Denial of Service

Question 1

Random Scanning

Answer 1

Each compromised computer probes

random addresses

Question 2

Permutation Scanning

Answer 2

All compromised computers share a
common pseudo-random permutation of the
IP address space

Question 3

Signpost Scanning

Answer 3

Uses the communication patterns of the

compromised computer to find new target.

Question 4

Hitlist Scanning

Answer 4

A portion of a list of targets is supplied to

a compromised computer

Question 5

subnet proofing

Answer 5

generate random addresses within a given address space

Question 6

Random spoofing

Answer 6

generate 32-bit numbers and stamp packets with them

Question 7

Fixed spoofing

Answer 7

the spoofed address is the address of the target

Question 8

Goal of DDOS

Answer 8

take out a large computer site / app / infra with as little computing resources as possible

Question 9

What are the reasons why the UDP-based NTP protocol is particularly vulnerable to amplification attacks?

Answer 9

A small command can generate a large response

Vulnerable to source IP spoofing.

It is difficult to ensure computers communicate only with legitimate NTP servers

Question 10

Which of the following are true?

The server must reject all TCP options because the server discards the SYN queue entry

SYN cookies lead to overall slower performance

SYN cookies require modified versions

Answer 10

The server must reject all TCP options because the server discards the SYN queue entry

Question 11

With regards to a UDP flood attack, which of the following are true?

• Attackers can spoof the IP address of their UDP packets
• the attack can be mitigated with firewalls
• firewalls can’t stop a flood because the firewall is susceptible to flooding

Answer 11

• Attackers can spoof the IP address of their UDP packets

- firewalls can’t stop a flood because the firewall is susceptible to flooding

Question 12

What is the main idea behind slowing down DOS attackers?

Answer 12

Slow down the hacker!

Question 13

What are client puzzles and what do they do?

Answer 13

• everyone must submit a puzzle solution with requests during a DOS attack which slows down the requests
• When there is no attack, no solution is needed

Question 14

Why is SSL/TLS handshake vulnerable to DDOS?

Answer 14

TBD

Question 15

What are client puzzles and what are they used for?

Answer 15

TBD

Question 16

Why is it recommended to use memory bound functions as problems to solve during DOS attack?

Answer 16

TBD

Question 17

Which of the following statements is true?

• Client puzzles should be stateless
• Puzzle complexity should increase as the strength of the attack increases
• Client puzzles should be hard to construct. This is an indication of the level of difficulty to solve them

Answer 17

Client puzzles should be stateless

Puzzle complexity should increase as the strength of the attack increases

Question 18

Which of the following are assumptions that can be made about Traceback?

Attackers can work alone or in groups

Attackers can generate limited types of packets

Attackers are not aware of the tracing mechanism

Answer 18

Attackers can work alone or in groups

Question 19

Select all statements that are true for edge sampling:

• Multiple attackers can be identified since edge identifies splits in reverse path
• It’s difficult for victims to reconstruct a path to the attacker
• Require space in the IP packet header

Answer 19

Require space in the packet header

Multiple attackers can be identified since edge identifies splits in reverse path

Question 20

What is a reflector attack?

Answer 20

Reflector Attack:
Spoofs victim’s IP and sends requests to many DNS servers
All DNS servers respond to magnify traffic to target
Victim is flooded

Question 21

Self defense against reflector atacks should incorporate
which of the following:

• Filtering - filter DNS traffic as close to the victim as possible
• Server redundancy - servers should be located in multiple networks and locations
• Traffic limiting - traffic from a name server should be limited to reasonable thresholds

Answer 21

Server redundancy - servers should be located in multiple networks and locations

Traffic limiting - traffic from a name server should be limited to reasonable thresholds