This document discusses denial of service (DoS) and distributed denial of service (DDoS) attacks. It defines DoS as an attack that seeks to oversaturate a targeted machine's capacity to disrupt authorized use, while a DDoS uses multiple compromised systems to flood the target. The document describes how DDoS attacks work by flooding the victim from many sources, making it hard to block. It lists common DoS attacks like buffer overflow and ICMP floods, and DDoS attack types like traffic floods and application attacks. The document also covers typical attacker motivations and recommendations to prevent attacks like buying more bandwidth and building redundancy.

1. December 27,2016 1
DoS & DDoS Attack

2. INTRODUCTION:
■ Denial ofService (DoS)
– Attack to disrupt the authorized useof
networks, systems, orapplications
– Primary focus is to oversaturate the
capacity of targeted machine
– perpetrator seeks to make a machine or
network resource unavailable to its
intended users
December 27,2016 2

3. Distributed Denial ofService (DDoS)
• DDoS attack is a malicious attempt to disrupt
the normal traffic of a targeted server,
• Achieve effectiveness by utilizing multiple
compromised computer systems as sources of
attack traffic.
• DDoS attacks are carried out with networks of
Internet-connected machines.
December 27,2016 3

4. HOW DDOS ATTACK WORK
■ incoming traffic flooding the victim
originates from many different
sources – potentially hundreds of
thousands ormore.
■ effectively makes it impossible to
stop the attack simply by blocking
asingle IPaddress;
■ very difficult to distinguish
legitimate user traffic from attack
traffic when spread across so many
points oforigin.
December 27,2016 4

5. TYPES OF DOS ATTACKS
• Buffer overflow attacks – the most common DoS attack. The
concept is to send more traffic to a network address than the
programmers have built the system to handle.
• ICMP flood – leverages misconfigured network devices by sending
spoofed packets that ping every computer on the targeted network,
instead of just one specific machine. The network is then triggered

6. TYPESOFDDOSATTACKS
December 27,2016 6
■ Trafficattacks: Traffic flooding attacks send ahuge volume of TCP
,UDP and
ICPM packets to the target. Legitimate requests get lost and these attacks
may be accompanied by malware exploitation.
■ Bandwidth attacks: This DDoS attack overloads the target with massive
amounts of junk data. This results in a loss of network bandwidth and
equipment resources and can lead to acomplete denial of service.
■ Application attacks: Application-layer data messages can deplete
resources in the application layer, leaving the target's system services
unavailable.

7. DoS Attack DDos Attack
• DOS Stands for Denial of
service attack.
• In Dos attack single system
targets the victims system.
• Victim PC is loaded from the
packet of data sent from a single
location.
• Volume of traffic in Dos attack is
less as compared to DDos.
• DDOS Stands for Distributed
Denial of service attack.
• In DDos multiple system
attacks the victims system
• Victim PC is loaded from the
packet of data sent from
Multiple location
• DDoS attacks allow the
attacker to send massive
volumes of traffic to the victim
network.

8. ATTACKER MOTIVATION
1.Hacktivism: Hacktivists use DoS attacks as a means to express their criticism
of everything, from governments and politicians, including “big business”
2. Cyber vandalism: These vandals are often bored teenagers looking for an
adrenaline rush, or seeking to vent their anger or frustration against an
institution or on a person.
3. Business competition: DoS and DDoS attacks are increasingly being used
as a competitive business tool.
4. Extortion: An increasingly popular motivation for DDoS attacks is extortion,
meaning a cybercriminal demands money in exchange for stopping (or not
carrying out) a crippling DDoS or DoS attack

9. ATTACK PREVENTION
MBER27,
9
 Buy More Bandwidth ensure that you have enough bandwidth to handle
spikes in traffic that may be caused by malicious activity.
 Build Redundancy Into Your Infrastructure For this strategy to be truly
effective, it’s necessary to ensure that the data centers are connected to
different networks.
 Configure Your Network Hardware Against DDoS Attacks: For example,
configuring your firewall or router to drop incoming ICMP packets or
block DNS responses from outside your network

10. DOSATTACK
DEMO
December 27,2016 10