Project 3

DOS is an attack used to deny legitimate users access to a resource such as accessing a website, network, emails, etc. or making it extremely slow. DoS is the acronym for Denial of Service. This type of attack is usually implemented by hitting the target resource such as a web server with too many requests at the same time. This results in the server failing to respond to all the requests. The effect of this can either be crashing the servers or slowing them down.

Cutting off some business from the internet can lead to significant loss of business or money. The internet and computer networkspower a lot of businesses. Some organizations such as payment gateways, e-commerce sites entirely depend on the internet to do business.

In this tutorial, we will introduce you to what denial of service attack is, how it is performed and how you can protect against such attacks.

Topics covered in this tutorial

• Types of Dos Attacks
• How DoS attacks work
• DoS attack tools
• DoS Protection: Prevent an attack
• Hacking Activity: Ping of Death
• Hacking Activity: Launch a DOS attack

Types of Dos Attacks

There are two types of Dos attacks namely;

• DoS– this type of attack is performed by a single host
• Distributed DoS– this type of attack is performed by a number of compromised machines that all target the same victim. It floods the network with data packets.

How DoS attacks work

Let’s look at how DoS attacks are performed and the techniques used. We will look at five common types of attacks.

Ping of Death

The ping command is usually used to test the availability of a network resource. It works by sending small data packets to the network resource. The ping of death takes advantage of this and sends data packets above the maximum limit (65,536 bytes) that TCP/IP allows. TCP/IP fragmentation breaks the packets into small chunks that are sent to the server. Since the sent data packages are larger than what the server can handle, the server can freeze, reboot, or crash.

Smurf

This type of attack uses large amounts of Internet Control Message Protocol (ICMP) ping traffic target at an Internet Broadcast Address. The reply IP address is spoofed to that of the intended victim. All the replies are sent to the victim instead of the IP used for the pings. Since a single Internet Broadcast Address can support a maximum of 255 hosts, a smurf attack amplifies a single ping 255 times. The effect of this is slowing down the network to a point where it is impossible to use it.

Buffer overflow

A buffer is a temporal storage location in RAM that is used to hold data so that the CPU can manipulate it before writing it back to the disc. Buffers have a size limit. This type of attack loads the buffer with more data that it can hold. This causes the buffer to overflow and corrupt the data it holds. An example of a buffer overflow is sending emails with file names that have 256 characters.

Teardrop

This type of attack uses larger data packets. TCP/IP breaks them into fragments that are assembled on the receiving host. The attacker manipulates the packets as they are sent so that they overlap each other. This can cause the intended victim to crash as it tries to re-assemble the packets.

SYN attack

SYN is a short form for Synchronize. This type of attack takes advantage of the three-way handshake to establish communication using TCP. SYN attack works by flooding the victim with incomplete SYN messages. This causes the victim machine to allocate memory resources that are never used and deny access to legitimate users.

DoS attack tools

The following are some of the tools that can be used to perform DoS attacks.

• Nemesy– this tool can be used to generate random packets. It works on windows. This tool can be downloaded from http://packetstormsecurity.com/files/25599/nemesy13.zip.html . Due to the nature of the program, if you have an antivirus, it will most likely be detected as a virus.
• Land and LaTierra– this tool can be used for IP spoofing and opening TCP connections
• Blast– this tool can be downloaded from http://www.opencomm.co.uk/products/blast/features.php
• Panther– this tool can be used to flood a victim’s network with UDP packets.
• Botnets– these are multitudes of compromised computers on the Internet that can be used to perform a distributed denial of service attack.

Also Check:- Best FREE DDoS Attack Online Tool | Software | Websites

DoS Protection: Prevent an attack

An organization can adopt the following policy to protect itself against Denial of Service attacks.

• Attacks such as SYN flooding take advantage of bugs in the operating system. Installing security patches can help reduce the chances of such attacks.
• Intrusion detection systems can also be used to identify and even stop illegal activities
• Firewalls can be used to stop simple DoS attacks by blocking all traffic coming from an attacker by identifying his IP.
• Routers can be configured via the Access Control List to limit access to the network and drop suspected illegal traffic.

Hacking Activity: Ping of Death

We will assume you are using Windows for this exercise. We will also assume that you have at least two computers that are on the same network. DOS attacks are illegal on networks that you are not authorized to do so. This is why you will need to setup your own network for this exercise.

Open the command prompt on the target computer

Enter the command ipconfig. You will get results similar to the ones shown below

For this example, we are using Mobile Broadband connection details. Take note of the IP address. Note: for this example to be more effective, and you must use a LAN network.

