SLIDE 1
CSCI-UA.9480 Introduction to Computer Security
Session 2.2
Denial of Service
- Prof. Nadim Kobeissi
Defining Denial
- f Service
Introduction to Computer Security Session 2.2 Denial of Service - - PowerPoint PPT Presentation
Introduction to Computer Security Session 2.2 Denial of Service - - PowerPoint PPT Presentation
CSCI-UA.9480 Introduction to Computer Security Session 2.2 Denial of Service Prof. Nadim Kobeissi 2.2a Defining Denial of Service 2 CSCI-UA.9480: Introduction to Computer Security Nadim Kobeissi What is a Denial of Service attack? An
SLIDE 2
SLIDE 3
What is a Denial of Service attack?
An attack “where the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet.” 3 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 4
What is a Denial of Service attack?
Some resource is being starved by an adversary: ⚫ Network overload? ⚫ CPU overload? ⚫ Memory overload? 4 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 5
What is a Denial of Service attack?
Some resource is being starved by an adversary: ⚫ Network overload: send too many packets. ⚫ CPU/memory overload: force the server to carry out too many password stretching instances. ⚫ Application overload: send too many database/API requests. 5 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 6
Examples of Denial of Service vectors.
UDP flood: unlike TCP, UDP has no flow control built in. ⚫ Fork bombs: :(){ :|: & };: ⚫ SYN flood: Initiate several TCP connections but never complete (ACK) them. ⚫ LAND attack: Craft a TCP packet where the source and destination IP addresses are both equal to the victim’s IP. ⚫ Malformed packets: exploit parsing errors. 6 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 7
Test your knowledge!
7 CSCI-UA.9480: Introduction to Computer Security – Nadim KobeissiCan you figure out why the following Bash command would be a “fork bomb”?
:(){ :|: & };:
SLIDE 8
Test your knowledge!
8 CSCI-UA.9480: Introduction to Computer Security – Nadim KobeissiCan you figure out why the following Bash command would be a “fork bomb”?
:(){ :|: & };:
Define a function called “:” Run “:”, pipe output to “:” executed in the background. Run “;” for the first time. SLIDE 9
DDoS: Distributed Denial of Service.
Example: Mirai botnet (600,000+ victims): ⚫ Caused serious damage to many leading hosting providers (e.g. OVH, Dyn...) ⚫ Among the highest ever recorded throughput for DoS attacks. 9 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 10
DDoS: Distributed Denial of Service.
Example: Mirai botnet (600,000+ victims): ⚫ Caused serious damage to many leading hosting providers (e.g. OVH, Dyn...) ⚫ Among the highest ever recorded throughput for DoS attacks. 10 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 11
DDoS: Distributed Denial of Service.
Example: Mirai botnet (600,000+ victims): ⚫ Caused serious damage to many leading hosting providers (e.g. OVH, Dyn...) ⚫ Among the highest ever recorded throughput for DoS attacks. 11 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 12
DDoS: Distributed Denial of Service.
Example: Mirai botnet (600,000+ victims): ⚫ Caused serious damage to many leading hosting providers (e.g. OVH, Dyn...) ⚫ Among the highest ever recorded throughput for DoS attacks. 12 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 13
DDoS: Mirai botnet device composition.
13 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 14
DDoS: Mirai botnet device composition.
14 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 15
DDoS: Mirai botnet victims.
15 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 16
Examples of other botnets.
⚫ Srizbi botnet: responsible for most of the spam in the world at some point. ⚫ Carna botnet: used for estimating the size of the Internet. 16 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 17
Another example: “Project Chanology”
Instead of a slide, at this point in the class we will watch this short documentary on Project Chanology: https://www.youtube.com/watch?v=vRb6L7SCSro 17 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 18
Mitigating Denial of Service Attacks
18 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi2.2b
SLIDE 19
Basic defenses against Denial of Service.
Firewalls, switches, and routers at ingress points of a network that use packet filtering. ⚫ Build models of normal and abnormal behavior and flag abnormal behavior. ⚫ Intrusion detection systems that look for attack signatures or abnormally high rates of traffic or both. ⚫ CAPTCHAs to ensure that a human and not a bot is carrying out the request. 19 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 20
Basic defenses against Denial of Service.
CAPTCHAs to ensure that a human and not a bot is carrying out the request. ⚫ Proof of work: request hashes, etc. 20 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 21
Content Delivery Networks: CloudFlare.
21 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi SLIDE 22
Content Delivery Networks (CDNs).
Akamai, CloudFlare, Amazon CloudFront, Microsoft Azure… ⚫ Concerns regarding centralizing of Internet traffic (i.e. man-in-the-middle capabilities). ⚫ Questions w.r.t. freedom of expression- nline:
SLIDE 23
Next time: Designing Secure Network Systems
23 CSCI-UA.9480: Introduction to Computer Security – Nadim Kobeissi