Presentation is loading. Please wait.

Presentation is loading. Please wait.

EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Security News Source Courtesy:

Published byGerard Singleton Modified over 8 years ago

Similar presentations

Presentation on theme: "EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Security News Source Courtesy:"— Presentation transcript:

1 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Security News Source Courtesy: http://www.informationweek.com/story/showArticle.jhtml?articleID=192701817&cid=RSSfeed_IWK_News

2 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Real World Scenario of DoS Attacks  A single attacker, Mafiaboy, shot down some of the biggest e-commerce websites: eBay, Schwab, and Amazon. Mafiaboy, a Canadian teenager who pleaded guilty, used readily available DoS attack tools, which can be used to remotely activate hundreds of compromised zombie servers to overwhelm a target's network capacity in a matter of minutes  In the same attack, CNN Interactive found itself essentially unable to update its stories for two hours—a potentially devastating problem for a news organization that prides itself on its timeliness

3 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited What are Denial of Service Attacks?  A Denial of Service attack (DoS) is an attack through which a person can render a system unusable, or significantly slow it down for legitimate users, by overloading its resources  If an attacker is unable to gain access to a machine, the attacker will most likely crash the machine to accomplish a denial of service attack

4 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Goal of DoS  The goal of DoS is not to gain unauthorized access to machines or data, but to prevent legitimate users of a service from using it  Attackers may: Attempt to flood a network, thereby preventing legitimate network traffic Attempt to disrupt connections between two machines, thereby preventing access to a service Attempt to prevent a particular individual from accessing a service Attempt to disrupt service to a specific system or person

5 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Types of Attacks There are two types of attacks: 1. DoS attack 2. DDos attack A type of attack on a network that is designed to bring the network down by flooding it with data packets Hacker Internet Network Attack

6 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited DoS Attack Classification  Smurf  Buffer Overflow Attack  Ping of death  Teardrop  SYN Attack

7 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Smurf Attack  The perpetrator generates a large amount of ICMP echo (ping) traffic to a network broadcast address with a spoofed source IP set to a victim host  The result will be lots of ping replies (ICMP Echo Reply) flooding the spoofed host  Amplified ping reply stream can overwhelm the victim’s network connection  Fraggle attack, which uses UDP echo is similar to the smurf attack

8 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Smurf Attack

9 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Buffer Overflow Attack  Buffer overflow occurs any time the program writes more information into the buffer than the space it has allocated in the memory  The attacker can overwrite data that controls the program execution path and hijack the control of the program to execute the attacker’s code instead of the process code  Sending email messages that have attachments with 256- character file names can cause buffer overflow

10 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Ping of Death Attack  The attacker deliberately sends an IP packet larger than the 65,536 bytes allowed by the IP protocol  Fragmentation allows a single IP packet to be broken down into smaller segments  The fragments can add up to more than the allowed 65,536 bytes. The operating system, unable to handle oversized packets freezes, reboots, or simply crashes  The identity of the attacker sending the oversized packet can be easily spoofed

11 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Teardrop Attack  IP requires that a packet that is too large for the next router to handle be divided into fragments  The attacker's IP puts a confusing offset value in the second or later fragment  If the receiving operating system is not able to aggregate the packets accordingly, it can crash the system  It is a UDP attack, which uses overlapping offset fields to bring down hosts  The Unnamed Attack Variation of the Teardrop attack Fragments are not overlapping but there are gaps incorporated

12 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited SYN Attack  The attacker sends bogus TCP SYN requests to a victim server. The host allocates resources (memory sockets) to the connection  Prevents the server from responding to legitimate requests  This attack exploits the three-way handshake  Malicious flooding by large volumes of TCP SYN packets to the victim’s system with spoofed source IP addresses can cause DoS

13 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited SYN Flooding  It takes advantage of a flaw in how most hosts implement the TCP three-way handshake  When Host B receives the SYN request from A, it must keep track of the partially-opened connection in a "listen queue" for at least 75 seconds  A malicious host can exploit the small size of the listen queue by sending multiple SYN requests to a host, but never replying to the SYN&ACK  The victim’s listen queue is quickly filled up  This ability of removing a host from the network for at least 75 seconds can be used as a denial-of- service attack SYN ACK SYN/ACK SYN Normal connection establishment SYN Flooding XA

14 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited How Do They Infect? Hacker in Russia John (end user in Boston) Downloads and executes chess.zip from freeware site John’s machine is infected with Agabot Bot Bot looks for other vulnerable systems and infects them Bot Bots connect to the “Master” using IRC channel and waits for instructions Commands Attacker sends commands to the Bots 1 2 3 4 5

15 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited What is DDoS Attack? According to the website, www.searchsecurity.com: On the Internet, a distributed denial of service (DDoS) attack is one in which a multitude of compromised systems attack a single target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the target system essentially forces it to shut down, thereby denying service to the system to legitimate users

16 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Agent Handler Model Attacker HHH AAAAAA …………........ … Victim HH Agents Handlers Primary Victim Secondary Victim (Daemons) (Master)

17 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited DDoS Attack Taxonomy  Bandwidth depletion attacks Flood attack UDP and ICMP flood  Amplification attack Smurf and Fraggle attack Source: http://www.visualware.com/whitepapers/casestudie s/yahoo.html

18 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited DDoS Attack Taxonomy DDoS Attacks Bandwidth Depletion Resource Depletion Flood Attack Amplification Attack Protocol Exploit Attack Malformed Packet Attack UDPICMP Smurf Fraggle TCP SYN Attack PUSH+ACK Attack TCP

19 EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Amplification Attack ATTACKER AGENT VICTIM …………………………… AMPLIFIER AMPLIFIER NETWORK SYSTEMS Systems used for amplifying purpose

Download ppt "EC-Council Copyright © by EC-Council All Rights reserved. Reproduction is strictly prohibited Security News Source Courtesy:"

Similar presentations

NETWORK SECURITY ADD ON NOTES MMD © Oct2012. IMPLEMENTATION Enable Passwords On Cisco Routers Via Enable Password And Enable Secret Access Control Lists.

