A denial-of-service attack is a type of attack that causes legitimate users to be unable to use the service. These come in a few different categories:
- Resource exhaustion (e.g. consuming all network bandwidth, or server CPU time)
- Limitation exploitation (e.g. locking a user out of their account by repeatedly attempting to log into it with invalid credentials)
- Process disruption (e.g. crashing a process that serves user requests, via a bug in the software)
- Data corruption (e.g. altering all user types to an invalid type, making it impossible for them to log in)
- Physical disruption (e.g. pulling out the power cable on a server) - thanks to Henning for this one!
The most common type on webapps is a resource exhaustion, which is what most people tend to refer to as a DoS. These are caused by an attacker sending a large number of requests to the server, in order to exhaust one or more resources:
- Network bandwidth may be entirely consumed by the attack, preventing legitimate user traffic from reaching the server.
- Each request uses some CPU time, so a large number of requests may cause the CPU to spend all of its time dealing with attacker requests, instead of legitimate requests. Attackers can send expensive requests (e.g. full-text searches, SSL connections, etc.) to the server to increase the impact. There are also cases where vulnerabilities in the server software allow the attacker to craft special requests that eat a lot of CPU time.
- A small amount of RAM is used for storing the connection state, which might allow for physical memory exhaustion if enough connections can be made. However, database queries can be very memory intensive, in terms of memory usage and memory bandwidth. If an attacker picks his queries well, he might be able to entirely exhaust the physical memory of the system.
- Logs, database tables, etc. are stored on disk. Sending a huge number of queries over a period of time may exhaust the disk space on the server, causing it to crash.
Note that the requests don't need to be HTTP - they could be DNS, HTTPS, SSH, FTP, SMTP, POP, IMAP, SMB, etc. Any situation where a service is listening for incoming packets is a potential way to achieve a DoS.
There are two primary ways to achieve basic application-independant network DoS attacks: TCP SYN floods and UDP flood.
The TCP protocol involves a three-way handshake. First, a client sends a SYN (synchronise) request, to which the server responds with a SYN-ACK (synchronise acknowledged), which the client then finally responds to with an ACK (acknowledge). However, if a client sends a SYN and does not respond to the SYN-ACK, the server is left with a half-open connection. This consumes a small amount of memory within the operating system, and eats a few CPU cycles. Eventually the connection is dropped, but a flood of SYN packets can be enough to cause serious performance issues on the target. There are a number of ways to mitigate this threat, and the most notable is SYN cookies, which allow the server to send back a response without storing the SYN state.
The UDP protocol doesn't involve any form of handshake. Packets are simply sent between hosts, with no state or connection. This means that an attacker can send a large number of UDP packets to the server, consuming their bandwidth. This requires that the total bandwidth of the client exceeds that of the server. Since the client doesn't need any response, it can spoof the source IP address, making mitigation harder. These types of attack can be harder to block, and often require intervention by the service provider.
The problem for attackers is that servers are designed to cope with a large number of concurrent users, and small denial of service attacks. Sending a huge number of packets from their home network or a rented server is unlikely to cause a significant reduction in availability or response speed of their target. In order to make the attack more effective, they use a distributed denial of service (DDoS) attack. This involves using a number of computers on different networks to flood the site with requests. Often the attacker will infect other computers with malware, to form a botnet, which is then used to perform DoS attacks. The difference is that a DDoS allows traffic to flow from legitimate (but compromised) source IPs, increasing the effectiveness of the attack and making it harder to block.