-: In this lessonn we're going to focus on the concept
of a Denial of Service attack.
Now, a Denial of Service attack
isn't a specific attack in and of itself,
but instead, it's this category or type of attack
that's carried out in a number of different ways.
Essentially, the term Denial of Service
is used to describe any attack
which attempts to make a computer
or service resources unavailable,
but it can also be extended to network devices,
like switches and routers, as well.
There are five subcategories of Denial of Service attacks,
Flooding Attacks, the Ping of Death, the Teardrop,
the Permanent Denial of Service attack, and the Fork Bomb.
The first category is called a Flood Attack.
This is a specialized type of Denial of Service
which attempts to send more packets to a single server
or host than it can handle.
So, in this example,
we see an attacker sending 12 requests
at a time to a server.
Now, normally, a server wouldn't be overloaded
with just 12 requests,
but if I could send 12 hundred or 12,000,
that might allow me to flood that server and take it down.
Now, under a Flood Attack
we have a few different specialized varieties
that you're going to come across on the exam.
The first is called a Ping Flood.
This attack is going to happen when somebody attempts to
flood your server by sending too many pings.
Now, a ping is technically an ICMP echo request packet,
but they like to call it a ping on the exam.
Because a Ping Flood has become so commonplace, though,
many organizations are now simply blocking echo replies
and simply having the firewall dropping these requests
whenever they're received.
This results in the attacker simply getting
a request timed out message,
and the service remains online,
and the Denial of Service is stopped.
Next, we have a Smurf Attack.
This is like a Ping Flood,
but instead of trying to flood a server
by sending out pings directly to it,
the attacker instead tries to amplify this attack
by sending a ping to a subnet broadcast address instead,
using the spoofed IP of the target server.
This causes all of the devices on that subnet
to reply back to the victimized server
with those ICMP echo replies,
and it's going to eat up a lot of bandwidth
and processing power.
Now, you can see how this looks here,
with the attacker sending the ping request
with the IP of that server being spoofed into the request,
and now the destination is sent
to the broadcast of that subnet.
In this example, all three PCs in the subnet
are going to reply back to that ping request
thinking it's from the server,
and the server gets three times the amount of ping replies
than if the attacker had sent it to them directly.
Now, this allows that attack to be amplified,
especially if the attacker can get a large subnet,
like a /16 or a /8 used in this attack.
The next kind of Flood Attack is what we call Fraggle.
Fraggle is a throwback reference to the kids show
Fraggle Rock from the 1980s
which aired around the same time as the Smurf TV show.
So, you can guess that Fraggle and Smurf are kind of related.
Well, with Fraggle, instead of using an ICP echo reply,
Fraggle uses a UDP echo instead.
This traffic is directed to the UDP port of seven,
which is the echo port for UDP, and the UDP port of 19,
which is the character generation port.
This is an older attack,
and most networks don't have this vulnerability anymore,
and both of these ports are usually closed,
'cause again, they're unnecessary.
Notice that I didn't have them
in your port memorization chart, either.
Now, because of this,
Fraggle attacks are considered very uncommon today.
That said, a UDP Flood Attack,
which is a variant of Fraggle,
is still heavily used these days.
It works basically the same way as a Fraggle attack,
but it uses different UDP ports.
The next Flood Attack we're going to cover is a SYN Flood.
Now, this attack is a variant on a Denial of Service attack,
where the attacker is going to initiate multiple TCP sessions
but never complete the 3-way handshake.
You could see here,
how the attacker is sending four SYN packets to the server,
but they're using made up IP addresses.
The server then replies to those IP addresses
in an attempt to establish that 3-way handshake,
but of course, the other people weren't expecting that call,
and so, no one responds.
This causes a server to set aside resources
for these supposed clients
while it waits for their response and acknowledgement,
but the acknowledgement never comes.
