Dos&DDos Attacks - Zombie - Botnets

Hi all, today i am going to write about Dos & DDos Attacks. Cyber security is based on three components. These are Confidentiality, Integrity and Accessibility(CIA). This type of attack is in the class of accessibility component. The level of danger of Dos&DDos attacks is lower than the other attack types because there is no possibility of an attacker to infiltrate the system in this attack type.  

There are some things that need to be known before they go to Dos & DDos attacks.

• If the incoming DDos attack is bigger than the bandwidth you have, there is nothing you can do. If you want to protect yourself in this case, you need to get support from your ISP.

• The majority of Dos & DDos attacks are not bandwidth attacks.

• You can not always out of service the victim. Sometimes you just slow it down.

Dos Attacks(Denial of Service)

Dos attacks are the type of attack to make systems unserviceable. Attackers perform Dos attacks using one or more computers. It is possible to perform Dos attacks on internet, local network and wireless networks. Blocking is easy because of the few attack resources, and blocking of attacking IP addresses often succeeds in stopping the attack. 

If IP Spoofing is enabled during the attack, the attack will appear to come from spoofed IP addresses. Depending on the number of spoofed IP addresses, it will not be possible to block the attack by blocking the source IP addresses.

DDOS Attacks(Distributed Denial of Service)

DDos attacks are similar to Dos attacks. But this time the attacker is attacking through hundreds or thousands of zombie computers. Zombie computers are computers that are under the control of an attacker, but who are unaware of it. In this type of attack, attackers successfully hide themselves because of using zombie computers. 

DDos Attacks

Components of DDos : 

Malware : Harmful software that will turn victims into zombies.

Zombi / Botnet : Computers that will attack the target

Commend & Control Center : Where everything is managed

Why do attackers use Botnet Networks ? Is it the sole purpose of making the target out of service?

Actually not. Attackers do not always aim to make the target unserviceable. For example, if you click on ads on your webpage with zombie computer on your botnet network, you can earn a high amount of revenue. Moreover, all this operation will be completely realistic because it is only clicked once on different computers located in different parts of the world.

As a second example, we can give Online Surveys. If the option you voted on is behind the survey results, you can let the zombie computers on your Botnet Network vote for the option you want. It should not be forgotten that this applies only to surveys for which Captcha Security measures have not been taken.

Where do the attackers manage Botnet Networks ? Where are the Command & Control Centers located?

Botnet Networks were managed through IRC chat rooms until 2005. However,  IRC chat rooms are not used for Botnet C&C since access to IRC chat rooms is blocked by many companies. Today, Botnet C&C are located on HTTP, HTTPS and P2P. 

The most popular Botnet C&C is Twitter. Zombie computers that constantly check the tweets of a twitter account that attackers have already set up will recognize it when a new twit is shared and start attacking the Web Site or IP address in the twit.

Twitter Command & Control

TCP Flood Attacks

A TCP flood attack is a DDoS attack that tries to fill the processing capacity of packets of the target system by sending a large number of TCP packets to the target system. IP Spoofing can be used in this type of attack.

Most Common TCP Flood Types : SYN Flood, ACK Flood, FIN Flood.

Reminder: TCP connections first make The 3-Way Handshake. TCP sessions always start with the TCP SYN packet. 

3-Way Handshake

The most effective TCP flood attacks are SYN Food Attacks. Because operating systems are starting to allocate system resources with the first incoming SYN package before the 3-Way Handshake is complete. If no change is made, the system resource release time is 120 seconds. Let's do a little calculation to see the power of SYN Flood attacks. The size of one SYN package is 65 bytes. With 25 Mbps bandwidth, it is possible to produce an average of 50,000 packets per second. It is possible to generate an average total of 6 million packages within 120 seconds until the system resource allocated by the first package you send is released ! 

We can perform TCP flood attacks in Linux with Hping3 tool. In the next article, I will make tutorial how to make SYN Flood, ACK Flood, FIN Flood and IP Spoofing with Hping3 tool.