Distributed Denial-of-Service, or more commonly known in its abbreviated form – DDoS – is an organized attempt to render a computer resource obsolete and unavailable to its intended users – temporarily or indefinitely. Specifically, a DDoS attack consists of the concerted efforts of a person or an organization to prevent an Internet website or service from functioning efficiently, or even at all. When a DDoS attack is successful, enterprises with core revenue-generating functions residing over the Internet will suffer great losses in the forms of: short-term financial losses, long-term reputational losses, or even permanent business disability.
DDoS attacks can be classified into two broad categories – Bandwidth Depletion Attacks or Resource Depletion Attacks. Bandwidth Depletion Attacks are characterized by which a victim network is flooded with large volume of bogus packets that overwhelms the network’s bandwidth capacity. The aim is to consume network bandwidth of the targeted network to such an extent that it starts to drop packets. An inevitable result would lead to legitimate traffic being dropped as well, thus denying valid users access to that particular service.
Resource Depletion Attacks involves the attackers sending packets that misuses network protocol communications, or via sending malformed packets that tie up network and/or system resources so that none are left for legitimate users. The aim is to occupy and jam up the limited resources so that it is unable to handle any other requests.
Bandwidth Depletion Attacks
DDoS bandwidth depletion attacks can be classified into two different levels; Flood Attacks or Amplification Attacks. A flood attack is characterized by the use of zombies to send large volumes of traffic to a compromised victim system in order to congest its bandwidth. An amplification attack is similar in that it limits the victim system’s bandwidth via amplified malicious traffic; characterized by the use of zombies to send messages, but to a broadcast IP address instead, causing systems in the subnet reached by the broadcast IP address to send messages to victim systems.
Flood Attacks
During a DDoS flood attack, the zombies flood the victim system with IP traffic and prevent legitimate traffic from accessing the victim network. The large volumes of packets are sent by the zombies to flood the victim system with IP traffic, thus slowing it down significantly, which results in bandwidth saturation or even a system crash. Common types of flood attacks include Agent-Handler attacks and IRC-based attacks. Agents are compromised via the handlers by the attacker, using automated routines to exploit vulnerabilities in programs that accept remote connections running on the targeted remote hosts. Each handler can control up to a thousand agents.
User Datagram Protocol (UDP) Flood Attacks
Due to its status as a connectionless protocol, when data packets are sent via UDP, no handshakes are required between sender and receiver, resulting in a mandatory processing of all received packets. This can lead to bandwidth saturation when a large number of UDP packets are sent to a victim system where legitimate service requests are prevented access to the victim system.
During a DDoS UDP Flood attack, UDP packets may be sent randomly or target specified ports on the victim system. Victim systems will try to process any data packets received to determine which applications have requested data. If no applications are run on the targeted port, the victim system will send out an ICMP packet to the sending system indicating a “destination port unreachable” message.
In some cases, attackers may spoof source IP addresses in order to hide the identity of the secondary victims and ensure that return packets from the victim system will not be directed back to the zombies, but to another computer instead with the spoofed address. Sometimes, UDP flood attacks may also affect the bandwidth connections surrounding the victim system and this may cause systems connected near to the victim system to experience connectivity issues. However, this is dependent on network architecture and line-speed.
Internet Control Message Protocol (ICMP) Flood Attacks
DDoS ICMP flood attacks are characterized by zombie attackers sending large volumes of ICMP_ECHO_REPLY (or “ping”) packets to the victim system. ICMP packets are specifically designed to assist users in locating network equipment or determine the number of hops or round-trip-time to get from a source to its destination. During an ICMP attack, these malicious packets will demand a reply from victim systems and this will lead to bandwidth saturation of victim network connections.
DDoS bandwidth depletion attacks can be classified into two different levels; Flood Attacks or Amplification Attacks. A flood attack is characterized by the use of zombies to send large volumes of traffic to a compromised victim system in order to congest its bandwidth. An amplification attack is similar in that it limits the victim system’s bandwidth via amplified malicious traffic; characterized by the use of zombies to send messages, but to a broadcast IP address instead, causing systems in the subnet reached by the broadcast IP address to send messages to victim systems.
