The most basic definition of a denial of service
is when you are preventing a service from operating.
And this can be done a number of different ways.
In the computer and networking world,
there are a lot of different ways
to create a denial of service situation.
If you are to overload a particular web
server, for instance, with thousands or millions of people
hitting it all at once, it would cause that server
to be completely overwhelmed by the number of requests
it's getting and, therefore, not be able to provide services
to the people that would really like to,
legitimately, get access to that web server.
Denial of service is also designed
to take advantage, sometimes, of a very specific vulnerability.
For instance, there may be a router.
When a router receives a particular kind of packet,
it doesn't know what to do with that packet.
And it causes a problem inside the software of that router
and may cause the router to stop forwarding traffic.
This is something that many router manufacturers
have had to deal with.
And whenever they find a vulnerability like that,
obviously they patch it very quickly.
But the bad guys know about these vulnerabilities.
And if they find a router that isn't patched,
they may be able to find that particular design
failure or that particular vulnerability
and take advantage of it, completely
bring that router down.
Now that router has to be rebooted for it
to be able to work properly.
You may also just want to cause an entire system
to become unavailable, not for a malicious reason, necessarily,
but more of a competitive advantage reason.
We see this a lot in industrial espionage,
when there is one particular organization that
would like to keep their competition out of business.
And they may do that through nefarious means,
such as creating a denial of service situation.
This may also, of course, be a smokescreen
for another kind of exploit.
In a previous video, we talked about a man-in-the-middle
attack.
We talked about DNS spoofing.
We've talked about DNS poisoning.
And when you start to do those types of things,
it may become very useful for you to create a diversion
or to overload a legitimate server,
so that you can take advantage of that.
And you can become the legitimate server.
You're now available, that other machine no longer available.
You're now the new DNS server.
And when it comes to DNS poisoning,
that can be very, very, very useful,
very helpful when you're performing that type of attack.
This, of course, does not have to be
a complex process for a denial of service.
I mentioned the very basic definition
of a denial of service is to prevent
any access to that resource.
One good way to do it would be to turn off the power.
You don't have to have a million systems
hitting a web server at once.
You simply go outside the building.
You notice outside of the building
the power, the big switch for the power
system on the building, is not locked up.
You walk up.
You turn the switch.
The entire building goes down.
You've just created a denial of service situation.
When we're talking about big time denial of service,
though, we're talking about many devices on the internet,
participating all at once.
Wherever we were looking at botnets, in our botnet video,
we were talking about these botnets just
sitting there and waiting for a command.
And the bad guys may take an army of their robot network
devices out there, send them a command that says, please take
down a web server, send a denial of service attack
to a particular site.
And so you can use this army of computers
to bring down that service.
Use all the bandwidth, use as many resources
available in that web server.
If that web server can serve 1,000 users at once,
hit them with 2,000.
He'll be so busy trying to serve that many systems,
he won't be able to operate and do anything for anyone else.
This is exactly the purpose of a botnet, not just to send spam,
but to participate in these massive types of events.
Coreflood was a really good example of this.
This was taken down in April 2011.
2.3 million devices, it's estimated,
were participating in this Coreflood botnet.
And these botnet command and control
would send these devices out to take down individual systems.
Becomes a bit of an issue when you're
trying to keep those websites up and running.
There's really very little you can
do when that many systems are hitting you all at once.
This may also be something called an asymmetric threat,
which means the attacker, the individual device,
has fewer resources then the victim has.
Sort of an odd situation.
You've got all these individual boxes out there.
They may be very tiny devices.
But they are now all working together
to take down a much larger giant.
That becomes a real big issue.
It's very difficult to build a web server that
would be able to accommodate 2.3 million requests all at once
and, therefore, it's very, very simple
for these tiny, tiny little devices
to take down those monster websites.
One of the very first denial of service attacks
was one called a Smurf attack.
And what was nice about the Smurf attack
is you could get a lot of bang for your buck.
And here's what I mean by this.
You would be a station out on the network.
When the 192.168.1.22, let's call you on this laptop,
and you would like to take down the server
that's at 192.168.1.1.
But one machine that's sitting out here,
it would be very, very difficult--
because this is a big beefy server-- it would
be very difficult for one machine
to take down that one server.
So the key to a Smurf attack is that you
get to involve everybody else on the network.
And the way you do that is through something that
was very commonly done back in the day.
This was back in the '90s.
This is a capability that, really, you
don't see much anymore.
But you send a ping out, an ICMP echo request.
Then you spoof the From address, even though you're 1.22.
You send the packet out and say, Hi.
I'm 192.168.1.1.
You pretend you're the server.
And you send it to the broadcast address for the subnet.
When all of these devices out here see this packet,
they are all programmed to take in and react
to broadcast addresses.
Everybody must look at a broadcast frame.
That's the whole purpose of a broadcast.
And they look at that and say, wow.
That's a ping.
I need to now send this ping response
back to the 1.1 address.
And now everybody on the network sends a response back.
So by sending out this one packet,
you can get an entire subnet sending back ping commands.
And if you start streaming out those ping requests,
obviously you'll start multiplying
the amount of ping responses going back
to that individual server.
And, hopefully, if this is your objective,
you're creating a denial of service situation
for that server.
Now, the reality is that, today, our routers are not
going to route these subnet requests,
these broadcast requests, for a ping to the subnet.
And our individual workstations these days
are programmed not to respond to a request.
You'll still see one from time to time
that won't participate that way.
And that may be an older system.
Or it may be a type of operating system
that will respond to that, but generally, you'll
find most systems won't participate in a Smurf attack.
But it was a very, very common way,
in fact, one of the very first ways, to do a denial of service
and make it very, very easy if you're on that subnet,
to take down one of these big servers, all
with a single packet.