Ethical Hacking
Module VIII
Denial Of Service
Module Objective
What is a Denial Of Service Attack?
What is a Distributed Denial Of Service Attack?
Why are they difficult to protect against?
Types of denial of service attacks
Tools for running DOS attacks
Tools for running DDOS attacks
Denial of Service Countermeasures
It’s Real
On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, eBay (EBAY), Amazon.com (AMZN), and CNN (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off.
(Business Week Online, 12 February 2000)
What is a Denial Of Service Attack?
A denial of service attack (DOS) is an attack through which a person can render a system unusable or significantly slow down the system for legitimate users by overloading the resources, so that no one can access it.
If an attacker is unable to gain access to a machine, the attacker most probably will just crash the machine to accomplish a denial of service attack.
Types of denial of service attacks
There are several general categories of DoS attacks.
Popularly, the attacks are divided into three classes:
bandwidth attacks,
protocol attacks, and
logic attacks.
What is Distributed Denial of Service Attacks?
An attacker launches the attack using several machines. In this case, an attacker breaks into several machines, or coordinates with several zombies to launch an attack against a target or network at the same time.
This makes it difficult to detect because attacks originate from several IP addresses.
If a single IP address is attacking a company, it can block that address at its firewall. If it is 30000 this is extremely difficult.
Ping of Death
An attacker sends a large ping packet to the victim`s machine. Most OS do not know what to do with a packet that is larger than the maximum size, it causes the OS to hang or crash.
Example: Ping of Death causes blue screen of death in Windows NT.
Ping of Death uses ICMP to cause a denial of service attack against a given system.
Hacking Tool: SSPing
SSPing is a DoS tool.
SSPing program sends the victim`s computer a series of highly fragmented, oversized ICMP data packets.
The computer receiving the data packets lock when it tries to put the fragments together.
The result is a memory overflow which in turn causes the machine to stop responding.
Affects Win 95/NT and Mac OS
Hacking Tool: Land Exploit
Land Exploit is a DoS attack in which a program sends a TCP SYN packet where the target and source addresses are the same and port numbers are the same.
When an attacker wants to attack a machine using the land exploit, he sends a packet in which the source/destination ports are the same.
Most machines will crash or hang because they do not know how to handle it.
Hacking Tool: Smurf
Smurf is a DoS attack involving forged ICMP packets sent to a broadcast address.
Attackers spoof the source address on ICMP echo requests and sending them to an IP broadcast address. This causes every machine on the broadcast network to receive the reply and respond back to the source address that was forged by the attacker.
1. An attacker starts a forged ICMP packet-source address with broadcast as the destination.
2. All the machines on the segment receives the broadcast and replies to the forged source address.
3. This results in DoS due to high network traffic.
SYN Flood
SYN attack floods a targeted system with a series of SYN packets.
Each packet causes the targeted system to issue a SYN-ACK response, while the targeted system waits for the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue.
SYN-ACKs are moved of the queue only when an ACK comes back or when an internal timer (which is set at relatively long intervals) terminates the TCP three-way handshake
Once the queue is full, the system will ignore all incoming SYN requests, making the system unavailable for legitimate users.
Hacking Tool: WinNuke
WinNuke works by sending a packet with "Out of band" data to port 139 of the target host. First off, port 139 is the NetBIOS port and does not accept packets unless the flag OOB is set in incoming packet.
The OOB stands for Out Of Band. When the victim`s machine accepts this packet, it causes the computer to crash a blue screen.
Because the program accepting the packets does not know how to appropriately handle Out Of Band data, it crashes.
Hacking Tool: Jolt2
Jolt2 enables users across different networks to send IP fragment-driven denial of service attacks against NT/2000 by making victim`s machine utilize 100% of its CPU when it attempts to process the illegal packets.
c: > jolt2 1.2.3.4 -p 80 4.5.6.7
The above command launches the attack from the attacker`s machine with a spoofed IP address of 1.2.3.4 against the IP address 4.5.6.7
The victim`s machine CPU resources reach 100% causing the machine to lock up.
Hacking Tool: Bubonic.c
Bubonic.c is a DOS exploit that can be run against Windows 2000 machines.
It works by randomly sending TCP packets with random settings with the goal of increasing the load of the machine, so that it eventually crashes.
c: > bubonic 12.23.23.2 10.0.0.1 100
Hacking Tool: Targa
Targa is a program that can be used to run 8 different Denial Of Service attacks.
