Denial-of-service attack

In computer security, a denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. Typically the targets are high-profile web servers where the attack is aiming to cause the hosted web pages to be unavailable on the Internet. It is a computer crime that violates the Internet proper use policy as indicated by the Internet Architecture Board (IAB).

DoS attacks have two general forms:

• Force the victim computer(s) to reset or consume its resources such that it can no longer provide its intended service.
• Obstruct the communication media between the intended users and the victim in such that they can no longer communicate adequately.

Not all service outages, even those that result from malicious activity, are necessarily denial-of-service attacks. Other types of attack may include a denial of service as a component, but the denial of service may be part of a larger attack.

Illegitimate use of resources may also result in denial of service. For example, an intruder may use one's anonymous FTP area as a place to store illegal copies of commercial software, consuming disk space and generating network traffic. They are often used to bring down a server and stop a website from existing on the internet.

Surviving attacks

There are steps that can be taken to mitigate the effects of a DDoS attack. As mentioned in the previous section, the first thing to start is the investigative process. One determines which core router (a router that handles Internet backbone traffic) is passing the packets to one's border router (a router that connects his or her network to the Internet). One would contact the owners of the core router, likely a telecom company or the internet service provider, and inform them of his or her problem. Ideally, there will be a process in place which can expedite one's requests for help. They, in turn, need to determine where the malicious traffic reaches their network and contact the source. By that point, it is out of one's hands.

Since it is not likely that the administrator will be able to quickly stop the DDoS flood, there are a few steps which might help mitigate the attack temporarily. If the target is a single machine, a simple IP address change can end the flood. The new address can be updated on internal DNS servers and given to a few crucial external users. This is especially useful for key servers (e.g. email or database) under attack on one's network.

There is a chance that some filtering techniques can help. If the attack is unsophisticated, there might be a specific signature to the traffic. A careful examination of captured packets sometimes reveals a trait on which either router ACLs (access control lists) or firewall rules can be based. Additionally, a large amount of traffic may originate from a specific provider or core router. If that is the case, one might consider temporarily blocking all traffic from that source. One would also be blocking "real" packets, or legitimate traffic, but this may be an unavoidable sacrifice. However, depending on the method of attack, this may not be an option if, for example, the participants' IP addresses are spoofed.

An alternative option, one which might be available to larger companies and networks, is to throw more hardware or bandwidth at the flood and wait it out. Again, it is not the best solution, nor the least expensive one. It may provide a temporary fix, nevertheless. A final method would be to simply disconnect the server from the network by physically pulling out the cable connecting the computer to the Internet (or disabling the hardware enabling this), which gives the SysAdmin a lot more time to work on the problem, but no service is then available for legitimate users. This method does not function on remotely-hosted servers such as virtual private servers which are then impossible to access for their administrators, so the problem is more difficult to fix.

The investigative process should begin immediately after the DoS attack begins. There will be multiple phone calls, call backs, emails, pages and faxes between the victim organization, one's provider and others involved. It is a time consuming process, so the process should begin immediately. It has taken some very large networks with plenty of resources several hours to halt a DDoS.

The easiest way to survive an attack is to have planned for the attack. Having a separate emergency block of IP addresses for critical servers with a separate route can be invaluable. A separate route (perhaps a DSL) is not that extravagant, and it can be used for load balancing or sharing under normal circumstances and switched to emergency mode in the event of an attack. Filtering is generally pretty ineffective, as the route to the filter will normally be swamped so only a trickle of traffic will survive.

External links

• Distributed Reflection Denial of Service (http://www.grc.com/dos/drdos.htm)
• Distributed Denial of Service Attacks (http://chinese-school.netfirms.com/computer-article-denial-of-service.html) - general information of Distributed Denial of Service Attacks (DDoS)
• DDoSVax Research Project (http://www.tik.ee.ethz.ch/~ddosvax/) - at Swiss Federal Institute of Technology (http://www.ethz.ch/) in Z?rich