Denial of Service Attacks - Revision history

NKirnbauer: /* Transport Layer attacks */

2024-08-23T06:37:06Z

Transport Layer attacks

← Older revision		Revision as of 06:37, 23 August 2024
Line 109:		Line 109:

	=== Transport Layer attacks ===		=== Transport Layer attacks ===
	Transport layer attacks like the [[Blackhole ]] try to be the main route between two networks and then filter their victim’s data traffic.		Transport layer attacks like the [[Wormhole and Blackhole DoS Attack\|Blackhole]] try to be the main route between two networks and then filter their victim’s data traffic.


	=== Application Layer attacks ===		=== Application Layer attacks ===

NKirnbauer at 19:03, 22 August 2024

2024-08-22T19:03:29Z

← Older revision		Revision as of 19:03, 22 August 2024
Line 29:		Line 29:
	=== Zero Day Attack ===		=== Zero Day Attack ===

	Zero-day attacks use vulnerabilities that are undiscovered by the manufacturers as the main entry point of the attack. The manufacturer is often powerless against zero-day attack, because he must research the vulnerability before they can take efficient counter measures.		Zero-day attacks use vulnerabilities that are undiscovered by the manufacturers as the main entry point of the attack. The manufacturer is often powerless against zero-day attack, because they must research the vulnerability before they can take efficient counter measures.

	== Types of DoS / DDos Attacks ==		== Types of DoS / DDos Attacks ==
Line 36:		Line 36:
	[[File:Volnumetric DoS Attack.png\|thumb\|right\|400px\|\|Volnumetric DoS Attack]]		[[File:Volnumetric DoS Attack.png\|thumb\|right\|400px\|\|Volnumetric DoS Attack]]

	A Volumetric attack is performed by a malicious user and ~~his~~ powerful rig. The malicious user sends a flood of ICMP or TCP packets to the victim to deplete its bandwidth or processing power. The basic form of volumetric attacks against websites is not effective anymore, due to the growth of the internet and Webservices. Nowadays Volumetric Attacks are used with Botnets to be much more effective and many other advanced DoS attacks use this principal as their basis.		A Volumetric attack is performed by a malicious user and their powerful rig. The malicious user sends a flood of ICMP or TCP packets to the victim to deplete its bandwidth or processing power. The basic form of volumetric attacks against websites is not effective anymore, due to the growth of the internet and Webservices. Nowadays Volumetric Attacks are used with Botnets to be much more effective and many other advanced DoS attacks use this principal as their basis.

	=== Reflection Attack ===		=== Reflection Attack ===
Line 42:		Line 42:
	[[File:Rflection DoS Attack.png\|thumb\|right\|400px\|\|Reflection DoS Attack]]		[[File:Rflection DoS Attack.png\|thumb\|right\|400px\|\|Reflection DoS Attack]]

	This type of attack is performed by using a range of innocent proxies to flood the victim network or device with packets. The malicious user simply sends an ICMP Request to ~~his~~ proxies that have been altered with a spoofed IP address header field. The innocent Proxies reply to the victim in a legit way and deplete the victim’s network. The proxies are unknowingly performed a DoS attack and the malicious user can cover ~~his~~ tracks.		This type of attack is performed by using a range of innocent proxies to flood the victim network or device with packets. The malicious user simply sends an ICMP Request to their proxies that have been altered with a spoofed IP address header field. The innocent Proxies reply to the victim in a legit way and deplete the victim’s network. The proxies are unknowingly performed a DoS attack and the malicious user can cover their tracks.

	=== Amplification Attacks ===		=== Amplification Attacks ===

Ikramer at 17:38, 12 March 2024

2024-03-12T17:38:09Z

← Older revision		Revision as of 17:38, 12 March 2024
Line 146:		Line 146:
	[12] IEEE 2012: DoS Attacks in Mobile Ad Hoc Networks: A Survey		[12] IEEE 2012: DoS Attacks in Mobile Ad Hoc Networks: A Survey

	Category:Basic		[[Category:Basic]]
	[[]]