Flood Attacks
During a DDoS flood attack, the zombies flood the victim system with IP traffic and prevent legitimate traffic from accessing the victim network. The large volumes of packets are sent by the zombies to flood the victim system with IP traffic, thus slowing it down significantly, which results in bandwidth saturation or even a system crash. Common types of flood attacks include Agent-Handler attacks and IRC-based attacks. Agents are compromised via the handlers by the attacker, using automated routines to exploit vulnerabilities in programs that accept remote connections running on the targeted remote hosts. Each handler can control up to a thousand agents.
User Datagram Protocol (UDP) Flood Attacks
Due to its status as a connectionless protocol, when data packets are sent via UDP, no handshakes are required between sender and receiver, resulting in a mandatory processing of all received packets. This can lead to bandwidth saturation when a large number of UDP packets are sent to a victim system where legitimate service requests are prevented access to the victim system.
During a DDoS UDP Flood attack, UDP packets may be sent randomly or target specified ports on the victim system. Victim systems will try to process any data packets received to determine which applications have requested data. If no applications are run on the targeted port, the victim system will send out an ICMP packet to the sending system indicating a “destination port unreachable” message.
In some cases, attackers may spoof source IP addresses in order to hide the identity of the secondary victims and ensure that return packets from the victim system will not be directed back to the zombies, but to another computer instead with the spoofed address. Sometimes, UDP flood attacks may also affect the bandwidth connections surrounding the victim system and this may cause systems connected near to the victim system to experience connectivity issues. However, this is dependent on network architecture and line-speed.
Internet Control Message Protocol (ICMP) Flood Attacks
DDoS ICMP flood attacks are characterized by zombie attackers sending large volumes of ICMP_ECHO_REPLY (or “ping”) packets to the victim system. ICMP packets are specifically designed to assist users in locating network equipment or determine the number of hops or round-trip-time to get from a source to its destination. During an ICMP attack, these malicious packets will demand a reply from victim systems and this will lead to bandwidth saturation of victim network connections.
Resource Depletion Attacks
DDoS Resource Depletion Attacks are characterized by attackers sending packets that target network protocol communications, which congests network resources and prevents access by legitimate users.
Protocol Exploit Attacks
Transfer Control Protocol (TCP) Synchronize (SYN) Attacks. The TCP process typically includes a full handshake between a sender and a receiver before data packets are sent. The initiating system sends a SYN request and the receiving system will reciprocate by returning an ACK (acknowledgement) along with its own SYN request. The sending system will then send back its own ACK to authorize communication between the two systems. If the receiving system is sent a SYN packet but does not receive an ACK, the receiver will resend a new SYN packet after some time. The processor and memory resources at the receiving system will be reserved for this TCP SYN request until a timeout occurs. Also known as resource starvation attacks, a DDoS TCP SYN attack will capitalize on the TCP function where zombies will send bogus TCP SYN requests to a victim server, which effectively saturates the server processor resources and prevents it from processing legitimate requests. It particularly exploits the three-way handshake between the sending system and the receiving system by sending large volumes of TCP SYN packets to the victim system with spoofed source IP addresses. Eventually, when large volumes of TCP SYN attack requests are sent and repeated, the victim system will run out of memory and processor resources, thus unable to process any legitimate user requests.
PUSH + ACK Attacks
The PUSH + ACK attack is similar to a TCP SYN attack in depleting processor and memory resources of victim systems. A PUSH is a one-bit flag tagged within a TCP header. During the TCP process, packets that are sent to a destination are buffered within the TCP stack. Packets will then be proceeded to be sent to the receiving system after the stack is filled. However, by setting the PUSH bit to one, the sender can request the receiving system to unload the contents of the buffer before the buffer becomes full. TCP then stores incoming data in large blocks for passage on to the receiving system in order to minimize the processing overhead. When this process is repeated with multiple agents, the receiving system will not be able to handle the large volumes of incoming packets and will result in a crash.
Malformed Packet Attacks
A malformed packet attack is characterized by zombies sending incorrectly formed IP packets to a victim system to crash it. There are typically two different levels of malformed packet attacks. During IP address attacks, the packet contains the same source and destination IP addresses. This confuses the victim operating system and causes it to crash. During IP packet options attacks, a malformed packet randomizes optional fields within an IP packet and sets all quality of service bits to one, so victim systems will be compelled to utilize additional processing time to analyze traffic. When this attack is repeated using multiple agents, this will lead to a shutdown of the processing ability in victim systems.
