Denial of Service (DoS) and Distributed Denial of Service (DDoS)

Overview

• Denial of Service (DoS) is an action or series of actions that cause a service to fail.
• Typically involves overloading a system so that no resources are available for legitimate users.

Causes of DoS

• Overwhelming a server's capabilities.
• Exploiting vulnerabilities in an operating system or application.
• Physical causes like power outages or infrastructure damage.
• Misconfigurations, such as network loops without spanning tree protocol.

Importance of Security

• Keeping systems updated with the latest security patches is crucial to prevent exploitations.
• Security breaches can be advantageous for competitors.

Distractive Nature of DoS

• Sometimes used as a distraction while attackers target other network parts.

Distributed Denial of Service (DDoS)

• Involves multiple devices acting in unison to cause a denial of service.
• Often executed by botnets, which can control millions of devices.
• Asymmetric nature: attackers need few resources to disrupt systems with more resources.

Reflection and Amplification Attacks

• Attackers use reflection and amplification strategies to intensify attacks.
• Protocols like Network Time Protocol (NTP), Domain Name System (DNS), and Internet Control Message Protocol (ICMP) can be used.

DNS Amplification Example

• A basic DNS query requests an IP address from a server.
• Attackers use the 'any' parameter in a DNS query to receive extensive information, such as DNS keys, amplifying the attack.

DDoS Attack Process (Using DNS Amplification)

1. Command and Control:
   • Manages the DDoS process.
   • Uses a botnet to send DNS queries to open DNS resolvers.
2. Botnet Action:
   • Sends small DNS queries; responses are much larger.
   • Spoofs the source of requests so responses target the victim's web server.
3. Amplification:
   • Queries of 28 bytes can result in 1300 bytes responses.
   • Overwhelms victim's web server, completing the DDoS attack.

Key Takeaways

• DoS and DDoS attacks can be very disruptive with minimal resources required from attackers.
• Keeping systems updated and using proper network configurations can mitigate risks.
• Reflection and amplification make these attacks efficient and potent.