Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks

Overview

• A Denial of Service (DoS) occurs when an attacker forces a service to fail, intentionally preventing access.
• Techniques include overloading a service, exploiting vulnerabilities, or utilizing design failures.
• Importance of keeping systems updated with the latest patches to prevent such attacks.

Motivations

• Competitive advantage: Organizations might initiate a DoS against competitors to take them offline.
• Distraction: DoS may be used as a smokescreen for exploiting other vulnerabilities in the system.

Types of DoS Attacks

• Simple Physical Attacks: Removing power from a system causes a DoS.
• Self-inflicted DoS: Configuration errors like creating network loops or consuming all bandwidth with large downloads.

Distributed Denial of Service (DDoS)

• Multiple devices across the world attack a target system, overloading it.
• Attackers use malware to create botnets (robot networks) to initiate these attacks.

Botnets

• Botnets are networks of infected devices controlled by an attacker.
• Example: Zeus botnet controlled over 3.6 million computers.
• Referred to as an 'asymmetric threat' due to the attacker's limited resources compared to the target's.

Amplification Attacks

• Attackers can amplify attacks by sending small requests that generate larger responses, overwhelming the target.
• Reflection and Amplification: Use of internet services to amplify attack data.
  • Protocols used: NTP, DNS, ICMP, etc.

DNS Amplification

• Common example involves DNS queries.
• Attack involves sending small DNS queries that result in large responses sent to the victim.
• Involves:
  • Botnet command and control sending instructions to botnet devices.
  • Devices sending spoofed DNS queries to open DNS resolvers.
  • Amplified responses are sent to the target, causing a DDoS.

Measures

• Importance of securing DNS servers and using properly configured resolvers to prevent misuse.
• Constant vigilance and monitoring of network configurations to avoid self-inflicted DoS.