Reference no: EM133240069

Question 1. What is a denial of service attack? A Denial-of-Service (DoS) attack is an attack that shut down a machine or network, making it not accessible to its intended users. Victims of DoS attacks often target web servers of high-profile organizations such as media companies, commerce, banking, or government and trade organizations.

Question 2. How easy is to launch a Dos attack?

Attackers use different methods to attack such as the Ping of death attack where the ping command is usually used to test the availability of a network resource. It works by sending the small number of data packets to the network resource and takes advantage of this and sends data packets above the maximum limit (65,536 bytes) that TCP/IP allows. TCP/IP fragmentation breaks the packets into small chunks that are sent to the server. Since the sent data packages are larger than what the server can handle, the server can freeze, reboot, or crash. Smurf another type of attack usages large amounts of ICMP ping traffic target at an Internet Broadcast Address. When the reply IP address is spoofed, All the replies are sent to the victim instead of the IP used for the pings. Since a single Internet Broadcast Address can support a maximum of 255 hosts, a Smurf attack amplifies a single ping 255 times that make the effect of slowing down the network to a point where it is impossible to use it. In addition, Buffer overflow also uses by attackers where the buffer is a temporary storage location in RAM that is used to hold data, and the CPU can manipulate it before writing it back to the disk. Buffers have a size limit. This type of attack loads the buffer with more data than it can hold. This response causes the buffer to overflow and corrupt the data it holds. An attack is a short form for Synchronize. This type of attack takes advantage of the three-way handshake to set up communication using TCP. SYN attack works by flooding the victim with incomplete SYN messages. This response causes the victim machine to allocate memory resources that are never used and deny access to legitimate users.

Question 3. What is a Distributed Denial of Service attack? A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of a targeted system, usually one or more web servers. A DDoS attack uses more than one unique IP address or machine, often from thousands of hosts infected with malware.

Question 4. Difference between DDoS and Intrusion? Distributed denial of service (DDoS) attacks use intermediary computers, called agents, to launch the attack from multiple locations. A program called a zombie is surreptitiously installed by the hacker on these agent computers, which can be anywhere on the Internet. The hacker activates the zombies to simultaneously attack, leaving the true origin of the attack obscured. Even if your network is not the target of a DoS attack, if you don't take strong security precautions, you could find that your computers are being used as the zombies in a DDoS attack. Intrusion attacks are when an attacker enters your network to read, damage, and/or steal your data. These attacks can divide into two subcategories: pre-intrusion activities and intrusions.

Question 5. Does the fact that DDos attack happened to mean that an intrusion has also definitely happened? No, but in some cases, DDoS attacks happen after an intrusion attack has occurred. DDoS attacks typically require four components: an attacker, master hosts, zombie hosts, and a victim host. Using exploits in a remote system, an attacker installs the attack program that can be remotely controlled by the master host. When the attack begins, it usually falls into one of two classes: bandwidth depletion and resource depletion. Attackers can perform these attacks directly or through reflection. Reflection makes it more difficult to track down the source of the problem and offers a greater challenge to DDoS handling systems by bouncing packets off other hosts. The first line of defense against DDoS attacks is intrusion prevention. Rate-limiting filters are commonly used for preventing DDoS attacks. The reason why intrusion prevention and intrusion detection are unlikely to solve all kinds of DDoS attacks is that it is often difficult to tell the two kinds of traffic apart. Although some DDoS traffic can be easily distinguished from legitimate traffic, this fact is not true in the general case.

Question 6. How common are DDos attacks? A distributed denial of service attack, also known as a DDoS attack, uses multiple systems to flood a server with irrelevant requests the scale of DDoS attacks has continued to rise over recent years, by 2016 exceeding a terabit per second. Some common examples of DDoS attacks are UDP flooding, SYN flooding, and DNS amplification.