Chapter 7

Question 1

Denial of service attack

Answer 1

action preventing authorized use of networks /systems/applications by exhausting resources

Question 2

categories of resources

Answer 2

1. network bandwidth - capacity of network links connecting server to internet
2. system resource - aims to overload network handling software
3. application resource - involves number of valid requests - each consumes significant resources - limit ability of server to respond to requests from other user

Question 3

types of attacks

Answer 3

1. flooding ping command - overwhelm capacity of network connection to target organizations
2. SYN spoofing - attack ability of server to respond to new connection request by overflowing tables used to manage them
3. flooding attacks - based on network protocol classified (ICMP flood - ICMP echo requests, UDP flood - UDP packet to port number, TCP SYN flood - TCP packets to target - total number of packets = aim of attack rather than system code)

Question 4

DDos

Answer 4

multiple systems to generate attack- botnet

Question 5

HTTP attack

Answer 5

1. HTTP flood - bombard web servers with HTTP requests
2. slowlorris - attempt to monopolize all available request handling threads on web server by sending HTTP requests that never complete

Question 6

Reflection attacks

Answer 6

attacker sends packets to known service on intermediary with spoofed source address of actual target system

Question 7

backscatter traffic

Answer 7

advertise routers to unused IP addresses to monitor attack traffic

Question 8

DNS amplification attacks

Answer 8

use packets directed at legitimate DNS server as intermediary system- attacker create series of DNS requests containing spoofed source address of target system

Question 9

basic defence

Answer 9

prevent use of spoofed source address

Question 10

Dos attack defence prevention + pre-emption

Answer 10

1. block spoofed source addresses
2. filter applied before leaving ISP to check claimed source address
3. use modified TCP connection handling code (encode critical info in cookie , responds with ACK packet containing inc sequence number cookie), drop entry for incomplete TCP connections when table overflows
4. block IP directed broadcasts
5. block suspicious services + combinations
6. manage application attacks with from of graphical puzzle
7. good general system security practices
8. use mirrored + replicated servers when high performance

Question 11

responding to Dos attacks

Answer 11

anti-spoofing , rate-limiting
1. identify type of attack - capture packets
2. have ISP trace packet flow back to source - for legal action
3. implement contingency plans - switch server
4. update incident response plan

Question 12

good incidence response plan

Answer 12

1. details on how to contact technical personnel for ISP
2. impose traffic upstream
3. details on how to respond to attack