DDoS

Question 1

DDoS, SSL, TLS

3 types of DDoS attacks?

Answer 1

Application layer attack, protocol attacks, volumetric attacks

Question 2

DDoS, SSL, TLS

How do you combat DDoS attacks?

Answer 2

Can’t handle it by blocking IP addresses.

Question 3

DDoS, SSL, TLS

What do you generally need to launch a DDoS attack?

Answer 3

botnet

Question 4

DDoS, SSL, TLS

What are application layer attacks?

Answer 4

Anything that relies on OSI layer 7 or other high layer

Question 5

DDoS, SSL, TLS

Example of an appliation layer attack?

Answer 5

HTTP Flood

Question 6

DDoS, SSL, TLS

What is HTTP Flood?

Answer 6

Requests that are easy for a client to generate, but hard for a server to handle.

Question 7

DDoS, SSL, TLS

What happens during a HTTP Flood attack?

Answer 7

Server flooded with requests, each of which is a heavy-lift.

Question 8

DDoS, SSL, TLS

What kind of botnet do you need to launch an application layer attack?

Answer 8

Generally a large one

Question 9

DDoS, SSL, TLS

What are protocol-based attacks?

Answer 9

Exploit a protocol that’s low on the OSI stack

Question 10

DDoS, SSL, TLS

Example of a protocol-based attack?

Answer 10

SYN Flood

Question 11

DDoS, SSL, TLS

What is a SYN Flood?

Answer 11

Send a ton of SYN with spoofed return IP. Server sends SIN-ACK and ties up a port waiting for a reponse that won’t come.

Question 12

DDoS, SSL, TLS

What kind of botnet do you need to launch an application layer attack?

Answer 12

Generally a large one

Question 13

DDoS, SSL, TLS

What are Volumetric Attacks?

Answer 13

Send small requests that return large payloads. Spoof the return address to the system you’re attacking.

Question 14

DDoS, SSL, TLS

Example of a Volumetric Attack?

Answer 14

DNS Amplification

Question 15

DDoS, SSL, TLS

What is the “Volume” in Volumetric Attacks?

Answer 15

The number of servers that send a response to your spoofed IP addr, not related to packet size.

Question 16

DDoS, SSL, TLS

How does DNS Amplification work?

Answer 16

Attacker makes ton of requests to a large number of DNS servers, spoof response, ton of DNS servers reply to the target system.

Question 17

DDoS, SSL, TLS

What kind of botnet do you need to launch an application layer attack?

Answer 17

Almost any side – easy to send a few, responses are large

Question 18

DDoS, SSL, TLS

Example of insecure (old) and secure (new) hashing algorithms?

Answer 18

MD5 is old, SHA2-256 is new

Question 19

DDoS, SSL, TLS

SSL vs. TLS?

Answer 19

TLS is newer and more secure than SSL