Overview
This lecture explains denial of service (DoS) attacks, their types, methods, and the impact on internet services, including distributed denial of service (DDoS) attacks.
What is a Denial of Service (DoS) Attack?
- A DoS attack tries to prevent legitimate users from accessing a network or service by overwhelming it.
- Attackers exhaust server resources so real users are denied access.
Examples of DoS Attack Methods
- Ping of Death (PoD): Sends a malformed, oversized ping causing a buffer overflow, crashing the system or allowing malicious code execution.
- Ping Flood: Sends large volumes of ICMP echo request (ping) packets; overwhelms target with reply traffic, making it unresponsive.
- SYN Flood: Bombards a server with SYN packets (used in initiating TCP connections), but never completes the handshake, leaving connections half-open and consuming resources.
Distributed Denial of Service (DDoS) Attacks
- DDoS attacks involve multiple machines (often compromised into a botnet) to overwhelm a target.
- Much more powerful than traditional DoS, enabling attackers to bring down large-scale services quickly.
- Example: October 2016 DDoS attack on DNS provider Dyn made major websites (e.g., Reddit, GitHub, Twitter) inaccessible by overloading their systems with fake DNS requests and SYN floods.
Key Terms & Definitions
- Denial of Service (DoS) Attack — Attempts to make a service unavailable by overwhelming it with traffic.
- Ping of Death (PoD) — DoS attack using malformed, oversized ping packets to crash systems.
- Ping Flood — DoS attack using many ICMP echo requests to flood and overwhelm a target.
- SYN Flood / Half-Open Attack — DoS attack flooding a server with TCP SYN requests without completing the handshake.
- Distributed Denial of Service (DDoS) Attack — DoS attack using many machines (often a botnet) to increase attack volume.
- Botnet — Network of compromised computers controlled by attackers to launch large-scale attacks.
Action Items / Next Steps
- Review common network protocols (ICMP, TCP) and their normal use.
- Research additional real-world examples of DoS and DDoS attacks.