BESIC CONCEPT OF DOS ATTACK

DoS(Denial-of-service ) Attack:- As we know Cyber-attacks have become a fact of life. One common type of cyber threat is a denial of service (DoS) that—as its name implies—renders websites and other online resources unavailable to intended users.In a DoS attack an attacker attempts to prevent legitimate users from accessing information or services , by targeting your computer and its network connection.This type of attack is usually implemented by hitting the target resource such as web server with too many requests at the same time & this results in the server failing to respond to all the requests. The effect of this can may be servers or slowing them down.

“A DoS (Denial-of-service) attack is when an attacker is trying to generate more traffic than you have resources to handle..”

Types of DoS Attacks:-
*. DoS
*. Distributed DoS

1) DoS
Simply it means, that one computer and one internet connection is used to flood a server with packets (TCP / UDP). The main point of a DoS attack is to overload the targeted server’s bandwidth and other resources. This will make the sever Inaccessible to others,thereby blocking the website or whatever else is hosted there.A successful DoS attack is a highly noticeable event impacting the entire online user base.

HOW IT WORKS..??

” DoS Attack occurs when an Attacker “Floods ” a network with information”
When you type a URL for a particular website into your browser, you are sending a request to that site’s computer server to view page. All requests have false return addresses, so the server can’t find the user when it tries to send the authentication approval, so if an attacker overloads the server with requests,it can’t process your request.This is “denial of service”(DoS) because you can’t access that site.

2) Distributed DoS

A Distributed denial-of-service (DDoS) is where the attack source is more than one–and often thousands of-unique IP addresses. In DDoS multiple systems are used to attack a single target.Sometimes a cracker uses a network of zombie computers to crack a specific Web site or server.
“A cracker tells all the computers on his botnet to contact a specific server or Web site repeatedly. The sudden increase in traffic can cause the site to load very slowly for legal users”. Sometimes the traffic is enough to shut the site down completely.That kind of an attack is Distributed Denial of Service (DDoS) attack.
Botnet (also known as a zombie army) is a number of Internet computers that, although their owners are unaware of it, have been set up to forward transmissions (including spam or viruses) to other computers on the Internet.

HOW IT WORKS..??

The cracker sends the command to start the attack to his zombie army. Each computer within the army sends an electronic connection request to an innocent computer called a reflector. When the reflector receives the request, it looks like it start not from the zombies, but from the ultimate victim of the attack. The reflectors send information to the victim system, and in the end system’s performance suffers or it shuts down completely.
Zombie is a computer connected to the Internet that has been compromised by a hacker, computer virus or Trojan horse and can be used to perform malicious tasks of one sort or another under remote direction.

Types of attack by DoS:-

*. Ping of Death:- “How to crash your
operating system”
Ping of death is a type of DoS attack in which the attacker attempt to crash, or freeze the targeted computer of services by sending over-sized packets using a simple ping command.In ping of death attacker sends a ping request larger than 65,536 bytes, which is the maximum size that IP allows.While a ping larger than 65,536 bytes, is too large to fit in a packet so that can transmitted, TCP/IP allows a packet to be fragmented, essentially breaking the packet into smaller segments.Attacker took advantages of that flaw(break) by fragmenting packets that when received are total more than the allowed number of bytes and would effectively cause a buffer overload on the operating system at the receiving end,crashing the system.
Buffer overload is the condition wherein the data transferred to buffer exceeds the storage capacity of the buffer and some of the data “overflows” into another buffer.Since buffer can only hold a specific amount of data, when the capactity has been reached over the data has to flow somewhere else, typically into another buffer,which can corrupt data that is already contained in that buffer.

*. (S)SYN flood:-
A SYN(synchronization) flood is a type of DoS attack in which attacker sends a series of SYN request to a target’s system.The attack involves having a client repeatedly send SYN (synchronization) packets to every port on a server, using fake IP addresses. In a normal three-way handshake, the client would return an ACK (acknowledged) packet to confirm that the server’s SYN/ACK packet was received, and communications would then commence. However, in a SYN flood, the ACK packet is never sent back by the hostile client. Instead, the client program sends repeated SYN requests to all the server’s ports. A hostile client always knows a port is open when the server responds with a SYN/ACK packet.

*. Teardrop Attacks:-
A Teardrop attack is a DoS attack that involves sending fragmented / broken packets to a target machine.
I another way “It involves sending broken and disorganized IP fragments with overlapping, over sized payloads to the victim machine.”
Since the machine receiving such packets cannot reassemble them due to a bug in TCP/IP fragmentation reassembly, the packets overlap one another, crashing the target network device.

*.Smurf Attacks:-
The Smurf Attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the fix victim’s fake source IP are broadcast to a computer network using an IP Broadcast address. Most devices on a network will, by default, respond to this by sending a reply to the source IP address. If the number of machines on the network that receive and respond to these packets is very large, the victim’s computer will be flooded with traffic. This can slow down the victim’s computer to the point where it becomes impossible to work on.

*. Peer to Peer Attacks:-
Basically peer to peer(P2P) Network is a special type of computer network that shows self-organization, symmetric communication, and distributed control.Peer-to-peer (P2P) is a distributed application architecture that partitions tasks or work loads between peers.
Since P2P systems inherently rely on the dependence of peer with each other, security arises from abusing the trust between peers.
This is for educational perpose only