Switch to the computer that you want to use for the attack and open the command prompt

We will ping our victim computer with infinite data packets of 65500

Enter the following command

ping 10.128.131.108 –t |65500

HERE,

• “ping” sends the data packets to the victim
• “10.128.131.108” is the IP address of the victim
• “-t” means the data packets should be sent until the program is stopped
• “-l” specifies the data load to be sent to the victim

You will get results similar to the ones shown below

Flooding the target computer with data packets doesn’t have much effect on the victim. In order for the attack to be more effective, you should attack the target computer with pings from more than one computer.

The above attack can be used to attacker routers, web servers etc.

If you want to see the effects of the attack on the target computer, you can open the task manager and view the network activities.

• Right click on the taskbar
• Select start task manager
• Click on the network tab
• You will get results similar to the following

If the attack is successful, you should be able to see increased network activities.

Hacking Activity: Launch a DOS attack

In this practical scenario, we are going to use Nemesy to generate data packets and flood the target computer, router or server.

As stated above, Nemesy will be detected as an illegal program by your anti-virus. You will have to disable the anti-virus for this exercise.

• Download Nemesy from http://packetstormsecurity.com/files/25599/nemesy13.zip.html
• Unzip it and run the program Nemesy.exe
• You will get the following interface

Enter the target IP address, in this example; we have used the target IP we used in the above example.

HERE,

• 0 as the number of packets means infinity. You can set it to the desired number if you do not want to send, infinity data packets
• The size field specifies the data bytes to be sent and the delay specifies the time interval in milliseconds.

Click on send button

You should be able to see the following results

The title bar will show you the number of packets sent

Click on halt button to stop the program from sending data packets.

You can monitor the task manager of the target computer to see the network activities.

Summary

• A denial of service attack’s intent is to deny legitimate users access to a resource such as a network, server etc.
• There are two types of attacks, denial of service and distributed denial of service.
• A denial of service attack can be carried out using SYN Flooding, Ping of Death, Teardrop, Smurf or buffer overflow
• Security patches for operating systems, router configuration, firewalls and intrusion detection systems can be used to protect against denial of service attacks.

A replay attack is a type of man-in-the-middle attack in which a hacker or user sniffs info being sent on a channel to interrupt them & resend them under the cloak of genuine messages.

What makes the replay attack mainly damaging is that the attacker does not even need to decrypt the note they resend but can still fool the person who receives it into thinking that the message is genuine.

In other words, think of this illegal party as having the capability to snoop on all your conversations, communication, & digital activity taking place through that specific channel. A Wi-Fi network for instance.

There are many implications of such an attack since it can render closely all your communications online susceptible.

More extremely, it will carry on to linger as a constant phantom within your prospect security protocols as there is no way to recognize for how long your communications have cooperated.

How Does a Replay Attack Work?

Take a look at this real-life attack situation. By sending encrypted info to the firm’s financial administrator, a corporate worker requests a fund transfer.

This communication is interrupted by an attacker, who captures it and might now resend it.

The communication is already properly encrypted & seems valid to the financial administrator since it is a reliable message that has simply been resending.

In this circumstance, unless the fiscal administrator has cause to be suspicious, he or she is possibly to react to the new request. A vast quantity of money might be sent to the attacker’s bank account as a reprisal.

Replay attack vs. man-in-the-middle

There are various types of security threats that attackers can use to exploit uncertain applications. Threat actors can run several of these attacks using automatic software, while others need a more active role from attackers.

In this segment, we will clarify the basic knowledge behind a man-in-the-middle (MITM) attack, offering examples and mitigation methods.

What Is a Man-in-the-Middle Attack?

A man-in-the-middle attack is a kind of eavesdropping attack, where attackers disturb an existing conversation or data transfer. After injecting themselves in the “mid” of the transfer, the attackers made-up to be both genuine participants.

This allows an attacker to interrupt information & data from either party while also sending harmful links or other information to both genuine participants in a method that might not be sensed till it is too late.

You can think of this kind of attack as similar to the game of telephone where one person’s words are carried along from member to member until it has changed by the time it reaches the last person.

In a man-in-the-middle attack, the middle contributor manipulates the conversation unidentified to either of the two genuine participants, acting to save confidential information & otherwise cause damage. Now we are going to tell you more about replay attacks.

Replay Attacks In Detail

Let us know replay attacks in detail with the benefit of a real-life example. Consider a business staff member asking for a monetary transaction from the company’s financial manager. He does so by sending an encoded message.

An attacker seeking a loophole to launch a replay attack might snoop on this message to satisfy his intention. His following step would be capturing the message so that he can resend it.

Now the message will look completely authentic because it has already been sent once. The financial administrator, who gets the message, will find it authentic as it has already been encoded.

What will occur now? In this case, the chances are that the fiscal administrator will reply to this new message unless there is a strong reason to get distrustful.

