What Does a Dos Attack Do to a Computer?

What is a denial-of-service attack?

A denial-of-service (DoS) attack is a security threat that occurs when an attacker makes it impossible for legitimate users to access computer systems, network, services or other it (IT) resources. Attackers in these types of attacks typically flood web servers, systems or networks with traffic that overwhelms the victim's resources and makes it difficult or impossible for anyone else to admission them.

Restarting a system will usually prepare an set on that crashes a server, but flooding attacks are more hard to recover from. Recovering from a distributed DoS (DDoS) attack in which attack traffic comes from a large number of sources is even more difficult.

DoS and DDoS attacks often accept advantage of vulnerabilities in networking protocols and how they handle network traffic. For case, an attacker might overwhelm the service by transmitting many packets to a vulnerable network service from different Internet Protocol (IP) addresses.

How does a DoS attack piece of work?

DoS and DDoS attacks target i or more than of the 7 layers of the Open Systems Interconnection (OSI) model. The about mutual OSI targets include Layer 3 (network), Layer 4 (transport), Layer 6 (presentation) and Layer 7 (application).

Diagram of the layers of the Open Systems Interconnection model — Layers 3, 4, 6 and 7 are the most common layers for attacks of the Open Systems Interconnection model.

Malicious actors have different ways of attacking the OSI layers. Using User Datagram Protocol (UDP) packets is i common way. UDP speeds transmission transferring data earlier the receiving party sends its understanding. Another common set on method is SYN (synchronization) parcel attacks. In these attacks, packets are sent to all open ports on a server, using spoofed, or imitation, IP addresses. UDP and SYN attacks typically target OSI Layers 3 and 4.

Protocol handshakes launched from net of things (IoT) devices are at present commonly used to launch attacks on Layers half-dozen and 7. These attacks can be difficult to identify and preempt because IoT devices are everywhere and each is a detached intelligent client.

Signs of a DoS attack

The U.s.a. Computer Emergency Readiness Team, too known as US-CERT, provides guidelines to determine when a DoS attack may be in progress. According to US-CERT, the following may indicate an attack is underway:

slower or otherwise degraded network performance that is specially noticeable when trying to access a website or open files on the network;
inability to admission a website; or
more than spam email than usual.

four signs of a denial-of-service attack — Learn the signs of a bot-driven denial-of-service attack.

Preventing a DoS assault

Experts recommend several strategies to defend against DoS and DDoS attacks, starting with preparing an incident response program well in advance.

An enterprise that suspects a DoS attack is underway should contact its internet service provider (ISP) to determine whether slow performance or other indications are from an set on or some other cistron. The ISP can reroute the malicious traffic to counter the attack. Information technology can besides use load balancers to mitigate the severity of the assault.

ISPs also accept products that detect DoS attacks, as do some intrusion detection systems (IDSes), intrusion prevention systems (IPSes) and firewalls. Other strategies include contracting with a backup ISP and using deject-based anti-DoS measures.

There take been instances where attackers have demanded payment from victims to end DoS or DDoS attacks, but financial profit is not ordinarily the motive behind these attacks. In many cases, the attackers wish to damage the business organisation or reputation of the organization or individual targeted in the assail.

Types of DoS attacks

DoS and DDoS attacks have a variety of methods of attack. Common types of denial-of-service attacks include the following:

Awarding layer. These attacks generate fake traffic to net application servers, especially domain name system (DNS) servers or Hypertext Transfer Protocol (HTTP) servers. Some application layer DoS attacks flood the target servers with network data; others target the victim's awarding server or protocol, looking for vulnerabilities.
Buffer overflow . This blazon of attack is ane that sends more traffic to a network resource than information technology was designed to handle.
DNS amplification . In a DNS DoS assault, the attacker generates DNS requests that appear to take originated from an IP address in the targeted network and sends them to misconfigured DNS servers managed by third parties. The amplification occurs every bit the intermediate DNS servers respond to the fake DNS requests. The responses from intermediate DNS servers to the requests may contain more data than ordinary DNS responses, which requires more resources to process. This tin can result in legitimate users existence denied admission to the service.
Ping of expiry . These attacks corruption the ping protocol by sending request messages with oversized payloads, causing the target systems to go overwhelmed, to stop responding to legitimate requests for service and to possibly crash the victim'south systems.
Country burnout. These attacks -- also known as Transmission Command Protocol ( TCP) attacks -- occur when an assaulter targets the state tables held in firewalls, routers and other network devices and fills them with attack data. When these devices incorporate stateful inspection of network circuits, attackers may be able to fill the state tables past opening more TCP circuits than the victim's system can handle at once, preventing legitimate users from accessing the network resource.
SYN flood . This assault abuses the TCP handshake protocol by which a client establishes a TCP connectedness with a server. In a SYN flood attack, the assaulter directs a high-book stream of requests to open up TCP connections with the victim server with no intention of completing the circuits. A successful assail can deny legitimate users admission to the targeted server.
Teardrop. These attacks exploit flaws similar how older operating systems (OSes) handled fragmented IP packets. The IP specification enables package fragmentation when the packets are also big to exist handled by intermediary routers, and it requires package fragments to specify fragment offsets. In teardrop attacks, the fragment offsets are set up to overlap each other. Hosts running affected OSes are and then unable to reassemble the fragments, and the attack can crash the arrangement.
Volumetric. These DoS attacks use all the bandwidth available to reach network resources. To do this, attackers must directly a high volume of network traffic at the victim's systems. Volumetric DoS attacks inundation a victim'due south devices with network packets using UDP or Internet Control Message Protocol (ICMP). These protocols crave relatively little overhead to generate large volumes of traffic, while, at the aforementioned fourth dimension, the victim'due south network devices are overwhelmed with network packets, trying to process the incoming malicious datagrams.