Cskallak: /* References */

2020-05-22T10:00:07Z

References

Cskallak: /* References */

2020-05-22T09:59:37Z

References

← Older revision		Revision as of 09:59, 22 May 2020
Line 117:		Line 117:
	== References ==		== References ==
	Introduction:		Introduction:
	* [1] https://www.cisco.com/c/en/us/products/security/common-cyberattacks.html		[1] https://www.cisco.com/c/en/us/products/security/common-cyberattacks.html
	* [2] https://www.wired.com/story/github-ddos-memcached/		[2] https://www.wired.com/story/github-ddos-memcached/
	* [3] https://ccdcoe.org/uploads/2018/10/12_NAZARIO-Politically-Motivated-DDoS.pdf		[3] https://ccdcoe.org/uploads/2018/10/12_NAZARIO-Politically-Motivated-DDoS.pdf
	Target points of Denial of Service Attacks:		Target points of Denial of Service Attacks:
	* [4] IEEE 2015: Botnet in DDoS Attacks: Trends and Challenge		[4] IEEE 2015: Botnet in DDoS Attacks: Trends and Challenge
	Types of DoS / DDos Attacks:		Types of DoS / DDos Attacks:
	* [5] https://en.wikipedia.org/wiki/Denial-of-service_attack		[5] https://en.wikipedia.org/wiki/Denial-of-service_attack
	* [6] IEEE: DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications		[6] IEEE: DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications
	~~Amplification Attacks:~~		[7] https://blog.cloudflare.com/65gbps-ddos-no-problem/
	* [7] https://blog.cloudflare.com/65gbps-ddos-no-problem/		[8] https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/
	* [8] https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/		[9] https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/
	* [9] https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/		[10]https://www.us-cert.gov/ncas/alerts/TA14-017A
	* [10]https://www.us-cert.gov/ncas/alerts/TA14-017A		[11] https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris
			[12] IEEE 2012: DoS Attacks in Mobile Ad Hoc Networks: A Survey

	Category:Basic		Category:Basic
	[[]]		[[]]

Cskallak: /* Types of DoS / DDos Attacks */

2020-05-22T09:56:03Z

Types of DoS / DDos Attacks

← Older revision		Revision as of 09:56, 22 May 2020
Line 107:		Line 107:
	\|-		\|-
	\|}		\|}

			=== Transport Layer attacks ===
			Transport layer attacks like the [[Blackhole ]] try to be the main route between two networks and then filter their victim’s data traffic.


			=== Application Layer attacks ===
			This type of DoS attacks uses system weaknesses and protocol vulnerabilities to take down servers. Protocol attacks use vulnerabilities in the specification, like ping of death which produces a buffer overflow by sending malformed ICMP packets. Low and Slow attacks are subgroup of Application Layer attacks, that takes down services by using a low bandwidth and proceeding slow. The [[Slow Loris DoS Attack]] exhausts apache2 servers by open multiple HTTP connections and keep them alive as long as possible.

	== References ==		== References ==

Cskallak: /* Amplification Attacks */

2020-05-22T09:16:41Z

Amplification Attacks

← Older revision		Revision as of 09:16, 22 May 2020
Line 48:		Line 48:
	[[File:Amplification DoS Attack.png\|thumb\|right\|400px\|\|Amplification DoS Attack]]		[[File:Amplification DoS Attack.png\|thumb\|right\|400px\|\|Amplification DoS Attack]]

	Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an multiplication factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest DDoS attack of 2018 on GitHub since then. The following table shows the Amplification factors of Amplifications Attacks[10]:		Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an multiplication factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest [https://wiki.elvis.science/index.php?title=DDoS_Attack_on_GitHub DDoS attack of 2018 on GitHub] since then. The following table shows the Amplification factors of Amplifications Attacks[10]:

	{\| class="wikitable"		{\| class="wikitable"

Cskallak: /* Amplification Attacks */

2020-05-22T09:10:40Z

Amplification Attacks

← Older revision		Revision as of 09:10, 22 May 2020
Line 48:		Line 48:
	[[File:Amplification DoS Attack.png\|thumb\|right\|400px\|\|Amplification DoS Attack]]		[[File:Amplification DoS Attack.png\|thumb\|right\|400px\|\|Amplification DoS Attack]]

	Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an ~~multiplicator~~ factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest DDoS attack of 2018 on GitHub~~. For further information Read this ('''Link to github entry''')~~. The following table shows the Amplification factors of Amplifications Attacks[10]:		Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an multiplication factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest DDoS attack of 2018 on GitHub since then. The following table shows the Amplification factors of Amplifications Attacks[10]:

	{\| class="wikitable"		{\| class="wikitable"

Cskallak: /* Amplification Attacks */

2020-05-22T08:39:45Z

Amplification Attacks

← Older revision		Revision as of 08:39, 22 May 2020
Line 46:		Line 46:
	=== Amplification Attacks ===		=== Amplification Attacks ===

