Week 4. DDoS! What, When and How

In one of the posts in a previous week, the hacker used DDoS as one of the attack strategies.  Let's talk about it a little bit.  What is it? When is it used? And how is it used?

DDoS stand for distributed denial of service.  So what is denial of service mean, and why is it called distributed?  When a user browses the web, the browser sends the request to the webserver;  The webserver look at the request, process it and send back a response to the browser.  The web server keeps doing that for each request it receives.  When one machine sends many consecutive requests, the server will have to finish all of those messages before processing others.  Therefore requests from other computers will timeout based on the underlying communication protocol specification.  That is called denial of service.  One of the ways to prevent denial of service attack is to limit the number of requests from the same source within a specified time. This method reduces the consumption of the bandwidth from one source, allowing others to have their chances.  Some strict configuration policy can even block the remote machine when DoS is detected.  While the server is cable of handling one source, it won't be able to handle many sources.  The hackers figured out this technic, so they use many sources to attack the target.  When encountering attacks from many directions, the server won't be able to do anything else but reject and block the attacking sources.  That is when the DDoS terminology was born. 

Hackers who use DDoS attack are no amateur.   They are a team or even from an organization.  Before using the DDoS tactic, hackers already compromised many machines and keeping them ready for the right moment.  Some may use DDoS for blackmailing.  Other may use it for defeating competitors.  While it is not effective as ransomware, DDoS probably be used as ransom technic.  The hackers attack a particular target, bringing it down and demand a ransom.  Another use of DDoS is a decoy.  Hackers use DDoS to distract security personnel while they perform other activities.

I think one way to prevent a DDoS attack is to have smarter, better routing, firewall, and policy.  The one that can detect, response automatically.  A server with such capability should be able to sustain services.

Comments

Post a Comment

Popular posts from this blog

Week 4 - STRIDE: Spoofing

Image
On week one, I briefly mentioned STRIDE as a method for threat identification. From this week, I want to go into a little more detail on each of its Mnemonic.  First, let's talk a little more about STRIDE.  In security , there are three fundamental aspects of the asset when speaking of security.  They are Confidentiality, Integrity, and Availability, which are referred to as the CIA triad.  To protect the asset means to protect its confidentiality, integrity, and availability.  STRIDE provides six ways to identify threats that would target the three areas. Spoofing: pretend to be someone or something that has legitimate permission to access the asset.  It is one of the ways to break the confidentiality . Tampering: ways to change the integrity of the asset. Repudiation: ways to obtain proves of violation Information Disclosure: access restricted information without permission (confidentiality) Denial of Service: ca...
Read more

Week 12 - The Final Words

Finally, I get to take a week of break.   This is the busiest Term so far.   Lots of demands from work plus things keep breaking at home made it tough.   I am glad it over.   With that said, I learned much from this class. In the first four weeks, I got to understand the threat modeling process and different threat modeling tools.   In a nutshell , threat modeling is about understanding your current state of the network; find all vulnerabilities, threats, and risks; formulate action plan and priority.   The process is carried out in a systematic way .   Initially, I thought the threat modeling is a process for finding the threats.   The name sounds small, but it also covers asset identification and action planning, as I realized after the comment on my assignment.  I spent the following weeks working on a security project where I apply the threat modeling process.   The first phase in threat modeling is the asset assessmen...
Read more

Week 7 - STRIDE: Repudiation

Image
In 2000, couple individuals at Signal Lake were sued for $25 million by a man named Suni Munshani.   He alleged that Signal Lake’s officers promised him a large amount of asset.     Munshani provided an email that purportedly sent from the dependents as the proof for his allegation.   The court ordered security professional to investigate and concluded that the plaintiff altered one of the emails the dependent sent to him.   Although this does not relate to repudiation, it brings an important aspect of non-repudiation.   (memecrunch.com) Repudiation, in short, is the denial of any wrongdoing , which is the very first thing anyone would do when they get caught doing something illegal.   Professional hackers learn to cover their track very well.   Likewise, security professionals learn to track.   For the email tampering case I mentioned, the defendant would not win the lawsuit if old emails weren’t available for invest...
Read more