How Denial-of-Service Attacks work

Services have their limits. They cannot serve an unlimited number of clients simultaneously. A service can serve to its limit. At a given point in time, if a service exceeds its capacity, it will not serve clients who arrive after the limit. A DoS attack works on this basic principle. A DoS attack blocks a service from serving genuine clients. In a DoS attack, a hacker creates more fake client requests than the service's limit and sends them to the service. The service becomes too busy serving or replying to fake clients that it has no time for genuine clients. Genuine clients keep waiting for their turn.

How Denial-of-Service attacks work

On a TCP/IP network, applications use TCP to transmit data. TCP transmits data only over an established connection. To establish a connection between two communicating nodes, TCP uses a three-way handshake sequence. In this process, a node sends a SYNC signal to another node. The SYNC signal indicates that the node wants to establish a new data connection.

The other node accepts the new connection request, assigns a unique ID to the connection, and replies to the first node that its request has been accepted. To reply, the other node uses a SYNC/ACK signal. This signal contains all the information that the first node needs to establish the new connection.

The node receives the SYNC/ACK signal from the other node. In reply, it sends an ACK signal to confirm that the first node has received the required information and is ready to establish a new connection. When the other node receives the ACK signal from the first node, the three-way handshake ends. The connection state changes to established. Once a connection is established, the nodes can exchange data.

The following image shows the typical TCP handshake workflow.

Now, suppose a hacker wants to abuse TCP. The hacker creates thousands of SYNC requests using the IP address spoofing technique and sends them to the server. In IP address spoofing, a hacker uses a fake IP address in the source address field of an IP packet.

For each request, the server creates a new entry, assigns a unique ID, sends a SYNC/ACK signal, and waits for an ACK signal to establish the connection. TCP waits for a response until the timeout expires. If it does not receive a response by the end of the wait time, it terminates the connection.

Since the hacker used a fake IP address in the source address field, the server will never receive a response to the SYNC/ACK signal. The server has no choice but to wait until the wait time is over. Meanwhile, since TCP is filled with the (fake) SYNC connections, it does not accept new connections from genuine users.

The following image shows how a DoS attack works on TCP connections.

Distributed denial-of-service

Distributed denial-of-service is the extended version of DoS. In this technique, instead of using a single system, a hacker uses many systems to initiate a denial-of-service attack against a single target host. To do this, the hacker sets up a master computer somewhere on the Internet.

Later, it creates malware, a virus, or a script and hides it in pirated software. The hacker shares the pirated software online. When a user downloads and installs pirated software on their computer, it silently becomes a bot. A bot is a system that silently waits for a command from the master computer. It operates normally, so the user can't detect any change in the system.

When the hacker wants to launch an attack, he sends a command from the master computer to every bot, instructing it to carry out a DoS attack against the target host. Since the attack is distributed across many bots, it is called a distributed denial-of-service attack.

Types of DoS attacks

A hacker can perform many types of DoS attacks. The following are some of the most common types of attacks.

ICMP ping attack

ICMP is used to debug and troubleshoot a network. It includes several tools for testing and debugging. The ping command is part of ICMP. It allows an administrator to test device connectivity. Since all devices support the ping command, a hacker can use it to launch a DoS attack. To launch a DoS attack on a server, a hacker can send thousands of ping requests to the server in a single millisecond. The server becomes too busy handling ping requests that it doesn't have time to respond to other requests. This attack is also known as "The Ping of Death".

ICMP overwhelm attack

In this attack, a hacker modifies the IP header of a packet so that the target server believes it contains more data than it actually does. To overwhelm and crash the server, the hacker sends millions of modified packets to the server.

Chargen attack

In this attack, a hacker sends a massive number of UDP packets into the network. Usually, this attack is performed to create significant congestion or to consume all available network bandwidth.

SYNC flood attack

In this attack, a hacker randomly sends several SYNC requests to open too many TCP connections.

Packet fragmentation and reassembly attack

An interface can automatically reassemble and fragment a packet. This feature is very efficient for a network. To abuse this feature, a hacker can create fragments that can't be reassembled.

Email attack

In this attack, a hacker uses a bot or a script to send too many emails to a target user, consuming all available space of the user's inbox.

Conclusion

Hackers use various methods to block the real traffic. DoS (Denial-of-Service) is one of them. It attacks exploit service thresholds and network rules to prevent legitimate users from accessing them. This tutorial described how DoS works and its types.