Dos

(Denial of Services)

What is DoS Attack

• A DoS attack can disrupts or completely denies service to legitimate users, networks, systems, or other resources.”

• Can last from a few minutes to several days

Types of DoS

Bandwidth Consumption Network Flooding

T3 vs. 56K

Amplifying AttackUsing multiple sites for attack

Distributed DoS Attacks

More effective than DoS AttacksMultiple sources for attack Tribe Flood Network, Trinoo, TFN2K

Zombie:A computer that has been implanted with a daemon that puts it under the control of a

malicious hacker without the knowledge of the computer owner.

Some History

DoS Tools:Single-source, single target toolsIP source address spoofingPacket amplification (e.g., smurf)

Deployment:Widespread scanning and exploitation via

scripted toolsHand-installed tools and toolkits on compromised

hosts (unix)Use:

Hand executed on source host

BP (Before Pain) – Pre - 1990

The danger grows - 1999

DoS Tools:Multiple-source, single target toolsDistributed attack networks (handler/agent)DDoS attacks

Deployment:Hand-selected, hard-coded handlersScripted agent installation (unix)

DoS Attack in 2000

Example SYN Flood Attack February 5th . 11th, 2000Yahoo, eBay, CNN, E*Trade, ZDNet, Datek and

Buy.com all hit Attacks allegedly perpetrated by teenagers Used compromised systems at UCSB

•May 4th-20th, 2001•Gibson Research Corporationwww.grc.com/dos/intro.htm

DDoS attack from 474 machines• Completely saturated two T1s• 13-year-old claimed responsibility

Detailed Account of DDoS

DoS Attacks on the Rise

24%27%

38%

0%

5%

10%

15%

20%

25%

30%

35%

40%

1999 2000 2001 2003

Frequency of DoS attacks increased 60% over the last three years…and still rising

Common forms of DoS•Buffer Overflow Attacks

•SYN Attack

•Teardrop Attack

•Smurf Attack

•Viruses

•Physical Infrastructure Attack

Buffer Overflow Attacks

Buffer overflow is an attempt to stuff to much information into a space in a computers memory.

Examples Sending e-mails that have attachments with

256-character file names to Netscape and Microsoft mail programs.

Sending large (ICMP) packets (this can be known as the Ping of Death attack)

What is a SYN Flood?

Send spoofed SYN packets to systemSystem responds with SYN/ACKNever receives final connectionBacklog in connection queue

Web servers are particularly vulnerableHow to Detect SYN attack netstat -n -p TCP | grep SYN_RECV | grep :23 | wc -l

Smurf AttackAmplification attackSends ICMP ECHO to network

Network sends response to victim system

The "smurf" attack's cousin is called "fraggle", which uses UDP echo packets in the same fashion

VirusesComputer viruses, which replicate across a network in various ways, can be viewed as denial-of-service attacks where the victim is not usually specifically targetted but simply a host unlucky enough to get the virus. Depending on the particular virus, the denial of service can be hardly noticeable ranging all the way through disastrous.

Physical Infrastructure Attacks fiber optic cable. This kind of attack is usually mitigated by the fact that traffic can sometimes quickly be rerouted.

Impact of DoS Attacks

Loss of Revenue

cont …

Costs of losses from the February 2000 Attacks: $1.2 billion cumulative

Estimated lost business from DDoS attacks at Amazon.com:

$200-300K/hour

Estimated costs of 24-hour outages:Brokerage Firm

$156 million

Cisco $30 millioneBay $4.5 millionAirline $2.1 million

Estimated cost of lost user access from one medium-grade attack:

$23K

Sources: Forrester, Yankee Group, IDC

•Damage to Corporate Image and Brand•Cost of Over-engineering Network Resources•Cost to diagnose and rebuild systems

•Forensic cost estimated by University of Washington to be $22,000 per event

•Violation of service level agreements (SLAs)•Risk of litigation•Increase in insurance protection

Impact of DoS Attacks

Why Defense is Difficult

• SYN packets are part of normal traffic• Source IP addresses can be faked• SYN packets are small• Lengthy timeout period

Possible Defenses

Increase size of connections tableAdd more serversTrace attack back to sourceDeploy firewalls employing SYNflood defense

Who Offers a Defense?

PIX by CiscoFirewall-1 by CheckpointNetscreen 100 by NetscreenAppSafe/AppSwitch by Top Layer

How Bad Can It Get?

Theoretical maximums for attackers using: Analog modem: 87 SYNs/sec ISDN, Cable, DSL: 200 SYNs/sec T1: 2,343 SYNs/sec 474 hacked systems 94,800 SYNs/sec

How Much Do You Need?

Single firewall for attacker with

single ISDN, DSL, or T1 Multiple parallel units for higher bandwidthTransparent. mode permits rapid

deployment

Conclusion

SYN floods are nasty Firewalls with SYN flood defense

can successfully counter attacks Multiple or distributed attacks may

require multiple parallel firewalls

In Summary

Thank You