0

There's this saying that using a DDOS-attack, people first attack a server using millions of concurrent requests and by doing that they miraculously gain access to the server.

How does this work? Why does an overload of requests give one root access all of a sudden?

6
  • 3
    Could you add a link or to pointing at this saying? Nov 18, 2015 at 0:59
  • 7
    This isn't a saying. And it doesn't. Nov 18, 2015 at 1:41
  • 2
    It is possible that an attacker could use a DDOS in order to induce a situation that could expose other vulnerabilities which are subsequently exploited to gain root access. For instance, a DDOS may cause a computer to reboot or dump memory, or the ensuing packet loss might allow some out-of-sequence injection, or possibly even overwhelm a firewall/IDS allowing intrusion into the network (if it was poorly set up). However this is purely hypothetical, I am not aware of any specific attacks employing methods similar to those I have described.
    – Hearth
    Nov 18, 2015 at 1:58
  • @NeilSmithline Can you explain the benefit of me sharing a link pointing to this saying? Nov 18, 2015 at 21:17
  • 2
    @Zurechtweiser it would provide the source of you information and perhaps shed light on the specifics of your question as you are mixing terms a bit. Being a "saying" implies it is common or common knowledge, but clearly none hear has heard of this before.
    – Hearth
    Nov 18, 2015 at 21:38

3 Answers 3

9

There's this saying that using a DDOS-attack, people first attack a server using millions of concurrent requests and by doing that they miraculously gain access to the server.

I think with "this saying" you refer to the recent attack at Talk Talk. There were a lot of miscommunication (like talking about "sequential attack" instead of SQL injection) and part of this were claims, that the break-in happened because of a DDoS attack. From The Register:

The telecommunications firm previously confused security experts by stating that the customers' data may have been compromised via a Distributed Denial of Service (DDoS) attack which had targeted the company's website.

This was later rectified and made clear that it might be that a DDoS attack was used to distract from the real attack but it might have been unrelated too. But, false information live on for a long time, sometimes in a form of "this saying" where the original source of the false information is no longer known.

To make it clear: a (D)DoS attack might be used as a distraction for another attack but (D)DoS by itself is not able to give access to data.

2
  • If it's a distraction, how does another attack take place when servers are not responding anymore? Nov 19, 2015 at 18:35
  • 1
    @Zurechtweiser: nobody said the you do the second attack against the same servers. The main point of distraction is to let the staff busy handle one problem and thus they don' have time to notice the other problem. Nov 19, 2015 at 18:42
3

As @MarkHulkalo already explained you mixed a few terms. DDoS (Distributed Denial of Service) and DoS (Denial of Service) - Attacks don't let you gain root-access on any server.

The basic idea behind (D)DoS-ing is to simply flood a service with requests until the server can't handle the requests and thus starts to lag or completely dies. A quite common example (though it's actually pretty old already and isn't in use anymore) for this kind of attack would be the Zip-Bomb which was used to kill antivirus-software by flooding the decompression-service for zip-files with a huge pile of data that couldn't be handled by the service, thus making it unavailable (Denial of Service) and prevented the antivirus-software from inspecting the file. (D)DoS-ing itself only fulfills one sole purpose: slowing a service down to the point where it becomes unusable and thus (possibly) killing processes or services that depend on it.

Gaining root-access on the other hand can be done in several ways. A pretty common approach is to modify the stack utilizing buffer-overflows, stack-buffer-overflows, etc. (this article from Phrack describes ways of interfering with the stack in C). The list of ways to gain unauthorized access to computer-systems, especially servers, is endless.

2

I think you have your terminology and concepts mixed up.

  1. A Denial of Service (DoS) or Distributed Denial of Service (DDoS) attack can lag a computer/server's network considerably, to the point where it stops responding, or responds too slowly.
  2. Exploiting a vulnerability (buffer overflow, stack buffer overflow, heap overflow, et al) could give you access to a server/computer if you do it right.

If you could hack a computer by DDoSing it, the whole internet would be shut down.

Regarding buffer overflows, an overload of unhandled information could give you access to the server/computer in question, if you are able to execute the appropriate code that would do so, and the program in question is vulnerable. Here's a small example snippet of a vulnerable program:

#include <stdio.h>
int main(int argc, char **argv)
{
     char buf[8]; // buffer for eight characters
     gets(buf); // read from stdio (sensitive function!). 
     printf("%s\n", buf); // print out data stored in buf
     return 0; // 0 as return value
 }

More examples.

You would need to find a way to execute code that would give you access. It could be something as simple as downloading and running an executable, or disabling security features, or even enabling a terribly insecure setting that allows you to double backslash onto the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.