	[[File:~~Volnumetric~~ DoS Attack.png\|thumb\|right\|400px\|\|~~Volnumetric~~ DoS Attack]]		[[File:Amplification DoS Attack.png\|thumb\|right\|400px\|\|Amplification DoS Attack]]

	Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an multiplicator factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest DDoS attack of 2018 on GitHub. For further information Read this ('''Link to github entry'''). The following table shows the Amplification factors of Amplifications Attacks[10]:		Amplification attacks exploit the connection-less design of UDP which does not validate source IP addresses and Internet Services that send big Response Message data with small requests. One well known example for this is the DNS Amplification Attack. This Attack uses open DNS resolve server which are accessible by everyone. To trigger an amplified response the attacker sends a request for all DNS records of a zone with a spoofed source IP address. This will result in an extremely large stream of response messages to the victim. NTP server can be used quite similar by using the monlist command with a spoofed source IP address. This command triggers a response with the last 600 source IP addresses which used the NTP Service before. This attack has an multiplicator factor of 556. Another well-known for amplification used Protocol is the Memcache Protocol that allowed the biggest DDoS attack of 2018 on GitHub. For further information Read this ('''Link to github entry'''). The following table shows the Amplification factors of Amplifications Attacks[10]:

Cskallak: /* Reflection Attack */

2020-05-22T08:38:32Z

Reflection Attack

← Older revision		Revision as of 08:38, 22 May 2020
Line 40:		Line 40:
	=== Reflection Attack ===		=== Reflection Attack ===

	[[File:Rflection DoS Attack.png\|thumb\|right\|400px\|\|~~Rrflection~~ DoS Attack]]		[[File:Rflection DoS Attack.png\|thumb\|right\|400px\|\|Reflection DoS Attack]]

	This type of attack is performed by using a range of innocent proxies to flood the victim network or device with packets. The malicious user simply sends an ICMP Request to his proxies that have been altered with a spoofed IP address header field. The innocent Proxies reply to the victim in a legit way and deplete the victim’s network. The proxies are unknowingly performed a DoS attack and the malicious user can cover his tracks.		This type of attack is performed by using a range of innocent proxies to flood the victim network or device with packets. The malicious user simply sends an ICMP Request to his proxies that have been altered with a spoofed IP address header field. The innocent Proxies reply to the victim in a legit way and deplete the victim’s network. The proxies are unknowingly performed a DoS attack and the malicious user can cover his tracks.

← Older revision		Revision as of 10:00, 22 May 2020
Line 117:		Line 117:
	== References ==		== References ==
	Introduction:		Introduction:

	[1] https://www.cisco.com/c/en/us/products/security/common-cyberattacks.html		[1] https://www.cisco.com/c/en/us/products/security/common-cyberattacks.html

	[2] https://www.wired.com/story/github-ddos-memcached/		[2] https://www.wired.com/story/github-ddos-memcached/

	[3] https://ccdcoe.org/uploads/2018/10/12_NAZARIO-Politically-Motivated-DDoS.pdf		[3] https://ccdcoe.org/uploads/2018/10/12_NAZARIO-Politically-Motivated-DDoS.pdf

	Target points of Denial of Service Attacks:		Target points of Denial of Service Attacks:

	[4] IEEE 2015: Botnet in DDoS Attacks: Trends and Challenge		[4] IEEE 2015: Botnet in DDoS Attacks: Trends and Challenge

	Types of DoS / DDos Attacks:		Types of DoS / DDos Attacks:

	[5] https://en.wikipedia.org/wiki/Denial-of-service_attack		[5] https://en.wikipedia.org/wiki/Denial-of-service_attack

	[6] IEEE: DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications		[6] IEEE: DDoS Attacks at the Application Layer: Challenges and Research Perspectives for Safeguarding Web Applications

	[7] https://blog.cloudflare.com/65gbps-ddos-no-problem/		[7] https://blog.cloudflare.com/65gbps-ddos-no-problem/

	[8] https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/		[8] https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/

	[9] https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/		[9] https://www.cloudflare.com/learning/ddos/famous-ddos-attacks/

	[10]https://www.us-cert.gov/ncas/alerts/TA14-017A		[10]https://www.us-cert.gov/ncas/alerts/TA14-017A

	[11] https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris		[11] https://web.archive.org/web/20150426090206/http://ha.ckers.org/slowloris

	[12] IEEE 2012: DoS Attacks in Mobile Ad Hoc Networks: A Survey		[12] IEEE 2012: DoS Attacks in Mobile Ad Hoc Networks: A Survey

	Category:Basic		Category:Basic
	[[]]		[[]]