1. What is DOS attack?
A denial-of-service (DoS) is any type of attack where the attackers (hackers)
attempt to prevent legitimate users from accessing the service. In a DoS attack, the
attacker usually sends excessive messages asking the network or server to
authenticate requests that have invalid return addresses. The network or server will
not be able to find the return address of the attacker when sending the
authentication approval, causing the server to wait before closing the connection.
When the server closes the connection, the attacker sends more authentication
messages with invalid return addresses. Hence, the process of authentication and
server wait will begin again, keeping the network or server busy.
2. How it works?
A DoS attack can be done in a several ways. The basic types of DoS attack include:
Flooding the network to prevent legitimate network traffic
Disrupting the connections between two machines, thus preventing access to a
service
Preventing a particular individual from accessing a service.
Disrupting a service to a specific system or individual
Disrupting the state of information, such resetting of TCP sessions
Another variant of the DoS is the smurf attack. This involves emails with automatic
responses. If someone emails hundreds of email messages with a fake return email
address to hundreds of people in an organization with an autoresponder on in their
email, the initial sent messages can become thousands sent to the fake email
address. If that fake email address actually belongs to someone, this can overwhelm
that person's account.DoS attacks can cause the following problems:
Ineffective services
Inaccessible services
Interruption of network traffic
Connection interference
3. What is DDOS attack?
DoS stands for Distributed Denial of Service. A malicious hacker uses a DDoS attack to make a computer
resource (i.e. website, application, e-mail, voicemail, network) stop responding to legitimate users. The
malicious hacker does this by commanding a fleet of remotely-controlled computers to send a flood of
network traffic to the target. The target becomes so busy dealing with the attackers requests that it
doesnt have time to respond to legitimate users requests. That can cause the target system to stop
responding, resulting in long delays and outages.
4.How it works?
Distributed Denial of Service Attacks
Sometimes a cracker uses anetwork of zombie computers to sabotage a specific Web
site or server. The idea is pretty simple -- a cracker tells all the computers on his
botnet to contact a specific server or Web site repeatedly. The sudden increase in
traffic can cause the site to load very slowly for legitimate users. Sometimes the
traffic is enough to shut the site down completely. We call this kind of an attack
a Distributed Denial of Service (DDoS) attack.
Some particularly tricky botnets use uncorrupted computers as part of the attack.
Here's how it works: the cracker sends the command to initiate the attack to
his zombiearmy. Each computer within the army sends an electronic connection
request to an innocent computer called a reflector. When the reflector receives the
request, it looks like it originates not from the zombies, but from the ultimate victim
of the attack. The reflectors send information to the victim system, and eventually
the system's performance suffers or it shuts down completely as it is inundated with
multiple unsolicited responses from several computers at once.
From the perspective of the victim, it looks like the reflectors attacked the system.
From the perspective of the reflectors, it seems like the victimized system requested
the packets. The zombie computers remain hidden, and even more out of sight is
the cracker himself.
The list of DDoS attack victims includes some pretty major names. Microsoft
suffered an attack from a DDoS called MyDoom. Crackers have targeted other
major Internet players like Amazon, CNN, Yahoo and eBay. The DDoS names range
from mildly amusing to disturbing:
Ping of Death - bots create huge electronic packets and sends them on to victims
Mailbomb - bots send a massive amount of e-mail, crashing e-mail servers
Smurf Attack - bots send Internet Control Message Protocol (ICMP) messages to
reflectors, see above illustration
Teardrop - bots send pieces of an illegitimate packet; the victim system tries to
recombine the pieces into a packet and crashes as a result
Once an army begins a DDoS attack against a victim system, there are few things
the system administrator can do to prevent catastrophe. He could choose to limit
the amount of traffic allowed on his server, but this restricts legitimate Internet
connections and zombies alike. If the administrator can determine the origin of the
attacks, he can filter the traffic. Unfortunately, since many zombie computers
disguise (or spoof) their addresses, this isn't always easy to do.
5. Methods to protect from DDOS attack
Preventing Denial of Service Attacks
Rapid identification and response can prevent DoS attacks. The first challenge for
any DoS protection scheme is to quickly and effectively identify incoming traffic as
malicious. Once the flood of traffic is identified as a DoS attack, rather than for
example a spike in legitimate site traffic, an effective response will generally
involve setting up a scalable infrastructure to absorb the attack, until the source is
identified and blocked.
A specifically targeted DDoS attack is impossible to prevent, but there are excellent
and effective tools that can help mitigate the impact of such an attack.
