Dos Attacks On The Internet example essay topic

Denial of Service (DoS) attacks on the Internet Denial of Service attacks have plagued the Internet for many years, yet only recently have hackers been able to advance the way in which they use the DoS attack to gain full effectiveness of its power. The DoS style attack is the same attack used to bump large and powerful networks like yahoo. com or hotmail. com off-line for hours on end. By using the power of the DoS attack, and by spoofing source addresses, hackers are able to create a 'weapon of mass destruction' on the Internet. Spoofing a source address on the Internet, along with executing the DoS style attack, has plagued the Internet for many years.

Spoofing is the interception, alteration, and retransmission of a cipher signal or data in such a way as to mislead the recipient. That is to say a hacker configures his Internet settings to sign all outgoing packets with a source address that does not exist. This, in some cases, allows hackers to use tools to disrupt network activity, or shut it down all together. The largest problem with denial-of-service attacks is that, for the most part, they can't be traced.

To understand the DoS attack one must first have the general idea of packets, the TCP (Transmission Control Protocol) and the 'TCP three-way-handshake'. A Packet is a piece of information on the Internet. Due to the fact that a large piece of data can not be sent all at once, it is broken down into 'packets' or smaller parts of the whole. These packets are identified by 'flag bits', which specify the contents and purpose of the packet. For example, a packet with the SYN (synchronize) flag bit set is initiating a connection from the sender [client] to the recipient [server]. A packet with the ACK (acknowledge) flag bit set is acknowledging the receipt of information from the sender.

A packet with the FIN (finish) bit set is terminating the connection from the sender to the recipient. This exchange is called the TCP three-way handshake. Using this concept we can explore the DoS attack. In a traditional DoS style attack, a single machine attacks another. This is done using a standard TCP connection called the 'three-way handshake'.

DoS attacks are, when a workstation sends a TCP packet to a computer with a deliberately fraudulent (spoofed) source return address. Since the destination address had been spoofed the TCP connection stays open hoping for a reply until it finally times out. The damage is done when several thousand packets are sent, but never able to be replied to, using the entire host's resources trying to track down a source address on the SYN packet that does not exist. This causes legit traffic to be denied because no resources are available to initiate a connection, thus the name Denial of Service attack. This attack is very powerful, but without an extremely fast Internet connection, it can only send as many packets as its connection speed allows.

Hackers, being the smart individuals they are have advanced this DoS style attack much in the past few years. To allocate more bandwidth than that of just one machine, hackers began Distributed Denial of Service (DDoS) attacks. Unlike a DoS-style attack, in which a low rate of fraudulent SYN packets consume a vulnerable server's TCP connection resources, a bandwidth attack creates a brute force flood of malicious 'nonsense' Internet traffic to swamp and consume the target servers or its network connection bandwidth. Because the server is overwhelmed with false traffic, valid packets are unlikely to survive the flood. The DDoS attack is so very powerful because it focuses the combined bandwidth of multiple machines onto a single target machine or network.

Hackers remotely control machines on high bandwidth lines to establish many connections with a server causing a bandwidth flood, that is more information coming in than possible. The real power is created as the individual streams of traffic move across the Internet from their many separate sources, combined by the Internet's routers to form a single massive flood. Since a router cannot determine valid traffic from invalid traffic - to a router all packets are created equal - the network's valid traffic will also be discarded effectively cutting off the network form the rest of the Internet. In the event this is not suitable for the power hungry hacker, a more powerful attack using Distributed Reflection was devised. Distributed Reflection Denial of Service [Ddos] uses core Internet routers and a spoofed source address to do its damage.

All routers on the Internet will accept incoming SYN packets on port 179 of the router. This port is insignificant other than it is available to anyone for use. A hacker initiates a SYN connection to many different routers on port 179 with a spoofed address belonging to the server he wishes to drop. Since the router sees the incoming address to be the victim, it sends an ACK packets to the server, thus attempting to establish a three-way handshake.

The result is hundreds of routers blasting the server with data, knocking it off-line until the attack is over, or until incoming ACK packets on port 179 are blocked. However, many other ports are available for hackers to use, ports 22, 23, 53, 80, 4001, as well as 6665-6669. Blocking all traffic on those ports will stop the flood, but it will also stop legitimate traffic as well. Network administrators are forced to put attack filters in place, which can easily slow down network speed due to constant checking of incoming packets.

Without a complete reconfiguration of every one of the thousands of core Internet routers around the world, prevention of these attacks will continue to be difficult. Internet Service Providers [ISP's] can manually reconfigure their routers to only accept such commands on ports from other trusted connections. However they represent only a small portion of the thousands of routers that make up the Internet, and can only prevent a fraction of the malicious traffic from being generated or reflected. With DoS attacks happening at the rate of nearly 4,000 per week, current efforts just are not enough. DoS attacks on the Internet are an ever changing and evolving tool for hackers over the years. By developing more powerful Distributed and Distributed Reflection attacks, it is possible to knock the Internet's top sites off-line temporarily or even indefinitely.

DoS attacks are very real and troubling to network administrators, and continue to be the tool of choice among hackers to disrupt the Internet. The three-way handshake as we know it will never be the same again.

Bibliography

Collins, Matt. Telephone Interview. 30 Jan. 2003.
DoS Attacks underscore Net's vulnerability". C|Net. 1 Jun. 2001.
13 Mar. 2003.
Gibson, Steve. "Distributed Reflection Denial of Service". Gibson Research Corporation. 22 Feb. 2002.
Spoofing". 23 Aug. 1996.
Institute for Telecommunication Sciences. 27 Feb. 2003.
Study" 24 May 2001.
CNN SCI-TECH. 13 Mar. 2003.