CIS4360_Chapter_07 Flashcards
What is a denial of service attack?
A denial of service is an action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as CPU, memory, bandwidth and disk space.
What type of resources are targeted by a denial of service attack?
+ Network bandwidth
+ System resources
+ Application resources
What is the goal of a flooding attack?
The goal of a flood attack is to overload the network capacity of the target.
`What type of packets are commonly used for flooding attacks?
Any type of packet can be used in a flooding attack. Commonly used: ICMP, UDP or TCP SYN.
Why do many DoS attacks use packets with spoofed source addresses?
If there is a valid system at the spoofed source address, it will respond with a RST packet. However, if there is no system then no reply will return. In these cases the server will resend the packet a number of times before finally assuming the connection request has failed. In this period, the server is using an entry in its memory. If many connection requests with forged addresses are incoming, the memory fills up, making the server incapable of handing any more requests (not even legitimate ones).
Define a distributed denial-of-service attack.
A distributed denial of service attack is a denial of service attack using multiple systems.
What architecture does a distributed denial of service attack typically use?
A botnet consisting of infected zombie PCs is used, that is under the control of a hacker.
Define a reflection attack.
The attacker sends a network packet with a spoofed source address to a service running on some network server. The server (=reflector) responds to this packet, sending it to the spoofed source address that belongs to the actual attack target. This is then called a reflection attack.
Define an amplification attack.
They differ to reflection attacks in that they are generating multiple response packets for each original packet sent. This can be achieved by directing the original request to the broadcast address for some network. As a result, all hosts will respond, generating a flood of responses.
What is the primary defense against many DoS attacks, and where is it implemented?
Limiting the ability of systems to send packets with spoofed source addresses. An ISP knows which addresses are allocated to all its customers and hence can ensure that valid source addresses are used in all packets from its customers.
What defenses are possible against TCP SYN spoofing attacks?
Using a modified version of the TCP connection handling code, where the connection details
are stored in a cookie on the client computer rather than the server.
What do the terms slashdotted and flash crowd refer to? What is the relation between these
instances of legitimate network overhead and the consequences of a DoS attack?
These terms refer to the following occurrence: A posting to the well-known site Slashdot news aggregation site often results in overload to the referenced server system. There is very little that can be done to prevent this type of either accidental or deliberate overhead The provision of excess network bandwidth is the usual response.
What defenses are possible to prevent an organization’s system being used as intermediaries in an amplification attack?
They should have implemented antispoofing, directed broadcast and rate limiting filters. In addition you should have some form of automated network monitoring and intrusion detection system.
What steps should be taken when a DoS attack is detected?
Identification of the type of attack, application of suitable filters to block the attack packets.
In addition, an ISP may trace the flow of packets back in attempt to identify the source.
