Denial of Service Attacks Flashcards
Describe
Denial of Service (DoS)
DoS
Prevents user from using certain services
Two types of DoS Attacks
DoS
Program Flaw and Resource Exhaustion
Describe
DoS Attack: Program Flaw
DoS
Input that crashes target application/system
Defenses against DoS Attack: Program Flaw
DoS
- Careful programming
- Authentication
- Authorization
- Least privilege
- Testing/review
- Behavior of other defenses
Defenses against DoS Attack: Resource Exhaustion
DoS
- Reliable authentication
- Quota allocation
- Isolation
Describe
DoS Attack: Resource Exhaustion
DoS
Requesting significant amounts of computing resources (i.e. CPU, memory, disk, network connections)
Describe
Network DoS Attacks
DoS
Pulls the machine off the Internet by increasing traffic to isolation
What makes Network DoS Attacks possible?
DoS
Internet lacks isolation between traffic users
Cost of Network DoS Attacks
DoS
- Bandwidth = bottleneck link of target connection (requires distributed DoS attacks and amplification)
- Packet sending rate = bottleneck router
Two types of DNS DoS Attacks
DoS
Reflection and DYN Attacks
Describe
Reflection DNS DoS Attacks
DoS
Spoofs larger number of DNS requests from victim for bandwidth amplification
Describe
DYN DNS DoS Attacks
DoS
Floods DNS with DNS queries
Describe
Application DoS
DoS
Sends application payload to attack availability at application layer
What does Application DoS bypass?
DoS
Network-layer defenses
Defenses against Application DoS
DoS
- Authentication + isolation
- Distributed services
Ways to Mitigate Lack of Inbound Traffic Control
DoS
- Ingress Filtering
- Client Challenges
- Source Identification
Describe
Ingress Filtering
DoS
Ensures packets are from desired origin (drops datagrams without legit source IP addresses)
Limitation to Ingress Filtering
DoS
Requires reliance and cooperation between Internet Service Providers (ISP)
Describe
Client Challenges
DoS
Forces the Client to put effort after their request through puzzles or CAPTCHAs
Limitations to Client Challenges
DoS
- Changes client and servers
- Hurts low power legit clients
Describe
Source Identification
DoS
Tracebacks to the origianl source with updated router marks on packet info under the assumptions that packets arrived in stable paths and its routers were not compromised
Two ways to execute Source Identification
DoS
- Datagram carries link info
- Datagram information is stored into 1 fixed datagram based on statistics/probability
