third Cyber Security Assessment Netherlands - NCSC

Detailed section » 4 DDoS
4 DDoS
»
DDoS attacks have caused harm to the provision of
services by organisations in the vital infrastructure
(including the provision of online services from banks
and airline companies). Furthermore, basic facilities such
as iDeal and DigiD have also been affected by DDoS
attacks. This demonstrates that malicious attackers can
cause much harm using easily obtainable tools.
4.1 Introduction
In the past year, public attention on DDoS attacks has increased
considerably. This detailed section examines in greater depth the
technical background, the actors who are (possibly) responsible
and the measures that are implemented.
DDoS is a means of attack by people with malicious intent that
overloads the capacity of an organisation’s online services, websites
or infrastructure by means of data traffic. The online services or
infrastructure then become impossible or difficult for legitimate
traffic to reach. Where in a DoS attack the actions are executed from
a single system, with a DDoS the attack is launched from multiple
locations and systems. [33: NCSC 2013-3] This detailed section examines
in greater depth the issues and incidents caused by DDoS attacks.
4.2 Background
DDoS attacks are not a new development and have been happening
for more than ten years. However in recent years the number of
attacks has been increasing In 2012 and the first quarter of 2013 the
number of DDoS attacks rose and there was an enormous increase
in the intensity of the attacks. [133] DDoS attacks are usually carried
out by controlling an attack via a botnet [134] or multiple systems at
the same time. The resources needed to launch a DDoS are relatively
easy to come by and can be used by anyone with a sufficient
knowledge of IT and the internet. The chance of an attack succeeding
is very much dependent on the attacker’s level of knowledge and
tools used, and on the measures that the target organisation has put
in place. In many organisations there is a lack of knowledge and/or
resources to take satisfactory and effective measures to restrict the
impact and consequential harm caused by a DDoS attack. There is in
reality little that can be done in the face of a DDoS attack other than
to take measures to reduce the effect of the attack.
4.2.1 Actors and their motives
DDoS attacks are carried out for a variety of reasons by various actors.
The capacity and technology for a DDoS attack are available for sale
on the internet. Cyber criminals offer a DDoS attack as a ‘service’. [135]
The cost of using these services has fallen in recent years. [136] The
actors do not themselves need many skills. Independently setting up
a DDoS attack requires more knowledge and skills.
Script kiddies
A script kiddie’s motive for a DDoS attack is usually to increase
self-esteem because a successful attack will be reported in the press.
Hacktivists
Hacktivists may carry out a DDoS attack against companies,
organisations or governments that in their eyes are acting against
their ideology or convictions.
Criminals
Criminals use DDoS attacks to blackmail companies carrying out
a DDoS and then demanding money from the victim to stop the
attack or avoid a long-term, more severe attack. DDoS attacks may
also be used as a diversion from the ‘real’ attack, for example to
camouflage espionage or criminal actions. However there has been
no evidence of this in the Netherlands as yet. Organised criminals in
a number of cases themselves possess the knowledge and skills or
they buy in botnet services from a ‘botnet herder’.
States
A DDoS attack may also be carried out by a state for geopolitical
reasons or as an element of cyber warfare.
4.2.2 Technique
DDoS attack techniques come in various forms. There are dozens
of forms of DDoS attack on the IP protocol alone. Types of attack
are often combined, meaning that different techniques are
deployed at the same time or in sequence, making it more difficult
to detect the right type of attack and react to it. A distinction is
generally made between two categories of attack:
»»
attacks targeted at a volume which flood the network’s bandwidth
and the infrastructure;
»»
attacks at the application layer targeted at hitting specific services
and exhausting resources with a much lower volume of messages.
A number of common DDoS attacks are explained below.
SYN flood
A SYN message is sent by a computer, the source system, to a target
system, for example a web server, to create a connection through
the TCP protocol as a first step. SYN stands for ‘synchronise’. When
the target system receives a SYN message it responds with a SYN-ACK
message and the source system then sends back an ACK message.
ACK stands for ‘acknowledge’. In this way, communication is
133 Prolexic Quarterly Global DDoS attack Report Q1-13
134 See the detailed section on botnets.
135 ‘Cyber attack for sale on the internet’, Trouw, 11 April 2013. http://www.trouw.nl/tr/nl/5133/
Media-technologie/article/detail/3423959/2013/04/11/Cyberaanval-te-koop-op-internet.dhtml
136 Chris Verhoef, information technology professor at the Vrije universiteit: de Volkskrant, 9 April
2013: ‘Cyber attacks: a nice nuisance on the internet’.
67