If the attacker creates enough requests,
the server will simply run out of resources,
and be unable to establish any real connections
with those who really want to do business with the server,
and this creates the Denial of Service condition.
To prevent this from occurring,
flood guards can be installed in the network.
These devices will detect
when a SYN Flood is being attempted,
and it'll block the request at the network boundary,
freeing up the server.
Flood guards can also be a feature in some routers
and firewalls, as well.
Also, your server can be configured to timeout
on those half-open requests after a period of time,
say 10, 15 or 30 seconds,
and this will free up those resources,
and prevent the Denial of Service condition
from happening too.
Intrusion prevention systems also have the ability
to detect and respond to SYN Floods
as they're being attempted.
Now, the final type of Flood Attack
is known as a Christmas Attack.
This is a type of attack that's conducted by setting
the FIN, the PSH, and the URG flags inside a TC packet
to the on position.
This'll cause a device to crash or reboot
anytime that packet's received
because it's a nonstandard format.
Now, this attack got its name from the way it looks
when you look at these packets
inside a protocol analyzer like Wireshark,
because all of those flags are turned on,
and it looks like a Christmas tree.
Most devices today will simply block this type of attack
and discard the packet
because they don't understand how to handle it.
But when this attack first came out,
it caused a lot of trouble
for routers and switches around the globe.
So, now that we've covered
all of the different types of Flood Attacks,
let's move on to our next category, the Ping of Death.
This attack sends an oversized and malformed ping packet
to another computer or server.
When it's received,
these systems don't know what to do with it,
and they would crash.
This, again, is an older attack,
and one that modern operating systems
aren't vulnerable to anymore.
Now, essentially, the standard for a packet size
is supposed to not exceed 65,535 bytes
or 64k, but some smart attackers built ways
to force larger packets to be sent.
When they were received,
this could override areas of system memory,
much like a buffer overflow,
or it would simply crash the machine.
Why do we still cover the Ping of Death in Security+
when no one's vulnerable to it anymore?
Well, I think CompTIA likes to still cover it
because of the history.
The Ping of Death was one of the first
types of Denial of Service attack
that was really effective in the field.
This shows you just how old it really, really is.
Next, we have a Teardrop Attack,
which breaks apart packets into IP fragments,
modifies them with overlapping and oversized payloads,
and sends them back to a victim machine.
This gets its name because if you have enough teardrops,
you could form a large puddle and, essentially,
this attack attempts to create numerous smaller packets
that can't be reformed into this larger puddle,
and when they're trying to put those back together,
the system simply crashes or reboots itself
because it doesn't understand how to handle it.
This will create the desired Denial of Service condition
that the attacker was trying to create.
Next, we have the Permanent Denial of Service attack or PDOS.
This is an attack which exploits a security flaw
to permanently break a networking device
by reflashing its firmware.
This can cause a device to be unable to reboot itself
because its operating system is overwritten.
It's also called a Permanent Denial of Service attack
because a quick reboot won't bring the system back online.
Instead, the device has to be taken offline,
have a full firmware reload done,
and then it can be brought back online.
Finally, we have our last one, the Fork Bomb.
With the Fork Bomb,
the attacker creates a large number of processes
to use up available processing power of a computer.
This attack gets its name
because a process is called a fork,
and it can be forked into two processes,
and then four processes and so on,
until it eats up all of the resources.
Now, some people think of this as a worm
because of the self-replicating nature,
but they're not a worm, because they don't infect programs,
and they don't use the network to spread.
Instead, Fork Bombs only spread out
inside the processor's cache on a single computer
that it's being attacked with,
and it causes a Denial of Service attack,
and a Denial of Service condition,
which is why it's considered not to be a worm.
Now, there are new Denial of Service attacks
being dreamt up all of the time.
Basically, for the exam though,
if an attack causes a system to go offline,
and to stop providing the service
that it's really supposed to do to its real users,
or it can permanently cause a system to be broken,
this could be categorized as a Denial of Service condition.