- Denial of service and
distributed denial of service attacks
have been around for quite some time now.
But we have seen several waves of these attacks
over the past few years.
Now, DDoS attacks can be categorized
in three major categories:
direct DDoS attacks,
reflected DDoS attacks,
and amplification DDoS attacks.
Direct DDoS attacks occur when the source
of the attack generates the packet,
regardless of the protocol application and so on.
That they are sent directly
to the victim of the attack.
In this example, the attacker launches a direct DDoS
to a web server, which is the victim here,
and sending numerous TCP SYN packets,
so TCP synchronization packets.
And this type of attack is actually aimed
to flood the victim
with an overwhelming number of packets.
And then over saturating its connection bandwidth
or depleting the target's resources in that system.
This type of attack is also known
as a syn-flood attack.
As a TCP Syn-flood attack.
Cyber criminals also can use DDoS attacks to
produce added cost to the victim
when the victim is actually using things
like cloud services, for example.
So in most case,
when you see a cloud service,
such as Amazon Web Services, or AWS,
or some other ones,
you actually pay per usage, right?
So, attackers can actually launch DDoS attacks
and cause you to pay more
for the users and resources that are being serviced.
Another type of DDoS is caused
by exploiting vulnerabilities, such as a buffer overflow,
to actually cause a server,
or even a network infrastructure device,
to actually crash, so to reload.
And then subsequently causing
a complete denial of service condition.
Now, many attackers use botnets to launch DDoS attacks.
A botnet is actually a collection
of compromised machines where the attacker
can manipulate them from a command and control server,
what we call a CNC server, a system.
To either participate in a DDoS in this case,
or they can also be compromised and manipulated to
actually send spam emails
or to perform other illicit activities.
Now in this example here,
I'm actually showing a botnet that is actually used
by the hacker to actually launch a DDoS attack.
And in this example, the actual attacker sends instruction
to the command and control box, so to the CNC.
And then subsequently the CNC sends instructions to the bot,
within the botnet, to then launch a DDoS against the victim,
in this case.
Now the other type of DDoS attacks
is a reflected DDoS attack.
And reflected DDoS attacks occur when the source
or the sources of the attack are sent spoof packets
that appear to be from the victim.
And then the sources become unwittingly participants
of the DDoS attacks
by sending the response traffic back to the intended victim.
UDP is actually often used as a transport mechanism
because it's actually more easy,
or it is easier,
to be spoofed due to the lack of 3-way handshake.
Just like UDP is a connectionless protocol
and not like TCP, that actually has a 3-way handshake.
So for example, if the attacker decides
that he wants to attack the victim,
he will send packets, let's say NTP packets or
any of the other type of UDP packet,
to a source who actually thinks
that these packets are legitimate.
And then the source then responds
to the NTP request, in this case,
by sending the responses to the victim.
And in this case the victim, who has never been expecting
these NTP packets from actually the source, then of course
cause this denial of service condition.
Now there is another type of denial of service attack
called amplification attacks.
And these attacks are a form of reflected attacks in which
the response traffic,
which is actually sent by the unwilling participants,
is actually made up of packets that are much larger
than those that were initially sent by the attacker.
So, the attacker is actually spoofing the victim
in this case.
So, an example of this is actually when DNS queries are sent
to a DNS server and the DNS responses actually are
much larger in the packet size
than initial request of the packet.
Subsequently, this is what we call
an amplification of the attack,
since the the responses are actually amplified
or much larger in packet size
than the initial quarry packets that were sent.
So the end result is that the victim gets flooded
by those large packets
from which it never actually issues queries for.
So in this example, we actually have three DNS servers
that are open resolvers, right?
So, the attacker sends spoof packets to the DNS servers
and these packets are small 64-bit packet.
And then the DNS servers amplify those packets to the victim
with a much larger size, as you can see from this picture.