I understand how DoS/DDoS attacks work on servers. If I have not been misled, it is possible to DoS/DDoS a system that does not act as a server, but is still connected to the internet. How is this possible, as normal computers don't take data requests?
-
Most desktops run remote desktop servers leading to things like MS15-030. You can also overwhelm the computers network card or even the network connection. WiFi/ethernet has bandwidth limitations.– Neil SmithlineCommented Sep 30, 2015 at 2:39
-
@NeilSmithline But why should the computer cards/network connections allow data requests?– APCodingCommented Sep 30, 2015 at 2:43
-
1Pull the power cable >:D or unplug the router– ArlixCommented Sep 30, 2015 at 8:20
-
The computer in question still has to process the traffic, even if it's only to say "nothing listening in this port, sorry".– Shadur-don't-feed-the-AICommented Oct 2, 2015 at 10:22
Add a comment
|
2 Answers
You can saturate a computer's incoming network connection by just flooding it with packets. Even if every incoming packet bounces off the firewall or off a closed port (no process listening on that protocol+port on that interface), the bits are still being sent; legitimate traffic will need to compete for time on the wire. Even if you can't actually cause a crash or consume excessive resources on the gateway, NIC, or computer's network driver and related kernel components, you can slow downloads for that machine to a crawl if you blast enough packets at it. No need for the PC to reply (which would be required to complete a TCP handshake); you can send a packet to anybody.
This is a very brute-force approach, though. An equivalent in the real world might be to prevent people from going to a store by hiring a bunch of people to form a long line at the door, each one stepping away and getting back in line as they reach the door. Some legitimate shoppers may also reach the door, but most won't... or at least, it would take too long for most of them to bother waiting that long. Since home connections are usually capable of much faster downloads than uploads, it takes a lot of people working together to saturate the download connection if the attack is coming from people on home Internet.
You may also find that even supposedly client-only computers often listen for some traffic from the Internet. Incoming requests will usually be blocked by network address translation, but machines connected to the Internet directly (or in the gateway's DMZ) would be reachable. The gateway itself may also listen for remote connections. On Windows, check Resource Monitor (resmon.exe), "Network" tab, "Listening Ports" view. You may see quite a few processes listening on external (i.e. non-loopback) interfaces, and also permitted through the firewall.
answered Sep 30, 2015 at 3:13
Interesting point is that (D)DoS attacks simply mean (Distributed) Denial of Service attacks. They refer to the effect, not the cause. What you are doing is stopping a device from functioning in it's intended fashion.
For servers, this is often done by tying up resources to the point where other things either can't run, or the availability is incredibly low. On another device, it could be, as previously stated, by tying up the routes in use by the device, but anything else that can be done to stop your machine from doing what it's supposed to do would also be a (D)DoS.