He will not distinguish between the two statements— the one he gets from the company’s staff fellow & the other he received from the hacker.

The receiver, in this circumstance, the fiscal administrator, has received a similar message. It could lead to the fiscal administrator sending a heavy amount to the bank account of the attacker.

So, what the hacker did was crack the message from the network & decrypt it. He doesn’t even need to read or decipher the message. He just resends the update as it is.

The attacker used a humble technique or hack to break into the system & replay it simply by resending a message. It is how a replay attack in network safety works.

Examples of Replay Attacks

Suppose in the statement of two parties tom & bob; tom is sending his key to bob to verify his identity but in the meantime Attacker Jake overhears the conversation between them & keeps the data which are required to verify his identity to Bob. Later Jake contacts Bob and verifies its authenticity.

Except mitigated, networks and computers subject to replay attack would see the attack procedure as genuine messages.

One instance of a replay attack is to replay the note sent to a network by an attacker, which was formerly sent by a certified user.

Though the messages might be encrypted & the attacker might not get the real keys, retransmission of valid data or logon posts could help them gain adequate access to the network.

A replay attack can get access to the assets by replaying a verification message and can complicate the destination host.

One of the finest techniques to prevent replay attacks is by using strong digital signatures with timestamps.

An additional technique that could be used to evade a replay attack is by making random session keys that are time-bound and procedure bound.

A one-time password for every request also helps in preventing replay attacks and is often used in banking operations.

Other methods used against replay attacks comprise sequencing of messages & non-acceptance of repeated messages.

How To Prevent Replay Attacks

We recognize that replay attacks can lead to dire penalties. So, the real query is, how can we protect ourselves from replay attacks?

The main way to stop replay attacks is to attach timestamps or order numbers to every sent message. This will let the receiver discard some messages with a repeated timestamp or order number.

An additional prevention technique is to utilize digital signatures to make it simpler for the receiver to validate if the sender is really the individual they think they are.

Replay attacks can also be minimalized with the help of random-session session keys, which are time-specific & will change with time making it hard for an attacker to fool the receiver with an earlier message.

As replay attacks are contingent on reusing the session authorizations that an attacker has intercepted, stopping replay attacks frequently means generating a single-use encryption key or ID for an Internet session.

Several network transmissions between two users now use a particular, single-use encryption key, which is simply valid for one session and will not let an attacker replay the session.

Users might even log into an account with a single-use passcode, which will have to be reset for every successive login. This stops a replay attacker from submitting one more request with the intercepted password; it will no longer be functional.

A virtual private network can protect users from man-in-the-middle attacks: they set up a computer network distinct from the normal network, which normally prevents attackers from stealing on the Internet connection.

But, VPNs are not flawless, and they’ve sometimes allowed attackers to gain the user’s network through endpoint insecurities.

Certain VPNs really have flaws that let attackers replay Internet sessions, having gained access to their network link using cookies that weren’t dealt with correctly.

If you are using a VPN to evade replay attacks, research different options cautiously & watch for security bugs that have come to light in specific VPN products.

Standard Techniques in Replay Attacks

The predictable techniques in replay attacks are listed below.

Kerberos prevention technique: Throughout protocol exchanges between the user & the server, Kerberos implements a time authenticator. It also drafts the ticket’s lifetime and, most significantly, the user’s timestamp.

The message will be excluded if the authenticator’s timestamp isn’t within 5 minutes of the server’s time. This is because the extreme duration that might be accepted between users & servers is five minutes. But, the timing can be different.

One-time passwords (OTP): A password or secret code that can simply be used once for a transaction. With the user’s OTP program, the verification server operates on similar authorizations in OTP-based safety features.

The use of OTP is based on the indication that every OTP is valid for 10 minutes or one effective activation, depending on which comes first.

Sequencing: Authentic messages are numbered, & the receiver will reject accept packages, not in the right order. As a result, inner delay or duplication attacks are stopped.

Random session key: The session key allows both parties to have protected & closed-end transactions using time-bound & process-bound code.

The IT industry has recently seen a steady increase of distributed denial of service (DDoS) attacks. Years ago, DDoS attacks were perceived as minor nuisances perpetrated by novice attackers who did it for fun and it was relatively easy to mitigate them. Unfortunately, that situation is no more. DDoS attacks are now a sophisticated activity, and in many cases, big business.

InfoSecurity Magazine reported 2.9 million DDoS attacks in Q1 of 2021, an increase of 31% over the same period in 2020.

DDoS attacks rose 31% in Q1 2021 over the same period in 2020, to 2.9 million attacks

In recent years, we have seen an exponential increase in DDoS attacks that have incapacitated businesses for significant amounts of time.

