Framework - Eastern Illinois University Eastern Illinois 框架-伊利诺斯东部的伊利诺斯东部大学.pptVIP

Targeted Break-in, DoS, Malware attacks (II) (February 18 2013) ? Abdou Illia – Spring 2013 * Learning Objectives Discuss DoS attacks Discuss Malware attacks Denial of Service Attacks * TCP opening and DoS For each TCP connection request (SYN), server has to: Respond to the request (SYN/ACK) Set resources aside in order respond to each data request . . . . SYN SYN/ACK ACK Waiting for request from Computer 1 1 SYN SYN/ACK ACK 2 SYN SYN/ACK ACK 3 Waiting for request from Computer 2 Waiting for request from Computer 3 Server . . . * Web Server configuration * Denial of Service (DoS) What resources the web server would use to respond to each of the HTTP requests it receives? What could be the consequences of the web server being invaded by too much requests from the attacker? Attacker’s Home Network * Denial of Service (DoS) Attack Attack that makes a computer’s resources unavailable to legitimate users Types of DoS attacks: Single-message DoS Flooding DoS Distributed DoS * Single-message DoS attacks First kind of DoS attacks to appear Exploit weakness in the coding of operating systems and network applications Three main single-message DoS: Ping-of-Death Teardrop LAND attack * Ping of Death attacks Take advantage of Fact that TCP/IP allows large packets to be fragmented Some network applications operating systems’ inability to handle packets larger than 65536 bytes Attacker sends IP packets that are larger than 65,536 bytes through IP fragmentation. Ping of death attacks are rare today as most operating systems have been fixed to prevent this type of attack from occurring. Example of PoD code and vulnerable Operating Systems: /sploits/ping-o-death.html Fix Add checks in the reassembly process or in firewall to protect hosts with bug not fixed Check: Sum of Total Length fields for fragmented IP is 65536 bytes Total Length (16 bits) Flags Fragment Offset (13 bits) Fragment offset: identify which fragment this packet is attached to. Flags: indicates whet