now just going to sit there 91 91
and wait with a bunch of half-open connections. 92 92
To help you remember this concept, 93 93
I think there's a good analogy that I can give you here. 94 94
Let's pretend that you have some kids, 95 95
and if you have kids, 96 96
you're probably going to relate well to this. 97 97
Now, when my kids were really little, 98 98
my wife would sometimes get really stressed out 99 99
and overwhelmed by them. 100 100
This would occur because both kids would try 101 101
to get her attention at one time. 102 102
For example, my two kids would go running over to her 103 103
and go, "hey, Mommy, Mommy, Mommy, I have a question. 104 104
"Mommy, Mommy, Mommy, I want a snack. 105 105
"Mommy, Mommy, Mommy!" 106 106
And things like that. 107 107
Now, if one of the kids did this to Mom, 108 108
Mom could handle it. 109 109
She can take care of one kid with no issues. 110 110
But if both of them did at the same time, 111 111
she would have to balance her efforts between the two kids. 112 112
And so if my kids had a few friends over 113 113
and now we have five or six kids 114 114
who are asking for Mom's attention all at once, 115 115
she could quickly become overwhelmed and crash. 116 116
And that is using the terminology of an overloaded server, 117 117
but you get the idea. 118 118
Basically she could become exhausted 119 119
and she wouldn't be able to function anymore 120 120
and answer all their queries. 121 121
This is basically a denial of service. 122 122
Now another form of denial of service attack we have 123 123
is known as a smurf attack 124 124
and, again, this is an older type of attack. 125 125
It's known as an ICMP flood. 126 126
This occurs against the victim's server 127 127
by using ICMP traffic instead of TCP traffic. 128 128
An ICMP flood occurs when an attacker sends a ping 129 129
to a subnet broadcast address with the source IP spoofed 130 130
and that source IP is now going to be showing 131 131
as the victimized server. 132 132
By doing this, all of the devices on that subnet 133 133
are going to respond back to the server 134 134
and this can start using up all their processing power, 135 135
their memory, and their bandwidth, 136 136
and this could lead to resource exhaustion 137 137
and, again, a possible server crash. 138 138
In this example, an attacker spooks their source address 139 139
and pretends that they are the server. 140 140
Now, this attacker sends out a single packet 141 141
to the subnet broadcast address of 192.168.1.255 142 142
And it says, Hey, I'm the server at 10.1.1.2. 143 143
Now in response to this, all the clients in the broadcast, 144 144
in this example, 145 145
a class C subnet with up to 254 clients on it, 146 146
will start sending back a response to that server 147 147
since they all saw the source IP of this request 148 148
as that of the server and not the attacker. 149 149
This essentially is going to amplify the denial of service 150 150
against the server 151 151
because the attacker can now speed up this process even more 152 152
by sending out more of these requests. 153 153
They can send the same type of requests over and over 154 154
to multiple different subnets 155 155
and they can use different broadcast addresses 156 156
to get all these things amplified back 157 157
towards that first victim. 158 158
Now, because of this threat 159 159
of a denial of service using ICMP traffic, 160 160
which is the same traffic that's used by the ping tool, 161 161
a lot of networks will block providing responses 162 162
to ping requests 163 163
and instead they'll just drop or ignore these requests. 164 164
For this reason, 165 165
ICMP floods are not as common as they used to be, 166 166
but if you misconfigured your network, 167 167
it still could be a viable attack method 168 168
for an attacker to use on your network. 169 169
All right, let's take this concept 170 170
of a denial of service one step further 171 171
and add more attacking machines 172 172
that are focused on overwhelming a single server 173 173
all at the same time. 174 174
This is known as a distributed denial of service, 175 175
or DDoS attack. 176 176
Now, in a distributed denial of service attack, 177 177
the attacker will use 100, 1,000, 178 178
or even 100,000 computers all at the same time 179 179
asking for access to a single server. 180 180
This way they can consume up 181 181
all of that server's processing, 182 182
memory, and bandwidth resources, 183 183
leading to that server exhaustion and a server crash. 184 184
Now, often these machines can become part of the attack 185 185
and they won't even know they're part of that attack 186 186
because they are essentially part of a botnet 187 187
and they're now being controlled as a zombie. 188 188
A botnet is simply a collection of compromised computers 189 189
under the control of a single master node. 190 190
A zombie, on the other hand, 191 191
is any one of these individually compromised computers. 192 192
Once the device becomes part of a botnet, 193 193
it can be controlled by a master node, 194 194
known as a C2 or command and control server. 195 195
An attacker who controls the C2 server 196 196
will also control all the zombies that operate 197 197
as part of this botnet. 198 198
This isn't just a single computer anymore, 199 199
but instead it could be hundreds of thousands of machines, 200 200
all with the ability to be coordinated 201 201
into attacking a single target. 202 202
So when the attacker wants to launch 203 203
a distributed denial of service attack 204 204
against a website like the Wall Street Journal, 205 205
they simply send a command from their computer 206 206
to the C2 server 207 207
and then the C2 server will then relay that command 208 208
down to some or all of the zombies under its control. 209 209
This allows them to conduct a massive attack 210 210
that can even take down some really large websites 211 211
if they have enough zombies. 212 212
Now, the challenge for an attacker here 213 213
is that as more and more organizations move to the cloud, 214 214
it becomes harder and harder to overwhelm their servers. 215 215
After all, if you're using elastic cloud servers, 216 216
you can simply horizontally scale out 217 217
to answer up for all this new demand 218 218
that's being sent to you from all these different zombies 219 219
during a distributed denial of service attack. 220 220
But that doesn't mean 221 221
you shouldn't try to prevent these types 222 222
of distributed denial of service attacks from happening. 223 223
After all, with cloud-based resources, 224 224
you're still paying for all that compute 225 225
and bandwidth resources that are being used 226 226
to answer up for all these attacking requests, 227 227
so even if you can withstand the attack and outlast it 228 228
by horizontally scaling out on your servers, 229 229
it could result in a huge bill at the end of the month 230 230
and none of that bandwidth 231 231
was actually doing anything useful for you 232 232
because it wasn't from legitimate customers or users, 233 233
it was just from people who were attacking you 234 234
and you're still paying for it.