DDoS Resource Depletion Attacks are characterized by attackers sending packets that target network protocol communications, which congests network resources and prevents access by legitimate users.
Protocol Exploit Attacks
Transfer Control Protocol (TCP) Synchronize (SYN) Attacks. The TCP process typically includes a full handshake between a sender and a receiver before data packets are sent. The initiating system sends a SYN request and the receiving system will reciprocate by returning an ACK (acknowledgement) along with its own SYN request. The sending system will then send back its own ACK to authorize communication between the two systems. If the receiving system is sent a SYN packet but does not receive an ACK, the receiver will resend a new SYN packet after some time. The processor and memory resources at the receiving system will be reserved for this TCP SYN request until a timeout occurs. Also known as resource starvation attacks, a DDoS TCP SYN attack will capitalize on the TCP function where zombies will send bogus TCP SYN requests to a victim server, which effectively saturates the server processor resources and prevents it from processing legitimate requests. It particularly exploits the three-way handshake between the sending system and the receiving system by sending large volumes of TCP SYN packets to the victim system with spoofed source IP addresses. Eventually, when large volumes of TCP SYN attack requests are sent and repeated, the victim system will run out of memory and processor resources, thus unable to process any legitimate user requests.
PUSH + ACK Attacks
The PUSH + ACK attack is similar to a TCP SYN attack in depleting processor and memory resources of victim systems. A PUSH is a one-bit flag tagged within a TCP header. During the TCP process, packets that are sent to a destination are buffered within the TCP stack. Packets will then be proceeded to be sent to the receiving system after the stack is filled. However, by setting the PUSH bit to one, the sender can request the receiving system to unload the contents of the buffer before the buffer becomes full. TCP then stores incoming data in large blocks for passage on to the receiving system in order to minimize the processing overhead. When this process is repeated with multiple agents, the receiving system will not be able to handle the large volumes of incoming packets and will result in a crash.
Malformed Packet AttacksA malformed packet attack is characterized by zombies sending incorrectly formed IP packets to a victim system to crash it. There are typically two different levels of malformed packet attacks. During IP address attacks, the packet contains the same source and destination IP addresses. This confuses the victim operating system and causes it to crash. During IP packet options attacks, a malformed packet randomizes optional fields within an IP packet and sets all quality of service bits to one, so victim systems will be compelled to utilize additional processing time to analyze traffic. When this attack is repeated using multiple agents, this will lead to a shutdown of the processing ability in victim systems.
CC Attacks
CC Attack is one type of DDoS attack which uses proxy servers to flood victim servers by sending seemingly legitimate requests (usually using HTTP GET). Named after the tool, CC (ChallengeCollapsar), attackers creatively use proxy mechanisms to exploit the numerous and widely available free proxy servers to launch DDoS attacks. The fact that many of these free proxy servers support annonymous mode makes tracking difficult.
Botnet Attacks
A Botnet is a number of Internet computers that have, without their owners’ awareness, been taken over by Command-and-Control(C&C) servers. A spread of malware gives the attackers chances to own a botnet. The main problem with botnets is that they are hidden and may stay undetected unless one is looking for a specific activity. Botnets are associated with different types like IRC, HTTP or P2P for different communication ways between the Bots and C&C Servers.
CC Attack is one type of DDoS attack which uses proxy servers to flood victim servers by sending seemingly legitimate requests (usually using HTTP GET). Named after the tool, CC (ChallengeCollapsar), attackers creatively use proxy mechanisms to exploit the numerous and widely available free proxy servers to launch DDoS attacks. The fact that many of these free proxy servers support annonymous mode makes tracking difficult.
Botnet Attacks
A Botnet is a number of Internet computers that have, without their owners’ awareness, been taken over by Command-and-Control(C&C) servers. A spread of malware gives the attackers chances to own a botnet. The main problem with botnets is that they are hidden and may stay undetected unless one is looking for a specific activity. Botnets are associated with different types like IRC, HTTP or P2P for different communication ways between the Bots and C&C Servers.
 |
Pronto se pondrá los pasos para un ataque de denegación de servicio, solo para tener la idea del como hacerlo 3 o 4 VMs "atacando" un target, a nivel masivo es hacer eso mas grande...