NETWORK SECURITY ADD ON NOTES MMD © Oct2012. IMPLEMENTATION Enable Passwords On Cisco Routers Via Enable Password And Enable Secret Access Control Lists.
Network and Application Attacks Contributed by- Chandra Prakash Suryawanshi CISSP, CEH, SANS-GSEC, CISA, ISO 27001LI, BS 25999LA, ERM (ISB) June 2006.

Network and Application Attacks Contributed by- Chandra Prakash Suryawanshi CISSP, CEH, SANS-GSEC, CISA, ISO 27001LI, BS 25999LA, ERM (ISB) June 2006.
Review For Exam 2 March 9, 2010 MIS 4600 – MBA 5880 - © Abdou Illia.

Review For Exam 2 March 9, 2010 MIS 4600 – MBA © Abdou Illia.
Denial of Service & Session Hijacking.  Rendering a system unusable to those who deserve it  Consume bandwidth or disk space  Overwhelming amount of.

Denial of Service & Session Hijacking.  Rendering a system unusable to those who deserve it  Consume bandwidth or disk space  Overwhelming amount of.
Lecture 9 Page 1 CS 236 Online Denial of Service Attacks that prevent legitimate users from doing their work By flooding the network Or corrupting routing.

Lecture 9 Page 1 CS 236 Online Denial of Service Attacks that prevent legitimate users from doing their work By flooding the network Or corrupting routing.
Lecture slides prepared for “Computer Security: Principles and Practice”, 2/e, by William Stallings and Lawrie Brown, Chapter 7 “Denial-of-Service-Attacks”.

Lecture slides prepared for “Computer Security: Principles and Practice”, 2/e, by William Stallings and Lawrie Brown, Chapter 7 “Denial-of-Service-Attacks”.
Security (Continued) V.T. Raja, Ph.D., Oregon State University.

Security (Continued) V.T. Raja, Ph.D., Oregon State University.
Computer Security Fundamentals by Chuck Easttom Chapter 4 Denial of Service Attacks.

Computer Security Fundamentals by Chuck Easttom Chapter 4 Denial of Service Attacks.
Hacking Presented By :KUMAR ANAND SINGH 04-243,ETC/2008.

Hacking Presented By :KUMAR ANAND SINGH ,ETC/2008.
Simulation and Analysis of DDos Attacks Poongothai, M Department of Information Technology,Institute of Road and Transport Technology, Erode Tamilnadu,

Simulation and Analysis of DDos Attacks Poongothai, M Department of Information Technology,Institute of Road and Transport Technology, Erode Tamilnadu,
Network-Based Denial of Service Attacks Trends, Descriptions, and How to Protect Your Network Craig A. Huegen Cisco Systems, Inc. NANOG 12 Interprovider.

Network-Based Denial of Service Attacks Trends, Descriptions, and How to Protect Your Network Craig A. Huegen Cisco Systems, Inc. NANOG 12 Interprovider.
Computer Security and Penetration Testing

Computer Security and Penetration Testing
Distributed Denial of Service Attacks CMPT 471 1 Distributed Denial of Service Attacks Darius Law.

Distributed Denial of Service Attacks CMPT Distributed Denial of Service Attacks Darius Law.
Outline Definition Point-to-point network denial of service

Outline Definition Point-to-point network denial of service
Network & Computer Attacks (Part 2) February 11, 2010 MIS 4600 – MBA 5880 - © Abdou Illia.

Network & Computer Attacks (Part 2) February 11, 2010 MIS 4600 – MBA © Abdou Illia.
Review for Exam 4 School of Business Eastern Illinois University © Abdou Illia, Fall 2006.

Review for Exam 4 School of Business Eastern Illinois University © Abdou Illia, Fall 2006.
Analysis of Attack By Matt Kennedy. Different Type of Attacks o Access Attacks o Modification and Repudiation Attacks o DoS Attacks o DDoS Attacks o Attacks.

Analysis of Attack By Matt Kennedy. Different Type of Attacks o Access Attacks o Modification and Repudiation Attacks o DoS Attacks o DDoS Attacks o Attacks.
Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 7: Denial-of-Service Attacks.

Computer Security: Principles and Practice EECS710: Information Security Professor Hossein Saiedian Fall 2014 Chapter 7: Denial-of-Service Attacks.
Attack Profiles CS-480b Dick Steflik Attack Categories Denial-of-Service Exploitation Attacks Information Gathering Attacks Disinformation Attacks.

Attack Profiles CS-480b Dick Steflik Attack Categories Denial-of-Service Exploitation Attacks Information Gathering Attacks Disinformation Attacks.
Lance West.  Just what is a Denial of Service (DoS) attack, and just how can it be used to attack a network.  A DoS attack involves exploiting operating.

Lance West.  Just what is a Denial of Service (DoS) attack, and just how can it be used to attack a network.  A DoS attack involves exploiting operating.

Similar presentations

Ads by Google