DoS
CS3235
Eweek slides for DoS and DDoS
Hugh Anderson (on skype: hughanderson)
National University of Singapore
School of Computing
Audio Control:
September, 2013
Hugh Anderson (on skype: hughanderson)
CS3235 Eweek slides for DoS and DDoS
Layer 4 attacks (From Sam Browne)
DoS
Looking at connections
Audio Control:
Starting and terminating a TCP connection...
To start a connection there is a 3-way handshake. During this
time, initial sequence numbers are exchanged - a different
number used in each direction. To end a connection, there is
just a 2-way handshake.
Hugh Anderson (on skype: hughanderson)
CS3235 Eweek slides for DoS and DDoS
SYN flood attack
Audio Control:
Attack the connection setup
An attacker sends lots of (SYN) requests, and does not
complete the connection. At the server, resources are allocated
for each connection (Ports, tables etc), until no more resources
are left. Later, when Alice tries to connect, she is unable to.
SYN flood attack
Audio Control:
Protecting the server
The server returns a specially constructed sequence number,
which encodes the resources for the connection (TCB). The
TCB (transmission control block) is only allocated when the
ACK is returned.
TCP sequence prediction attack
Audio Control:
Attack/takeover an existing connection...
Sequence numbers allow re-ordering of packets. Consider an
attacker who cannot observe the traffic between the server and
the client. If the attacker can predict the correct sequence
number for a response, and get in before the server sends its
response (perhaps by SYN-flooding the server), the attacker
can start pretending to be the server.
TCP sequence prediction attack
Audio Control:
Check other layers, disallow prediction...
Techniques to reduce the likelihood of successful attacks
include using unpredictable sequence numbers, and checking
other layers for evidence of spoofing (such as source IP
address). These techniques can help minimize the success of
TCP sequence prediction attacks.
Layer 7 attacks (From Sam Browne)