Denial-of-Service (DoS)
By: Serafin Sanchez 3/5/08
A denial-of-service
(DoS) attack or distributed
denial-of-service (DDoS) attack is an attempt to make a computer
resource unavailable to its intended users. Although the means to, motives for,
and targets of a DoS attack do vary, it generally consists of the concerted,
malevolent efforts of a person or persons to prevent an Internet site or
service from functioning efficiently or at all, temporarily or indefinitely.
Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even DNS root servers.
One common method of attack involves saturating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable. In general terms, DoS attacks are implemented by:
Forcing the targeted computer(s) to reset, or
consume its resources so that it can no longer provide its intended service;
or,
Obstructing the communication media between the
intended users and the victim so that they can no longer communicate adequately.
Denial-of-service attacks are considered violations of the IAB's Internet proper use policy. They also commonly constitute violations of the laws of individual nations.
Manifestations
The United States Computer Emergency Readiness Team defines symptoms of DoS attacks to include:
unusually slow network performance (opening files
or accessing web sites)
unavailability of a particular web site
inability to access any web site
dramatic increase in the number of spam emails
received
Attacks can be directed at any network device, including attacks on routing devices and Web, electronic mail, or Domain Name System servers.
A DoS attack can be perpetrated in a number of ways. There are five basic types of attack:
Consumption of computational resources, such as
bandwidth, disk space, or CPU time;
Disruption of configuration information, such as
routing information;
Disruption of state information, such as
unsolicited resetting of TCP sessions;
Disruption of physical network components.
Obstructing the communication media between the
intended users and the victim so that they can no longer communicate
adequately.
A DoS attack may include execution of malware intended to:
Max out the CPU's usage, preventing any work
from occurring;
Trigger errors in the microcode of the machine;
Rrigger errors in the sequencing of
instructions, so as to force the computer into an unstable state or lock-up;
exploits errors in the operating system to cause resource starvation and/or
thrashing, i.e. to use up all available facilities so no real work can be
accomplished; crash the operating system itself; iFrame (D)DoS, in which a html
document is made to visit a webpage with many KB's of information many times,
until they achieve the amount of visits to where bandwidth limit is exceeded.