Denial-of-Service Attacks - An Overview of the SYN Flood and Distributed Attack Methods
Denial-of-service attacks (also called "DoS"), while not new, are becoming more and more popular attacks among hackers for taking websites offline. In my experience, the people who use tools designed to carry out these attacks often have no idea what's actually going on under the hood. I will attempt to outline two methods of DoS here- SYN flooding and distributed attacks.
A Bit About TCP
Transmission Control Protocol (TCP), for anyone not familiar, is a protocol that allows for streaming data between two computers on a network. "Streaming", in this context, means packets sent via TCP are treated as segments in a large stream rather than treated independently (as in UDP). As an analogy, TCP facilitates data exchange much like a phone call, where participants establish a connection and talk freely back and forth until they close it. (By contrast, snail mail is more analogous to UDP, where each item sent is independent and exchanges can sometimes be called "connectionless.") TCP delivers transmitted data in the proper sequence and without errors, making it useful in a wide variety of Internet applications.
In order to facilitate this reliable exchange, however, the computers communicating must first establish a TCP connection between each other. This is accomplished via what's called the "Three-Way Handshake." The computer requesting the connection (hereby referred to as the "client") sends a request to the computer it wishes to connect to (hereby referred to as the "server") asking to establish a connection. This initial request is called a "SYN" packet. The server replies with a "SYN-ACK" packet acknowledging that the original SYN packet was received. Finally, the client replies with an "ACK" packet to notify the server that it received the server's acknowledgement. At this point, the connection has been established, and the transmission can take place. This simple diagram is a good visual of the process.
SYN Flooding
Packets contain the IP address information of both the packet's sender and its intended destination. Packets can also be forged, and that address data can be modified. Hence, you can send data with a completely bogus source IP address.
If we spoof the source address on that initial SYN packet when establishing our TCP connection, the server will send a SYN-ACK packet to our fake address and wait to receive an ACK packet in reply. In the meantime, it will keep the connection we're trying to establish half-open. If we keep sending these SYN packets with spoofed addresses, the server will keep creating these half-open connections. Eventually, the server will be trying to open more connections than it can support, and will deny service to anyone trying to establish a new connection (even if they're legitimate users). This is known as a SYN flood denial-of-service attack.
Distributed Attacks
Distributed denial-of-service attacks, or DDoS, have garnered a lot of media attention in recent years. They are similar to the SYN flood and other DoS methods in that they exhaust the server's resources and force it to deny service to legitimate users. However, they differ in that DDoS attacks often have hundreds or thousands of machines carrying out the attack (hence the name "distributed"), whereas other methods are usually carried out by a smaller number of individuals/computers.
Traditionally, these larger numbers came from massive botnets, usually comprised of zombie computers infected by a trojan or other malware. Along with denying service, they've also been used as a means of extortion. It's also rumored that big businesses would sometimes use DDoS attacks to sabotage their rivals. More recent examples involve people downloading tools to coordinate DDoS attacks in support of a movement. Such tools are usually adapted from network stress testing programs, which flood the target with TCP or UDP packets when run by the user. Although DDoS attacks in support of a movement tend to get more media attention, both forms of DDoS can take sites and services offline with staggering efficiency.
Further Reading
Wikipedia has some good information about DoS attacks and TCP connection establishment.
If you're really die-hard, RFC 739 defines TCP in excruciating detail.
Posted Jul 20, 2012, 12:16 AM UTC
glit_lu is out for a bit while he waits on a new computer. I know he wanted the emphasis to be on programming, but I thought I would make some initial contributions on something I'm a little more knowledgeable about. Any feedback on the post (mistakes, format, etc) is welcome, and I'll be happy to answer questions anyone has.
Thank you for the informative post! As someone who likes the "theory" side as much as the "practical" side, this was great. One question, though. If SYN Flooding is so effective with very few attackers, then why use DDoS at all? Or if DDoS is used, why not just have more people using SYN Flooding (since DDoS sounds like just flooding with packets; no necessarily SYN Flooding)?
Glad you liked the post. I'll be dropping a few more that are "theory-based" over the next few days.
The techniques used in DoS attacks depend largely on the target, and how well it can mitigate such an attack. Countermeasures to SYN flooding do exist. "SYN cookies," for example, allow the server to drop the half-open TCP connections but reconstruct them if they receive an ACK packet from the client (step 3 of the handshake). DDoS mitigation techniques exist too, but many of them are still in papers being published/presented and haven't been implemented as widely.
Another factor is resources. As we've seen in the news, protests and calls-to-arms tend to garner more resources than things like corporate espionage. A DDoS attack coming from 10 computers likely won't be enough to bring down a major website, whereas an angsty network of thousands easily could. However, if you know that server doesn't manage its TCP connections well, a SYN flood from that handful of machines very well could take it offline.
Granted, there's a plethora of DoS techniques besides SYN flooding and DDoS. I wouldn't be surprised if there were some hybrid attacks that use multiple techniques at once.