All language subtitles for 04. DoS & DDoS

Divorce and your setbacks, first of all, what are these acronyms, a divorce, a denial of service

attack, tries to make a web resource unavailable to its users by floating the target URL with more

requests than the server can handle.

That means during the attack period, regular traffic on the, for example, website will be either

slow down or completely interrupted, added yours a distributed denial of service attack.

Is that a U.S. attack from more than one resource at the same time?

Did U.S. attack is typically generated using thousands, even hundreds of thousands of unsuspecting

zombie devices.

These machines are collectively known as botnet and will have been previously infected with malicious

software so that they can be remotely controlled by the attacker.

It is currently estimated that worldwide millions of computers are at this point infected with botnet

programs.

But let's see how all this works will take a classic example with our hacker chief and the unsuspecting

Bob, who is the owner of a small online shop.

If wants to take Bob's shop down and she's planning to use the HTP flawed to accomplish it.

And HTP flawed is an attack similar to pressing, let's say, refresh in a Web browser over and over

on many different computers at was large numbers of HTP requests for the server, resulting in a denial

of service.

Of course, this type of attack ranges from simple to complex.

Simpler implementations may access one MRL with the same range of attacking IP addresses referrers and

user agents.

Complex versions may use a large number of attacking IP addresses and target random URLs using random,

referrers and user agents.

Now let's go a bit deeper in our example.

Let's imagine you make a bunch of requests and if a real customer wants to access Bob's shop, he or

she will not be able because it's bots are overloading the servers.

Since it's probably not very clear how this works.

Let's imagine you have a small physical shop and they send 50 fake customers at the same time to enter

your shop.

And then there is another real customer that wants to enter and buy.

But he or she will need to wait for a long time or maybe not even make it inside the shop.

Is she to be flawed?

Works in a very similar way, where the server where Bob's shop is hosted can only serve a maximum number

of simultaneous requests.

And if if boards reach that limit, the shop will not be available for the actual real customers types

of attacks.

Here we have five main categories.

Since they are quite complex in the description, you may find some words that you are not familiar

with for you were going to explain all those terms in the notes together with some links with further

information.

First, HTP flood.

This was the attack from our example and we're not going to spend some extra time on it in big lines.

This translates into a large number of requests that flood the server or servers, resulting in a denial

of service.

Second protocol attacks also known as a state exhaustion attack.

This causes a service disruption by consuming all the available state table capacity of web application

servers or intermediate resources like firewalls and load balancers.

Protocol attacks utilizers weaknesses in layer three and layer four of the protocol stack to render

the target inaccessible.

Third, ESSI unflawed is an analogue to a worker in a supply room receiving requests from the front

of the store.

The worker receives a request, goes and gets the package, and waits for the confirmation before bringing

the package out in front.

The worker then gets many more package requests without confirmation until they can carry any more packages

becoming overwhelmed and requests start going unanswered.

Fourth, volumetric attacks, this category of attacks, attempts to create congestion by consuming

all available bandwidth between the target and the larger Internet, large amounts of data are sent

to a target by using a form of amplification or another means of creating massive traffic, such as

requests from a botnet with a dense amplification is like if someone were to call a restaurant and say,

I'll have one of everything, please call me back and tell me my whole order again where the callback

phone number they give is the target number with very little effort, a long response it generated.

This concludes our lecture.

You will find the links with further information in the digital text file from the resource section.

Thank you.

And see you soon in our next chapter.