Introduction to Cyber-Warfare - Proiect SEMPER FIDELIS

RUDIMENTARY BUT EFFECTIVE: DENIAL OF SERVICE13of legitimate traffic to the effect of rendering it inaccessible to other users, though more subtleforms of this attack exist. 5 When numerous systems are involved in the DoS attack (henceamplifying its effects) it is often referred to as a “Distributed Denial of Service” or DDoS.Data are carried over the Internet within a sequence of packets. Each packet can be thoughtof as an envelope, with some information on the outside describing where the packet is fromand where it is going. Inside this “envelope” are the data carried by the packet. A packet flooddenial of service attack entails one computer on the Internet sending another computer anunregulated and continuous stream of packets. Computers on the Internet, and the routinginfrastructure that carry packets on the Internet, are required to examine every packet theytransmit or receive. There is no obvious indicator in a packet whether it is part of a denial ofservice attack, or simply part of a file download or otherwise legitimate request of a server.Other forms of denial of service attacks are more subtle. Denial of service attacks ultimatelyhinge on an attacker’s ability to exhaust or monopolize computing resources of a server ornetwork. For example, the Secure Socket Layer (SSL) protocol provides a mechanism fortwo computers to transmit data without allowing an eavesdropper to read the data. It doesthis by using encryption. Using legitimate features of the SSL protocol, attackers are able toconvince servers that support SSL into performing spurious computation, denying the usageof the servers to legitimate users. 6These more subtle forms of DDoS attacks can carry individual markers that can allow networkdefense software to block or reject requests that would cause a denial of service condition.For example, the Low Orbit Ion Cannon (LOIC) tool, used by the Anonymous hacktivists, acontained an identifying string that differentiated it from connections from benign Webbrowsers. Web servers could use this string to determine whether or not a client was the maliciousLOIC tool or a Web browser, and could then deny all connections to the LOIC tool. In theevent where attackers were able to coordinate a sufficient number of hosts running the LOICtool, the amount of bandwidth consumed by maintaining each individual connection could besufficient for a DDoS attack of its own. Also, mitigatory technologies that perform this kind ofdiscrimination can themselves become bottlenecks that are targets of DDoS attacks. 7In the attacks against Estonia in 2007, posts were made on pro-Russia message boardsinciting members and readers of those message boards to conduct a packet flood denial ofservice attack against Estonian computer systems. The posts contained a very simple programthat users could download and run on their computers. The program would use commandsthat are present on all Windows computers, namely the “ping” command, to flood Estoniancomputers with traffic. “Ping” is normally used as a diagnostic utility to troubleshootnetworking issues; however, when used en masse by a large group of people, the “ping” commandcan generate enough traffic to cause a packet flood DoS attack. 8While performing a denial of service attack, it is very easy for the attackers to assessthe effectiveness of their attack. If the Web site is reachable, then the attack is not workingand the parameters of the attack need to be adjusted. This rapid feedback of informationallows attackers conducting denial of service attacks to adapt quickly to changes that systemadministrators make.a We further discuss the Low Orbit Ion Cannon, including its legitimate uses, in Chapter 6.