Chapter 11: DoS Flashcards
DoS goal
To remove the A from the Confidentiality, Integrity, & Availability triad
Denial of service
an attack that aims at preventing normal communication with a resource
What is the most common form of DoS?
to flood a victim w/ so much traffic that all available resources of the system are overwhelmed & unable to handle additional requests
What are signs of a potential DoS attack?
- Unavailability of a resource
- Loss of access to a website
- Slow performance
- Increase in spam e-mails
Hactivism
hackers who take action against a target based on “principle” or a sense of personal mission
They are a threat bc their focus is not for personal gain, but measured by how much their actions benefit their CAUSE.
DoS Targets (3)
1) Web Server Compromise - loss of uptime for company web page
2) Back-end Resources - include infrastructure items that support a public-facing resource, Dos take down back end which makes front-end unavailable
3) NW or Computer Specific
*** Types of Attacks (12)
1) SERVICE REQUEST FLOODS - flooding web server or web app w/ requests until all resources are used up; These are typically carried out by setting up repeated TCP connection to a system
2) SYN ATTACK/FLOOD - This exploits the 3-way handshake; Done by forging SYN packets w/ a bogus source address. When victim system responds w/ a SYN-ACK, it goes to this bogus address, & since the address doesn’t exist, it causes the victim system to wait for a response that will never come; This ties up a connection up for 75 seconds, attacker can keep opening half open connections to keep systems out of service //THE ACK RESPONSE IS MISSING; Syn is sent, syn-ack replied;
3) ICMP FLOOD ATTACK - an ICMP request requires the server to process the request & respond; Attacks include smurf attacks, ICMP floods, ping floods, all of which flood the server w/ ICMP requetss w/ out waiting for the response
4) PING OF DEATH - used back in the day; a ping packet that was larger than the allowable 64K was sent
5) TEARDROP - sending custom-crafted fragmented packets w/ offset values that overlap during the attempted rebuild making the target machine unstable
6) SMURF - spoofs the target IP & sends numerous ICMP echo requests to the broadcast address of intermediary sites; The intermediary sites amplify the ICMP traffic back to the source IP, saturating the NW
7) FRAGGLE - like SMURF attack but uses UDP instead of ICMP. Still uses an intermediary for amplification & spoofs target IP; The attack targets the UDP echo requests to the CHARGEN (character generator) port of the intermediary systems
8) LAND - sends traffic to the target machine w/ the source spoofed as the target machine itself; The victim attempts to acknowledge the requests repeatedly w/ no end.
PERMANENT DOS ATTACKS - most DoS attacks are temporary, some destroy a system & cause it to be permanently offline;
9) PHLASHING is one of them (pushes bogus/incorrect updates to a system’s firmware, this system is said to be BRICKED, aka worthless computer)
APPLICATION-LEVEL ATTACKS - those that result in a loss or degradation of a service to the point it is unusable; Can result in loss of data
10) FLOOD - overwhelm target w/ traffic
11) DISRUPT - attacking w/ intent of locking out or blocking a user (i.e. logging into system several times to lock up acct)
12) JAM - crafted SQL queries to lock up DB;
Performing a SYN Flood
Tool: HPING3 //Linux utility used to craft custom packets such as packets that have specific flags activated
1) Have Wireshark up & running; get sniffer started;
2) In your BackTrack box, open cmd, hping3 for a list of commands
3) hping3 –flood -p 80 -S 192.168.1.2 //Flood SYN packets
4) Check out the traffic
5) Go back to BackTrack & terminate cmd with ctrl+C
Buffer Overflow
takes adv. of a flaw in a program’s coding by inputting more data than the program’s buffer, or memory space, has room for; once the buffer of a program is an overflow state, it can crash, etc
C functions & signs of buffer overflow
Some C functions do not perform bounds checking, making it vulnerable to buffer overflow
gets(), scanf(), strcpy(), strcat() are common functions for buffer overflow
The HEAP and STACK
Two areas of memory a program uses for storage
HEAP //dynamic storage location that does not have sequential constraints or organizational scheme; considered the larger pool of free storage for programs to use as needed; once dynamic memory space is no longer needed, it is freed
STACK // linear in operation (top, bottom, LIFO); smaller pool of storage; memory allocated to a program for short-term processing, main action area where program variables are temporarily stored, added, & removed as needed; Can only see values from top down; LIFO; PUSH describes adding to a stack, POP is removing
During a buffer overflow, the heap if overflowed. The malicious code soon resides in the STACK & the EIP points to the malicious code executing it
Smashing the Stack
use of buffer overflow to compromise the stack & gain program-level access; submit excess data to stack
Stack pointer represents
the top of a stack; in a buffer overflow, the stack pointer is ignored an data is stacked over top of it creating False EIPs (Extended instruction pointer/point of execution) and False Stack pointers
When smashing the stack, the EIP points to injected malicious code
NOP sled
shellcode (or machine code) used in buffer overflow attack; uses multiple “NO OPERATION” commands in a sequenced chunk; 0x90 will instruct an Intel processor to perform one clock cycle on empty process
Equates to a full CPU cycle w/ no acutal work being accomplished
DDOS
Distributed Denial of Service
multiple comprised systems (by a trojan) target a single system causing a DoS attack; same goals as DoS, but more complex & powerful; DoS relies on a single system to attack a victim whereas DDOS is multiple attackers;
Concept: The MASTER/ATTACKER affects the HANDLER (typically server, a unit that has maneuverability in the NW) computers w/ DDoS SW build commonly known as a BOT; The bot sifts through victim’s NW searching for potential clients to make ZOMBIES; Once all compromised, attack!
