Cyberstudy
PDF p.348 In progress

Distributed Denial of Service Attacks

Open PDF at p.348 20 flashcards

Summary

PDF p.348

A Distributed Denial of Service (DDoS) attack reduces the availability of a resource by overwhelming it with traffic from multiple sources. These attacks can target physical hardware, infrastructure, or exploit protocol weaknesses.

Detailed explanation

PDF p.348
  • Denial of Service (DoS)
    • Definition: Reduces resource availability.
    • Targets: Physical hardware, infrastructure, CPU, memory, storage, network bandwidth.
    • Methods: Malware-based attacks, protocol exploitation.
  • Distributed Denial of Service (DDoS)
    • Definition: DoS attack launched from multiple hosts simultaneously.
    • Botnets: Compromised machines used as handlers to control thousands or millions of bots.
    • Types
      • Bandwidth Consumption: Overwhelms network bandwidth with ordinary requests.
      • Resource Exhaustion: Bombards victim host with requests, consuming CPU and memory.
  • SYN Flood Attack
    • Mechanism: Withholds client's ACK packet during TCP handshake.
    • Effect: Fills server's state table with pending connections, preventing genuine traffic.
  • Reflected Attacks
    • Definition: Spoofs victim's IP address to direct responses from third-party servers to the victim.
    • Effect: Consumes victim's bandwidth.
    • Asymmetric Threat: Effective attacks with fewer resources than the victim.
  • Amplified Attacks
    • Definition: Targets weaknesses in application protocols to increase attack effectiveness.
    • Protocols: DNS, NTP, CLDAP, memcached.
    • Mechanism: Manipulates requests to force large data responses.
  • DDoS Indicators
    • Traffic Spikes: Unexplained increases in traffic.
    • Mitigation: High availability services (load balancing, cluster services), stateful firewalls.
    • Challenges: Randomly spoofed source addresses, bot-launched attacks.

Important terms

taken from the text above
Denial of Service (DoS)
Reduces resource availability.
Targets
Physical hardware, infrastructure, CPU, memory, storage, network bandwidth.
Distributed Denial of Service (DDoS)
DoS attack launched from multiple hosts simultaneously.
Botnets
Compromised machines used as handlers to control thousands or millions of bots.
Bandwidth Consumption
Overwhelms network bandwidth with ordinary requests.
Resource Exhaustion
Bombards victim host with requests, consuming CPU and memory.
Effect
Fills server's state table with pending connections, preventing genuine traffic.
Reflected Attacks
Spoofs victim's IP address to direct responses from third-party servers to the victim.
Asymmetric Threat
Effective attacks with fewer resources than the victim.
Amplified Attacks
Targets weaknesses in application protocols to increase attack effectiveness.
Protocols
DNS, NTP, CLDAP, memcached.
Traffic Spikes
Unexplained increases in traffic.
DDoS Distributed Denial of Service DoS Denial of Service

What I should remember

Key Points PDF p.348
  • DoS
    • Definition: Reduces resource availability.
    • Targets: Hardware, infrastructure, CPU, memory, bandwidth.
  • DDoS
    • Definition: Multiple hosts, botnets.
    • Types: Bandwidth consumption, resource exhaustion.
  • SYN Flood Attack
    • Mechanism: Withholds ACK packet, fills state table.
  • Reflected Attacks
    • Definition: Spoofs IP, directs responses to victim.
    • Effect: Consumes bandwidth.
  • Amplified Attacks
    • Definition: Exploits protocol weaknesses.
    • Protocols: DNS, NTP, CLDAP, memcached.
  • DDoS Indicators
    • Traffic Spikes: Unexplained increases.
    • Mitigation: Load balancing, firewalls.
    • Challenges: Spoofed addresses, bot attacks.