• In February of 2020, Amazon Web Services (AWS) suffered a DDoS attack sophisticated enough to keep its incident response teams occupied for several days also affecting customers worldwide.
• In February of 2021, the EXMO Cryptocurrency exchange fell victim to a DDoS attack that rendered the organization inoperable for almost five hours.
• Recently, Australia experienced a significant, sustained, state-sponsored DDoS attack.
• Belgium also became a victim of a DDoS attack that targeted the country’s parliament, police services and universities.

Hundreds of thousands of unnamed, undocumented, yet successful DDoS attacks continue daily. In fact, it is these attacks that are the most effective and costly. The DDoS upward trend promises to continue, putting IT pros with mitigation skills in high demand.

Raging IT Warfare: What Is a DDoS Attack?

Despite becoming more common, DDoS attacks can be quite advanced and difficult to combat. But what exactly is a DDoS attack and what does DDoS stand for?

DDoS is short for distributed denial of service. A DDoS attack occurs when a threat actor uses resources from multiple, remote locations to attack an organization’s online operations. Usually, DDoS attacks focus on generating attacks that manipulate the default, or even proper workings, of network equipment and services (e.g., routers, naming services or caching services). In fact, that’s the main problem.

Sophisticated DDoS attacks don’t necessarily have to take advantage of default settings or open relays. They exploit normal behavior and take advantage of how the protocols that run on today’s devices were designed to run in the first place. In the same way that a social engineer manipulates the default workings of human communication, a DDoS attacker manipulates the normal workings of the network services we all rely upon and trust.

When a DDoS attack takes place, the targeted organization experiences a crippling interruption in one or more of its services because the attack has flooded their resources with HTTP requests and traffic, denying access to legitimate users. DDoS attacks are ranked as one of the top four cybersecurity threats of our time, amongst social engineering, ransomware and supply chain attacks.

Modern Warfare: Avoiding Confusion About DDoS Attacks

It’s relatively easy to confuse DDoS attacks with other cyberthreats. In fact, there is a significant lack of knowledge among IT pros and even cybersecurity professionals concerning exactly how DDoS attacks work.

In a DDoS attack, cybercriminals take advantage of normal behavior that occurs between network devices and servers, often targeting the networking devices that establish a connection to the internet. Therefore, attackers focus on the edge network devices (e.g., routers, switches), rather than individual servers. A DDoS attack overwhelms the network’s pipe, (the bandwidth) or the devices that provide that bandwidth.

Here’s a useful analogy: Imagine that several people call you simultaneously so that you can’t make or receive phone calls or use your phone for any other purpose. This problem persists until you block those calls through your provider.

Notice that you don’t fix, upgrade or otherwise make adjustments to your actual mobile device. Instead, you fix the connection between the attackers and your phone by using your mobile phone provider’s blocking service.

A similar thing happens during a DDoS attack. Instead of modifying the resource that is being attacked, you apply fixes (otherwise known as mitigations) between your network and the threat actor.

DDoS vs. DoS Attacks: What’s the Difference?

It’s important to avoid confusing a DDoS (distributed denial of service) attack with a DoS (denial of service) attack. Although only one word separates the two, these attacks vary significantly in nature.

• Strictly defined, a typical DDoS attack manipulates many distributed network devices in between the attacker and the victim into waging an unwitting attack, exploiting legitimate behavior.
• A traditional DoS attack doesn’t use multiple, distributed devices, nor does it focus on devices between the attacker and the organization. These attacks also tend not to use multiple internet devices.

Typical DoS attacks can include the following:

• Single-source SYN floods: This occurs when an attacker uses a single system to issue a flood attack of SYN packets, manipulating the typical TCP three-way handshake. For example, a SYN flood someone might generate using a Kali Linux computer is not a true DDoS attack because the attack being made is only coming from one device. This is the case even if the attacker uses IP address spoofing. A true DDoS attack is generated by network-level devices, for network-level devices. In other words, you use multiple routers or Memcached servers to attack a network.
• The “ping of death”: Years ago, some network drivers contained flawed code that would crash a system if it received an ICMP packet that contained certain parameters.
• The slow loris attack: The slow loris attack is often called a DDoS attack, but because the attack targets a specific server (in this case, a web server) and usually does not use intermediate networking devices, it is typically a traditional DoS attack.

Each of the above DoS attacks take advantage of software or kernel weaknesses in a particular host. To resolve the issue, you fix the host, and/or filter out the traffic. If you can upgrade a server to mitigate an attack, then it doesn’t qualify as a traditional DDoS attack.

Remember, in a DDoS attack, the threat actor adopts a resource consumption strategy. This strategy involves using what appears to be legitimate requests to overwhelm systems which are, in fact, not legitimate, resulting in system issues.

Attack Strategy: Types of DDoS Attacks

There are three general types of DDoS attacks.