13. Denial Of Service And Distributed Denial Of Service

Front 1

T/F: Email Flooding/bombing isn't a form of denial of service attack.

Back 1

False, it is a form of DoS

Front 2

Email "bombing" is

Back 2

Email "bombing" is characterized by abusers repeatedly sending an identical email message to a particular address.

Front 3

Email "spamming" is

Back 3

Email "spamming" is a variant of bombing; it refers to sending email to hundreds or thousands of users (or to lists that expand to that many users

Front 4

Email spamming can be made worse if

Back 4

if recipients reply to the email, causing all the original addressees to receive the reply. It may also occur innocently, as a result of sending a message to mailing lists and not realizing that the list explodes to thousands of users, or as a result of an incorrectly set-up responder message (such as vacation(1)).

Front 5

T/F: Email bombing/spamming may be combined with email "spoofing"

Back 5

True

Front 6

Describe what email flooding is

Back 6

1. Attacker sends spoofed email
with error to 100’s of systems.
2. Systems return email to system that appears to have sent emails.
3. Target system goes down under load of too many emails.

Front 7

Denial of Service (DoS)

Back 7

Attacks that deny legitimate users service and access to information resources.

Front 8

Poisoned traffic

Back 8

malformed or invalid data that can’t be properly handled

Front 9

What DoS attack simply uses up all the available capacity?

a. brute-force resource
b. poisoned traffic
c. stateful resource

Back 9

a. Brute-force resource simply use up all available capacity

Front 10

Stateful resource

Back 10

take advantage of client/server relationship in protocols

Front 11

Operating system attacks

Back 11

target flaws in specific operating systems

Front 12

Networking attacks

Back 12

exploit inherent limitations of networking

Front 13

T/F: An attacker can hide the source of an attack through IP spoofing

Back 13

True

Front 14

T/F: Attackers can also hide their identity by enslaving unwitting victims.

Back 14

True

Front 15

When an attacker uses many zombie agents together simultaneously the result is a

a. Denial of Service (DoS)
b. Distributed Denial of Service (DDoS) attack

Back 15

b. DDoS

Front 16

Describe how the attack worked against NT 4.0 running Microsoft’s Internet Information Server version 3.0

Back 16

All that was required was for the user to request a document with a very long name from the server to halt it.

e.g. http://victim.com/?something=xxxxxx…

Front 17

Explain Ping of Death (POD)

Back 17

POD accomplished by sending packet less than 64K.

Buffer overflow ensues causing reboot or crash

Front 18

T/F: ICMP Packet isn't considered part of IP layer

Back 18

False

Front 19

ICMP Packet communicates

Back 19

error messages and other conditions that require attention.

Front 20

ICMP messages are usually acted on by either the what layer(s)?

Back 20

IP layer or the higher layer protocol.

Front 21

Describe what a Smurf/ping flooding/ICMP storm is.

Back 21

EXPLOITS the PING Utlity
1. Attacker sends a large stream of spoofed ping packets to a broadcast address (an IP address that services a network of computers)
2. All of the packets have as their source address the target’s IP address.
3. Broadcast host will relay request to all hosts on network.
4. Hosts reply to the victim
5. Amount of data sent to victim is multiplied by a factor of the number of hosts in network
6. If multiple requests sent to broadcast host, target will be overloaded with replies
7. A Network/Brute-force attack

Front 22

SYN flooding exploits

Back 22

Exploits the synchronization protocol used to initiate connections

Front 23

Describe the normal process of SYN flooding

Back 23

Initiator sends synchronization (SYN) packet
Target replies with a SYN/ACK (acknowledgement)
Initiator sends ACK, two machines are now ready

Front 24

T/F: Syn_Flooder an example of SYN Flooding attack

Back 24

True

Front 25

tribal flood network (TFN) DDoS is made up of

Back 25

TFN is made up of client and daemon programs, which implement a distributed network denial of service tool capable of waging ICMP flood, SYN flood, UDP flood, and Smurf style attacks

Front 26

Remote control of a TFN is accomplished via

Back 26

via command line execution of the client program, using any of a number of connection methods

Front 27

Communication from the TFN client to daemons is accomplished via

Back 27

ICMP_ECHOREPLY (why?) packets.

Front 28

What are 3 ways to protect yourself from DoS and DDoS

Back 28

a. Best way would seem to be to stop the attack before it happens
b. Block “marching orders”
c. Block the attack at the source

Front 29

Name 5 things to mitigate the Effects of DoS

Back 29

1. Acknowledges that we can’t stop DoS
2. Harden the network
3. Avoid putting “all of your eggs in one basket”
4. Use Load balancers
5. Adjust state limits (e.g. wait time)