Computer Security & Privacy

Questions and Answers

Define a denial-of-service (DoS) attack.

A denial of service (DoS) attack is an action that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources such as central processing units (CPU), memory, bandwidth, and disk space.

What type of resources are targeted by such DoS attacks?

Resources that could be attacked include any limited resources such as network bandwidth, system resources, or application resources.

What is the goal of a flooding attack?

The goal of a flooding attack is generally to overload the network capacity on some link to a server, or alternatively to overload the server's ability to handle and respond to this traffic.

What types of packets are commonly used for flooding attacks?

Common flooding attacks use ICMP, UDP, or TCP SYN packet types. Signup and view all the answers

Why do many DoS attacks use packets with spoofed addresses?

Many DoS attacks use packets with spoofed source addresses so any response packets that result are no longer reflected back to the original source system. Signup and view all the answers

What is 'backscatter traffic'?

Backscatter traffic refers to packets generated in response to DoS attack packets with a forged random source address. Signup and view all the answers

Define a distributed denial-of-service (DDoS) attack.

A distributed denial-of-service (DDoS) attack uses multiple attacking systems, often using compromised user workstations or PCs. Signup and view all the answers

What architecture does a DDoS attack typically use?

DDoS attack botnets typically use a control hierarchy, where a small number of systems act as handlers controlling a much larger number of agent systems. Signup and view all the answers

Define a reflection attack.

In a reflection attack, the attacker sends a network packet with a spoofed source address to a service, and the service responds to the spoofed source address that belongs to the actual attack target. Signup and view all the answers

Define an amplification attack.

An amplification attack involves sending packets to intermediaries with a spoofed source address for the target system, generating multiple response packets for each original packet sent. Signup and view all the answers

Study Notes

Denial of Service (DoS) Attack

A DoS attack prevents or impairs authorized access to networks, systems, or applications by depleting resources like CPU, memory, bandwidth, or disk space.
Targeted resources include limited network bandwidth, system resources, and application resources.

Flooding Attacks

The primary goal of a flooding attack is to overwhelm network capacity or the server’s ability to manage incoming traffic.
Common packet types used in flooding attacks include ICMP, UDP, and TCP SYN packets.

Spoofed Addresses in DoS Attacks

Many DoS attacks utilize packets with forged source addresses, causing responses to be scattered across the Internet rather than returning to the attacker.
This leads to an increase in traffic directed at the target system with responses potentially sent to random addresses.

Backscatter Traffic

Backscatter traffic consists of packets generated as responses to spoofed DoS packets, providing insight into the type and scale of attacks.
It can inform about attacks using forged random source addresses, including single and distributed flooding or SYN spoofing attacks.
It does not provide information on attacks using direct source addresses or those based on reflection or amplification techniques.

Distributed Denial-of-Service (DDoS) Attack

A DDoS attack involves multiple attackers' systems, often compromised user PCs, forming a botnet under one attacker’s control.
Utilizes several systems to greatly increase traffic volume and makes tracing the attack back to the source more challenging.

DDoS Attack Architecture

DDoS botnets feature a control hierarchy, with a few systems acting as handlers overseeing numerous agent systems.
Attackers can deploy commands efficiently by sending a single command to a handler, which then relays it to all controlled agents.

Reflection Attacks

In a reflection attack, spoofed packets are sent to a server, with responses flooding a target’s network link.
They leverage legitimate server systems, making them easier to implement and harder to trace.

Amplification Attacks

Amplification attacks involve sending requests to intermediaries with spoofed target addresses, generating numerous responses for each request.
Methods often include directing requests to a network’s broadcast address or using services like DNS that produce larger response packets than the original requests.

Description

Test your knowledge on denial-of-service attacks in Chapter 7 of Computer Security & Privacy. This quiz covers key definitions and types of resources targeted by DoS attacks. Dive into the world of cybersecurity and understand how these attacks affect networks and systems.