What is DDoS and how does it compare to DoS?

Many high-contour DoS attacks are actually distributed attacks, where the assault traffic comes from multiple attack systems. DoS attacks originating from i source or IP address tin can exist easier to counter because defenders can block network traffic from the offending source. Attacks from multiple attacking systems are far more difficult to observe and defend confronting. It can be difficult to differentiate legitimate traffic from malicious traffic and filter out malicious packets when they are beingness sent from IP addresses seemingly located all over the net.

In a distributed denial-of-service assail, the attacker may use computers or other network-continued devices that have been infected by malware and fabricated part of a botnet. DDoS attacks use command-and-command servers (C&C servers) to control the botnets that are part of the attack. The C&C servers dictate what kind of attack to launch, what types of data to transmit, and what systems or network connectivity resources to target with the assail.

History of denial-of-service attacks

DoS attacks on internet-connected systems accept a long history that arguably started with the Robert Morris worm attack in 1988. In that assault, Morris, a graduate educatee at Massuchusetts Found of Technology (MIT), released a self-reproducing slice of malware -- a worm -- that quickly spread through the cyberspace and triggered buffer overflows and DoS attacks on the affected systems.

Those connected to the cyberspace at the time were mostly inquiry and academic institutions, just it was estimated that as many every bit 10% of the 60,000 systems in the U.S. were affected. Damage was estimated to be as high as $x one thousand thousand, according to the U.South. General Bookkeeping Office (GAO), now known as the Authorities Accountability Office. Prosecuted under the 1986 Figurer Fraud and Abuse Act (CFAA), Morris was sentenced to 400 customs service hours and three years' probation. He was likewise fined $x,000.

DoS and DDoS attacks take get mutual since and then. Some recent attacks include the following:

GitHub. On Feb. 28, 2018, GitHub.com was unavailable because of a DDoS assault. GitHub said it was offline for under 10 minutes. The attack came "beyond tens of thousands of endpoints … that peaked at 1.35 terabits per second (Tbps) via 126.9 million packets per second," according to GitHub.
Imperva. On April thirty, 2019, network security vendor Imperva said it recorded a large DDoS assail against one of its clients. The attack peaked at 580 million packets per 2d but was mitigated past its DDoS protection software, the company said.
Amazon Spider web Services (AWS). In the AWS Shield Threat Landscape Study Q1 2020, the cloud service provider (CSP) said it mitigated one of the largest DDoS attack information technology had ever seen in February 2020. Information technology was 44% larger than anything AWS had encountered. The volume of the assault was 2.3 Tbps and used a type of UDP vector known as a Connexion-less Lightweight Directory Access Protocol (CLDAP) reflection. Amazon said it used its AWS Shield to counter the assail.

This was last updated in April 2021

Continue Reading About denial-of-service assail

6 common types of cyber attacks and how to prevent them

The ultimate guide to cybersecurity planning for businesses

ten types of security incidents and how to handle them

Credential stuffing: When DDoS isn't DDoS

The nighttime spider web in 2021: Should enterprises be worried?

Dig Deeper on Network security

Implement API charge per unit limiting to reduce set on surfaces

By: Kyle Johnson
IP spoofing

By: Ben Lutkevich
distributed denial-of-service (DDoS) attack

By: Ben Lutkevich
3 ways to prevent DDoS attacks on networks

Past: John Cavanaugh