In this lesson, we're going to focus
on the concept of distributed denial of service attack.
Now, a denial of service attack isn't a specific attack
in and of itself, but instead is this category
or type of attack
that's carried out in a number of different ways.
Essentially, the term denial
of service is used to describe any attack
which attempts to make a computer
or servers resources unavailable
but it can also be extended to network devices
like switches and routers as well.
The first category is called a flood attack.
This is a specialized type of denial of service
which attempts to send more packets
to a single server or host than it can handle.
So in this example, we see an attacker sending 12 requests
at a time to a server.
Now, normally a server wouldn't be overloaded
with just 12 requests, but if I could send 1200 or 12,000
that might allow me to flood that server and take it down.
Now, under a flood attack,
we have a few different specialized varieties.
The first is called a ping flood.
This attack is going to happen when somebody attempts
to flood your server by sending too many pings.
Now, a ping is technically an ICMP echo request packet
but they like to call it a ping on the exam.
Because a ping flood has become so commonplace though,
many organizations are now simply
blocking echo replies
and simply having the firewall dropping these requests
whenever they're received.
This results in the attacker simply getting
a request timeout message
and the server remains online
and the denial of service is stopped.
The next flood attack we're going to cover is a SYN flood.
Now, this attack is a variant
on a denial of service attack where the attacker's
going to initiate multiple TCP sessions
but never complete the three-way handshake.
You could see here how the attacker is sending
four SYN packets to the server
but they're using made up IP addresses.
The server then replies to those IP addresses
in an attempt to establish that three-way handshake.
But of course, the other people weren't expecting that call
and so no one responds.
This causes the server to set
aside resources for these supposed clients.
Well awaits for their response and acknowledgement
but the acknowledgement never comes.
If the attacker creates enough requests,
the server will simply run out of resources
and be unable to establish any real connections
with those who really want to do business with the server.
And this creates the denial of service condition.
To prevent this from occurring,
flood guards can be installed in the network.
These devices will detect when a SYN flood
is being attempted, and it'll block the requests
at the network boundary, freeing up the server.
Flood guards can also be a feature
in some routers and firewalls as well.
Also, your server can be configured
to time out on those half open requests
after a period of time, say 10, 15, or 30 seconds
and this will free up those resources and prevent
the denial of service condition from happening too.
Intrusion prevention systems also have the ability to detect
and respond to SYN floods as they're being attempted.
So now that we've covered the different types
of flood attacks, let's move on to our next category.
The permanent denial of service attack or PDoS.
This is an attack which exploits a security flaw
to permanently break a networking device
by re-flashing its firmware.
This can cause a device to be unable to reboot itself
because its operating system is overwritten.
It's also called a permanent denial of service attack
because a quick reboot won't bring the system back online.
Instead, the device has to be taken offline,
have a full firmware reload done
and then it can be brought back online.
Finally, we have our last one, the fork bomb.
With a fork bomb,
the attacker creates a large number of processes
to use up available processing power of a computer.
This attack gets its name
because a process is called a fork, and it can be forked
into two processes and then four processes
and so on until it eats up all the resources.
Now, some people think of this
as a worm because of the self-replicating nature
but they're not a worm because they don't infect programs
and they don't use the network to spread.
Instead, fork bombs only spread out
inside the processor's cache on a single computer
that it's being attacked with, and it causes a denial
of service attack and a denial of service condition
which is why it's considered not to be a worm.
Now, there are new denial of service attacks
being dreamt up all of the time.
Basically for the exam though,
if an attack causes a system to go offline
and it stop providing the service that it's really
supposed to do to its real users
or it can permanently cause a system to be broken,
this could be categorized as a denial of service condition.
Now, we discussed the concept of a denial of service attack.
We went over all of the different types of them
but most moderate systems can't be taken down
by a single machine attempting a denial of service anymore.
So attackers got smarter
and they created a distributed denial of service or DDoS.
Now a distributed denial of service attack,
instead of using a single attack targeting one server,
they use hundreds or even thousands
of machines to launch an attack simultaneously
against a single server and force it offline
to create that denial of service condition.
Usually these machines that conduct the attack
don't even realize that they're a part of it though.
Generally, these machines have become zombies
or bots inside a large botnet
and then when they receive that command to attack,
they all simultaneously send all
of their payloads against a single victim.
Now, in addition to most basic forms of DDoS attacks,
there is one specific type of DDoS attack
called a DNS Amplification Attack that could be performed.
This specialized DDoS allows an attacker
to generate a high volume
of packets that's intended to flood a victim's website
by initiating DNS requests
from a spoof version of the target's IP address.
This causes the DNS servers to respond
to that request and send the response back
to the server thinking that it's valid.
Because the DNS request uses very little bandwidth to send
but the response usually takes up a lot more bandwidth.
This allows the attack to be amplified
against the victim server.
Also, if this is happening because thousands
of simultaneous requests are being made by a bunch
of zombies in a botnet on behalf of your victim server,
you can easily become overwhelmed with a lot of information
and eat up lots of bandwidth pretty quickly
causing that denial of service condition to occur.
We talked about a denial of service attack
involving the continual flooding
of a victim system with request for services
that causes a system to crash and run out of memory.
Now this all usually happens when you're talking
about one system attacking one system
but that wasn't enough with modern computers.
So we moved up to the distributed denial of service attack
where hundreds or thousands
of people target a single server to take it down.
Now, in March of 2018, the website GitHub was actually hit
by the largest DDoS that we've clocked to date.
This is where tens of thousands
of unique endpoints conducted a coordinated attack to
hit that server with a spike in traffic,
and the spike in traffic went up to 1.35
terabits per second.
This took the website offline for all of five minutes.
So you can see how these DDoSs are really hard
on a server and can take them down
but not for very long if you can stop 'em.
So your real question probably is how can you survive
one of these attacks and how can you prevent it
from taking down your organization's servers?
Well, we have a couple of techniques.
The first one is called blackholing or sinkholing.
This technique identifies attacking IP addresses
and routes all of their traffic
to a non-existent server through a null interface.
This effectively will stop the attack.
Unfortunately, the attackers can move
to a new IP and restart the attack all over again
and so this is only a temporary solution.
Intrusion prevention systems can also be used to identify
and respond to denial of service attacks.
This can work for small scale attacks against your network
but you're not going to have enough processing power
to handle a large scale attack or a big DDoS.
Now, one of the most effective methods
to utilize is to have an elastic cloud infrastructure.
If you've built your infrastructure so that it can scale up
when demand increases, you can ride out a DDoS attack.
Now, the problem with this strategy though is
that most service providers are going to charge you based
on the capacity and resources that you used.
So when you scale up, you're going to get a much larger bill
from that service provide
than you normally were expecting
and you're not getting a return
on this investment because this traffic was all wasted.
It wasn't generating any revenue for you.
So there's actually some specialized cloud providers
out there that have taken to on this challenge.
People like CloudFlare and Akamai are designed
to help you ride out these DDoS attacks.
They provide web application filtering
and content distribution on behalf of your organization.
These service providers are focused
on ensuring that you have highly robust,
highly available networks
that can ensure that they can write out
these DDoS attacks and these high bandwidth attacks.
This is going to also give you additional layered defenses
throughout your OSI model.
It's going to help provide you additional protections.