In this lesson,
we're going to discuss a network-based attack
that you may come across while working in the field.
This is known as a denial of service or DoS attack.
Now, a denial of service occurs
when one machine is continually flooding a victim
with requests for services.
That victim system simply won't be able to keep up,
and so it'll run out of memory and eventually crash.
For example, if I have a workstation that begins to send
10 or 20 or 30 different packets of information at once
to a low-powered server,
that server may be able to crash
because it won't be able to handle all those requests.
Now, this was a big problem
when we were dealing with networks 10 or 20 or 30 years ago.
But since that time,
computers and servers have gotten much faster,
and so it is now very difficult for one computer
to cause a denial of service all by itself
by being able to send enough traffic to a server.
But it is important to understand this concept
from a historical perspective
because what is old tends to become new again over time
when it comes to network attacks
and protecting ourselves from them.
To achieve a denial of service attack with a single machine,
attackers are going to use either a TCP SYN Flood,
or an ICMP flood.
A TCP SYN Flood is a specific type
of denial of service attack
that occurs when an attacker initiates
multiple TCP sessions,
but they never complete those sessions.
So remember, TCP operates by conducting
a three-way handshake to establish communication.
This happens by the requester first setting a packet
with the SYN flag set.
Then the server sends back a packet
with both the SYN and the ACK flag set.
And finally, that server sits there and waits for the client
to send back a final packet with just the ACK flag set,
and this will complete the handshake.
Well, in A TCP SYN Flood attack,
the attacker sends a bunch of requests to the server
to establish those connections
by sending out the first part of the handshake.
Those packets will just have the SYN flag set.
The server will then respond and reserve some resources,
like network capacity or memory, for each of the requests,
and it sends back the packet
that has SYN and ACK flags both being set.
Now, up to this point,
everything is operating like a normal TCP handshake, right?
But instead of the attacker acknowledging
that SYN-ACK packet,
they're not going to send back an ACK packet.
Instead, they're just going to ignore it.
And so we end up with a bunch of these half-open connections
that are consuming resources on the server.
If you have too many of these half-open connections,
you could overwhelm the server,
and therefore, you could crash it
through this process of resource exhaustion.
To execute this type of an attack,
the attacker is usually going to spoof their source IP
when conducting their three-way handshake.
This way, when they send the SYN packet over,
the server will respond with the SYN-ACK to a spoofed IP.
and that person isn't expecting it,
and therefore, they're not going to answer it,
and they're just going to drop that packet.
This leaves the connection half open
for the default length of time
until the server closes that connection.
Normally, this will be around three minutes.
So, in that three-minute period,
you can get a lot of these half-open connections.
And if you get too many of them,
it will be resource exhaustion on that server
that could cause it to crash.
You could see an example of that here
with four different spoof IPs being sent to the server
by the attacker.
Now, when the server sends back its responses to those IPs,
which never respond because they weren't starting
a three-way handshake after all,
that server is now just going to sit there
and wait with a bunch of half-open connections.
To help you remember this concept,
I think there's a good analogy that I can give you here.
Let's pretend that you have some kids,
and if you have kids,
you're probably going to relate well to this.
Now, when my kids were really little,
my wife would sometimes get really stressed out
and overwhelmed by them.
This would occur because both kids
would try to get her attention at one time.
For example, my two kids would go running over her and go,
"Hey, mommy, mommy, mommy, I have a question."
"Mommy, mommy, mommy, I want a snack."
"Mommy, mommy, mommy," and things like that.
Now, if one of the kids did this to mom,
mom could handle it.
She can take care of one kid with no issues.
But if both of them did at the same time,
she would have to balance her efforts between the two kids.
And so if my kids had a few friends over,
and now we have five or six kids
who are asking for mom's attention all at once,
she could quickly become overwhelmed and crash.
And that is using the terminology of an overloaded server,
but you get the idea.
Basically, she could become exhausted
and she wouldn't be able to function anymore
and answer all their queries.
This is basically a denial of service.
Now, another form of denial of service attack we have
is known as a Smurf attack.
And again, this is an older type of attack.
It's known as an ICMP flood.
This occurs against the victim's server
by using ICMP traffic instead of TCP traffic.
An ICMP flood occurs when an attacker sends a ping
to a subnet broadcast address with the source IP spoofed,
and that source IP is now going to be showing
as the victimized server.
By doing this, all the devices on that subnet
are going to respond back to the server,
and this can start using up all their processing power,
their memory, and their bandwidth,
and this could lead to resource exhaustion
and, again, a possible server crash.
In this example, an attacker spoofs their source address
and pretends that they are the server.
Now, this attacker sends out a single packet
to the subnet broadcast address of 192.168.1.255,
and it says, "Hey, I'm the server at 10.1.1.2."
Now, in response to this, all the clients in the broadcast,
in this example, a class C subnet
with up to 254 clients on it,
will start sending back a response to that server
since they all saw the source IP of this request
as that of the server and not the attacker.
This essentially is going to amplify the denial of service
against the server
because the attacker can now speed up this process
even more by sending out more of these requests.
They can send the same type of requests over and over
to multiple different subnets,
and they can use different broadcast addresses
to get all these things amplified back towards
that first victim.
Now, because of this threat of a denial of service
using ICMP traffic, which is the same traffic
that's used by the ping tool,
a lot of networks will block providing responses
to ping requests and instead, they'll just drop
or ignore these requests.
For this reason, ICMP floods are not as common
as they used to be.
But if you misconfigured your network,
it still could be a viable attack method
for an attacker to use on your network.
All right, let's take this concept of a denial of service
one step further and add more attacking machines
that are focused on overwhelming a single server
all at the same time.
This is known as a distributed denial of service
or DDoS attack.
Now, in a distributed denial of service attack,
the attacker will use 100, 1,000 or even 100,000 computers
all at the same time asking for access to a single server.
This way, they can consume up all of that server's
processing, memory and bandwidth resources,
leading to that server exhaustion and a server crash.
Now, often, these machines can become part of the attack
and they won't even know they're part of that attack
because they are essentially part of a botnet
and they're now being controlled as a zombie.
A botnet is simply a collection of compromised computers
under the control of a single master node.
A zombie, on the other hand,
is any one of these individually compromised computers.
Once a device becomes part of a botnet,
it can be controlled by a master node
as a C2 or command and control server.
An attacker who controls a C2 server
will also control all the zombies
that operate as part of this botnet.
This isn't just a single computer anymore,
but instead it could be hundreds of thousands of machines,
all with the ability to be coordinated
into attacking a single target.
So when the attacker wants to launch
a distributed denial of service attack against a website,
like the Wall Street Journal,
they simply send a command
from their computer to the C2 server,
and then the C2 server will then relay that command
down to some or all of the zombies under its control.
This allows them to conduct a massive attack
that can even take down some really large websites
if they have enough zombies.
Now, the challenge for an attacker here
is that as more and more organizations move to the cloud,
it becomes harder and harder to overwhelm their servers.
After all, if you're using elastic cloud servers,
you can simply horizontally scale out
to answer up for all this new demand
that's being sent to you from all these different zombies
during a distributed denial service attack.
But that doesn't mean you shouldn't try to prevent
these types of distributed denial of service attacks
from happening.
After all, with cloud-based resources,
you're still paying for all that compute
and bandwidth resources that are being used
to answer up for all these attacking requests.
So even if you can withstand the attack and outlast it
by horizontally scaling out on your servers,
it could result in a huge bill at the end of the month,
and none of that bandwidth
was actually doing anything useful for you
because it wasn't from legitimate customers or users.
It was just from people who were attacking you
and you're still paying for it.