Denial of Service Attacks
[ Introduction | Types | Real cases | Explored solutions | Related books ]
Denial of Service (or DoS for short) attacks are a kind of attacks against
computers connected to the Internet. DoS attacks exploit bugs in
a specific operating system or vulnerabilities in TCP/IP implementation.
Unlike a privacy attack, where an adversary is trying to get access to
resources to which it has no authorization, the goal of DoS attacks is to
keep authorized users from accessing resources. The infected computers may
crash or disconnect from the Internet. In some cases they are not very
harmful, because once you restart the crashed computer everything is on track
again; in other cases they can be disasters, especially when you run a
corporate network or ISP.
In this page, you will find many useful and helpful links which not only give
you a general introduction to DoS attacks, but also present you specific types
of DoS attacks and their possible solutions. But let's start with some
introductory pages to familiarize you with DoS attacks.
An introductory article from CERT/CC. The advice from CERT is always reliable, and this article gives you a
very clear definition and description of the DoS attack.
Chapter 11 of John Howard's dissertation, An Analysis Of Security Incidents On The Internet, gives a formal discussion of the DoS attacks. This is a very good reference of DoS attack, but you need to have some patience.
This article on PC magazine by Jeff Downey is much easier to read than the previous dissertation. It gives you clear description of several famous types of DoS attacks, and visualizes
the attacks with some chart.
This page from www.irchelp.org also gives a good introduction and information on specific DoS attacks.
If you just want a quick overview of the DoS attacks, this summary by Roman Markowski at Tango Group Internal Technology Seminars might serve your need well.
Here is a short report I wrote about Denial of Service attacks.
Back to top
According to the www.irchelp.org article, the DoS attacks can be roughly divided into OS-related attacks and networking-related attacks. For OS-related attacks, Windows 95/NT and older MacOS are vulnerable, but most vendors of operating systems have fixed the problem
in their latest versions. The vendors also provide patches for their vulnerable OS. For networking-related attacks, as pointed out in Steven Bellovin's famous paper "Security Problems in the TCP/IP Protocol Suite", there are many security holes which an adversary can exploit to launch a DoS attack; SYN flooding is a good example. You can find information of common DoS attacks in the following list.
Bonk/boink/newtear/teardrop2 is an attack resulting in blue screen freeze and crash.
Ping of Death is an attack taking advantage of a known bug in TCP/IP implementation. The attacker uses the ping system utility to make up an IP packet that exceeds the maximum 65,536 bytes of data allowed by the IP specification. Systems may crash or reboot when they received such an oversized packet. An introduction of Ping of Death can be found in CERT Advisory CA-96.26.
Teardrop is an attack exploiting a weakness in the reassembly of IP packet fragments. The attacker creates a sequence of IP fragments with overlapping offset fields. Some systems will crash or reboot when they are trying to reassemble the malformed fragments. A quick look can be found in this page on ZDNet.
SYN flooding is an attack exloiting the three-way handshaking of TCP. The attacker sends the targeted system a flood of SYN packets with spoofed source address, until the targeted system uses up all slots in its backlog queue. An introduction of SYN flooding can be found in CERT Advisory CA-96.21.
Land is very similar to SYN flooding. The adversary floods SYN packets into the network with a spoofed source IP address of the targeted system. Here is a notice about Land attack from Cisco.
Smurf is a new kind of DoS attack. A smurf attacker cripples your router with ICMP echo request packets. Craig Huegen wrote a good article about smurfing attack, and this article on ZDNet gives you a guick look at smurf.
Snork is an attack against Windows NT RPC service. It allows an adversary with minimal resources to cause a remote NT system to consume 100% CPU Usage for an indefinite period of time. Here is an article about snork attack.
Back to top
DoS attacks are very common, but they are no joking matter. According to National Information
Infrastructure Protection Act of 1996, they can be a serious federal crime.
So amateur hackers, don't play this game. The links in this section lead you to
review several real world cases of DoS attacks.
Morris Worm, written by Robert Morris, a Cornell
University CS graduate student, and launched on Nov. 2, 1988, was the first
DoS attack of significance. This worm was said to cause some 5000 machines
taken out of commission for several hours. RFC 1135 provides a deep discussion of this incident. This page
gives you links to related papers, and this article by Ira Winkler
discusses some lessons we may learn from the incident.
Here is a story about how a DoS attack was launched in March 1998
against several U.S. government and university servers, and how the attack was handled. Here is
the description of how the NIH network suffered from DoS attack in that
incident.
Here is an FBI report on how the famous Melissa virus resulted in a
denial of service on some networks.
An article on TIME magazine tells you a story
of how several young hackers hit FBI with a massive DoS attack and how they were
caught, and discusses the problem of cybergang.
Chapter 12 of John Howard's dissertation, An Analysis Of Security Incidents On The Internet, gives an estimate
of the total number of DoS incidents happened between 1989 and 1995.
Back to top
Most OS-related DoS attacks can be solved by patches. Patches are small
programs developed by vendors to fix the problem. A common protection against
networking-related attacks is setting up a firewall. There are also some
other proposed techniques against networking-related attacks.
From this page you can find some patches for Windows 95
and Windows NT.
To learn more about firewalls, this faq and this faq are good starting points. News groups like comp.security.firewalls and comp.security.misc also provide you useful information.
RFC 2267 discusses how to defeat DoS attacks by filtering IP packets with spoofed source address. However this method is not 100% effective because the attacker can always choose an address which represents a down or unreachable machine.
SYN cookies is a method using cryptographic techniques to protect the system against SYN flooding attacks. It seems working well and is now a standard part of
Linux.
Back to top
For further information on DoS attacks, you can refer to the books listed below.
Maximum Security: A Hacker's Guide to Protecting Your Internet Site and Network, Second Edition, by Anonymous, published by SAMS, Sep. 1998. This book gives you a very practical guide and
detailed information on many kinds of DoS attacks, and covers many other
security related issues. An excellent reference for system administrators.
Hacking Exposed: Network Security Secrets and Solutions, by Stuart McClure, Joel Scambray, George Kurtz, published by McGraw-Hill, Sep. 1999. This is a new book just out of press, and as it claims, it points out security holes in different systems, and tells you how to apply countermeasures. Provide information on how to improve your firewalls.
Practical Unix & Internet Security,
by Simson Garfinkel and Gene Spafford, published by O'Reilly & Associates,
Apr. 1996. This book devotes a whole chapter to DoS attacks, but the range of
examples does not cover Windows OS. Also some information in the book is
outdated. However, it is still a valuable reference for Unix system
administrators.
Back to top
