Denial of Service (DoS)
A denial of service (DoS) attack is an incident in which a user or organization is deprived of the services of a resource they would normally expect to have. In a distributed denial-of-service, large numbers of compromised systems (sometimes called a botnet) attack a single target.Although a DoS attack does not usually result in the theft of information or other security loss, it can cost the target person or company a great deal of time and money. Typically, the loss of service is the inability of a particular network service, such as e-mail, to be available or the temporary loss of all network connectivity and services. A denial of service attack can also destroy programming and files in affected computer systems. In some cases, DoS attacks have forced Web sites accessed by millions of people to temporarily cease operation.
Common forms of denial of service attacks are:
Buffer Overflow Attacks
The most common kind of DoS attack is simply to send more traffic to a network address than the programmers who planned its data buffers anticipated someone might send. The attacker may be aware that the target system has a weakness that can be exploited or the attacker may simply try the attack in case it might work. A few of the better-known attacks based on the buffer characteristics of a program or system include:
• Sending e-mail messages that have attachments with 256-character file names to Netscape and Microsoft mail programs
• Sending oversized Internet Control Message Protocol (ICMP) packets (this is also known as the Packet Internet or Inter-Network Groper (PING) of death)
• Sending to a user of the Pine e-mail progam a message with a "From" address larger than 256 characters
SYN Attack
When a session is initiated between the Transport Control Program (TCP) client and server in a network, a very small buffer space exists to handle the usually rapid "hand-shaking" exchange of messages that sets up the session. The session-establishing packets include a SYN field that identifies the sequence in the message exchange. An attacker can send a number of connection requests very rapidly and then fail to respond to the reply. This leaves the first packet in the buffer so that other, legitimate connection requests can't be accommodated. Although the packet in the buffer is dropped after a certain period of time without a reply, the effect of many of these bogus connection requests is to make it difficult for legitimate requests for a session to get established. In general, this problem depends on the operating system providing correct settings or allowing the network administrator to tune the size of the buffer and the timeout period.
Teardrop Attack
This type of denial of service attack exploits the way that the Internet Protocol (IP) requires a packet that is too large for the next router to handle be divided into fragments. The fragment packet identifies an offset to the beginning of the first packet that enables the entire packet to be reassembled by the receiving system. In the teardrop attack, the attacker's IP puts a confusing offset value in the second or later fragment. If the receiving operating system does not have a plan for this situation, it can cause the system to crash.
Smurf Attack
In this attack, the perpetrator sends an IP ping (or "echo my message back to me") request to a receiving site The ping packet specifies that it be broadcast to a number of hosts within the receiving site's local network. The packet also indicates that the request is from another site, the target site that is to receive the denial of service. (Sending a packet with someone else's return address in it is called spoofing the return address.) The result will be lots of ping replies flooding back to the innocent, spoofed host. If the flood is great enough, the spoofed host will no longer be able to receive or distinguish real traffic.
Viruses
Computer viruses, which replicate across a network in various ways, can be viewed as denial-of-service attacks where the victim is not usually specifically targeted but simply a host unlucky enough to get the virus. Depending on the particular virus, the denial of service can be hardly noticeable ranging all the way through disastrous.
Physical Infrastructure Attacks
Here, someone may simply snip a fiber optic cable. This kind of attack is usually mitigated by the fact that traffic can sometimes quickly be rerouted.
There are ways of preventing many forms of DoS attacks.
Distributed Denial of Service
The last thing an administrator wants to deal with is a Distributed Denial of Service (DDoS) attack. Yet, together with the recent rise of hacktivism, DDoS attacks are increasingly becoming a threat that IT admins need to prepared for.
Just recently, the CIA’s main website was allegedly brought down by a DDoS attack launched by Anonymous. DDoS attacks work by essentially leveraging the power of hijacked computer systems (through the use of botnets, for example) to send a huge amount of traffic to a single designated target. This simple concept can be frighteningly effective in bringing down huge sites.
The worst thing about DDoS attacks is that they do not prey on the victim’s weaknesses; therefore being cautious and using the right tools and protection, as in the case of hacking attacks, is not enough.
Despite the threat, there’s still an effective way to protect your network against these attacks – network design decisions. A DDoS is nothing more than a never-ending stream of requests from a large number of sources. The only way to protect against this is by having a system to identify the DDoS source and block it.
This is easier said than done. Identifying the source of a DDoS attack can be tricky and, in most cases, involves tweaking an intrusion detection system (IDS) to differentiate between legitimate requests and attacks. Testing its effectiveness is not easy either. In any case, this will cause quite a few false positives.
Once an attack source is identified, all you need to do is configure the Firewall to block that source until the attack stops. Even so, if your Internet bandwidth is overwhelmed by requests, your site will still probably be inaccessible.
And it doesn’t end here; if you’re the target of a DDoS attack, the next problem to deal with is your Internet Service Provider (ISP). If the attack is large enough, the ISP may opt to cut your route out of the system to save bandwidth and avoid degrading performance for other customers. In this case, the consequences may be worse than the actual impact of the DDoS attack itself as your downtime is likely to be longer. For this reason, you may want to check what your ISP polices on DDoS attacks are before signing up for the service.
Ironically, the ISP also happens to be your best ally in the event of a DDoS attack since their infrastructure is most likely to have the capability to handle the huge amount of traffic if the Firewall is hosted on their systems rather than at your end. This is also something you might want to explore with the ISP.
Defending against a DDoS attack is possible mostly through design choices, and having an infrastructure in place that can help mitigate the damage should you be the target of a DDoS attack.
These attacks are really easy for the hackers to crash a website. If there exists a big website then a group of hackers may collaborate to make their themselves strong. These attacks cannot be traced easily because of the proxy server technology.