The attacker has the option to either launch individual attacks or to try all the attacks until it is successful.
Targa is a very powerful program and can do a lot of damage to a company`s network.
Tools for running DDOS Attacks
The main tools for running DDOS attacks are:
Trinoo
TFN
Stacheldraht
Shaft
TFN2K
mstream
DDOS - Attack Sequence
All of the DDOS tools follow this sequence.
Mass-intrusion Phase - automated tools identify potential systems with weaknesses; then root compromise them and install the DDOS software on them. These are the primary victims.
DDOS Attack Phase - The compromised systems are used to run massive DOS against a victim site.
Trinoo
Trinoo (TrinOO) was the first DDOS tool to be discovered.
Found in the wild (binary form) on Solaris 2.x systems compromised by buffer overrun bug in RPC services: statd, cmsd, ttdbserverd.
Trinoo daemons were UDP based, password protected remote command shells running on compromised systems.
DDOS Structure
The attacker controls one or more master servers by password protected remote command shells.
The master systems control multiple daemon systems. Trinoo calls the daemons "Bcast" hosts.
Daemons fire packets at the target specified by the attacker.
Hacking Tool: Trinoo
Trinoo is a DDOS attack tool. It uses the following TCP Ports:
Attacker to master: 27665/tcp
Master to daemon: 27444/udp
Daemon to master: 31335/udp
Daemons reside on the systems that launch that the attack, and masters control the daemon systems.
Since Trinoo uses TCP, it can be easily detected and disabled.
TFN
Could be thought of as `son of trinoo`
Improved on some of the weaknesses of trinoo by adding different types of attacks that could be mounted against the victim site.
Structured like trinoo with attackers, clients (masters) and daemons.
Initial system compromise allows the TFN programs to be installed.
Hacking Tool: TFN2K
http://packetstorm.security.com/distributed
TFN2K is a DDOS program which runs in distributed mode. There are two parts to the program: client and server.
The server (also known as zombies) runs on a machine in listening mode and waits for commands from the client.
Running the server
#td
Running the client
#tn -h 23.4.56.4 -c8 -i 56.3.4.5
This command starts an attack from 23.4.56.4 to the victim`s computer 56.3.4.5
Hacking Tool: Stacheldraht
Stacheldraht combines the features of TFN and Trinoo but adds encryption layer between daemons.
Stacheldraht uses TCP and ICMP on the following ports:
Client to Handler: 16660 TCP
Handler to and from agents: 65000 ICMP
Preventing DoS Attacks
You could do the following things to minimize the DoS attack:
Effective robust design
Bandwidth limitations
Keep systems patched
Run the least amount of services
Allow only necessary traffic
Block IP addresses
Due to the power of DoS attacks and the way they work, there is nothing that can be done to prevent a Dos attack entirely.
Preventing the DDoS
Keep the network secure
Install IDS (Intrusion Detection System)
Use scanning tools
Run zombie tools
IDS pattern matching technologies have a database of signatures. When it finds packets that have a given pattern, it sets off an alarm.
Common IDS systems
Shareware
Snort
Shadow
Courtney
Commercial
ISS RealSecure
Axent NetProwler
Cisco Secure ID (Net Ranger)
Network Flight Recorder
Network Security Wizard`s Dragon
Use Scanning Tools
There are several tools available which could detect whether a system is being used as a DDOS server. The following tools can detect TFN2K, Trinoo and Stacheldraht.
Find_DDOS
(http://ftp.cert.org.tw/tools/Security_Scanner/find_ddos/)
SARA
(http://www.cromwell-intl.com/security/468-netaudit.html)
DDoSPing v2.0
(http://is-it-true.org/pt/ptips19.shtml)
RID
(http://staff.washington.edu/dittrich/misc/ddos/)
Zombie Zapper
(http://razor.bindview.com/tools/zombiezapper_form.shtml)
Summary
Denial of Service is a very commonly used attack methodology.
Distributed Denial Of Service using a multiplicity of Zombie machines is an often seen attack methodology.
There are various tools available for attackers to perpetrate DOS attacks.
Protection against DOS is difficult due to the very nature of the attacks.
Different scanning tools are available to aid detection and plugging of vulnerabilities leading to DOS