DDOS attack

A DDOS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete. Which attack is being described here?

Leave a Comment / CEHv11 / By

A DDOS attack is performed at layer 7 to take down web infrastructure. Partial HTTP requests are sent to the web infrastructure or applications. Upon receiving a partial request, the target servers opens multiple connections and keeps waiting for the requests to complete.
Which attack is being described here?

Option 1 : Slowloris attack
Option 2 : Session splicing
Option 3 : Phlashing
Option 4 : Desynchronization

1. Slowloris attack

Developed by Robert “RSnake” Hansen, Slowloris is DDoS attack software that permits one computer to require down an internet server. Due the straightforward yet elegant nature of this attack, it requires minimal bandwidth to implement and affects the target server’s web server only, with almost no side effects on other services and ports.
Slowloris has proven highly-effective against many popular sorts of web server software, including Apache 1.x and 2.x.
Over the years, Slowloris has been credited with variety of high-profile server takedowns. Notably, it had been used extensively by Iranian ‘hackivists’ following the 2009 Iranian presidential election to attack Iranian government internet sites .
Slowloris works by opening multiple connections to the targeted web server and keeping them open as long as possible. It does this by continuously sending partial HTTP requests, none of which are ever completed. The attacked servers open more and connections open, expecting each of the attack requests to be completed.
Periodically, the Slowloris sends subsequent HTTP headers for every request, but never actually completes the request. Ultimately, the targeted server’s maximum concurrent connection pool is filled, and extra (legitimate) connection attempts are denied.
By sending partial, as against malformed, packets, Slowloris can easily elapse traditional Intrusion Detection systems.
Named after a kind of slow-moving Asian primate, Slowloris really does win the race by moving slowly and steadily. A Slowloris attack must await sockets to be released by legitimate requests before consuming them one by one.
For a high-volume internet site , this will take a while . the method are often further slowed if legitimate sessions are reinitiated. But within the end, if the attack is unmitigated, Slowloris—like the tortoise—wins the race.
If undetected or unmitigated, Slowloris attacks also can last for long periods of your time . When attacked sockets outing , Slowloris simply reinitiates the connections, continuing to reach the online server until mitigated.
Designed for stealth also as efficacy, Slowloris are often modified to send different host headers within the event that a virtual host is targeted, and logs are stored separately for every virtual host.
More importantly, within the course of an attack, Slowloris are often set to suppress log file creation. this suggests the attack can catch unmonitored servers off-guard, with none red flags appearing in log file entries.
Methods of mitigation
Imperva’s security services are enabled by reverse proxy technology, used for inspection of all incoming requests on their thanks to the clients’ servers.
Imperva’s secured proxy won’t forward any partial connection requests—rendering all Slowloris DDoS attack attempts completely and utterly useless.

2. Session splicing

– Session splicing is an IDS evasion technique that exploits how some IDSs don’t reconstruct sessions before performing pattern matching on the info.

– The thought behind session splicing is to separate data between several packers, ensuring that nno single packet matches any patterns within an IDS signature

– If attackers know what IDS system is in use, they might add delays between packets to bypass reassembly checking.

– Many IDSs reassemble communication streams, so if a packet isn’t received within an inexpensive amount of your time , many IDSs stop reassembling and handling that stream.

– If the appliance under attacks keeps a session active longer than an IDS will spend on reassembling it, the IDS will stop.

– As a result, any session after the IDS stops reassembling the session are going to be vulnerable to malicious data theft by the attacker.

3. Phlashing

Phlashing may be a permanent denial of service (DoS) attack that exploits a vulnerability in network-based firmware updates. Such an attack is currently theoretical but if administered could render the target device inoperable.
Rich Smith, head of HP’s Systems Security Lab, discovered the vulnerability and demonstrated the attack at the EUSecWest security conference in June 2008. during a real-world execution, an attacker could use remote firmware update paths in network hardware, which are often left unprotected, to deliver corrupted firmware and flash this to the device. As a result, the device would become unusable.
The likelihood of phlashing attacks is under some debate. Like other sorts of exploits, DDoS attack has become increasingly profit-driven. Although phlashing would be cheaper to execute and more damaging than a standard DDoS attack, its potential for gain is restricted because once the network hardware has been rendered useless, the victim has no incentive to pay the attacker. The attacker’s only prospect for gain would be to threaten to attack and demand a payoff to refrain from doing so. However, as suggested on the Hack each day blog, an equivalent attack vector might be more effectively wont to flash a tool with malware-embedded firmware.

4. Desynchronization

A typical RFID related threat during which a tag’s key stored within the back-end database and therefore the tag’s memory wouldn’t be an equivalent , due to an attacker blocks the communication between the parties.
The operations that change the media content in spatial domain, temporal domain or transformation domain while still keeping its usability. The operations include frame removing, frame insertion, frame replacement, picture rotation, picture shifting, etc. This technology is usually wont to break a watermarking technology.

Learn CEH & Think like hacker

This Blog Article is posted by

Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092

Contact us – www.info-savvy.com

https://g.co/kgs/ttqPpZ

Leave a Comment