2

I was wondering, to make a DOS attack you need to send something to the target you are DOS-ing. And to send something you need to use some protocol. My question is, are all protocols the same speed? And what are the protocols that DOS programms usually use? My guess the UDP because I saw online it was fatser, but I am not sure.

Bonus question: If a target is using a TCP socket to listen to a connection, and I make a connection using UDP, what will happen? Will I be able to connect or not?

  • you probably mean DDOS, not DOS ? – niilzon Apr 7 '17 at 8:48
  • That doesnt really affect the question :V – jeyejow Apr 7 '17 at 8:53
  • 1
    It totally does (no pun intended)... A denial of service can be achieved locally without network communication – niilzon Apr 7 '17 at 9:14
  • what parte of my question does it affect then? <.< – jeyejow Apr 7 '17 at 9:17
  • The overhead of UDP is smaller since it doesn't need to maintain a connection metadata. However, if you are replacing TCP with UDP, chances are that you have a "connection"/"session" metadata in the application layer, which would have increased the UDP overhead as well. – Lie Ryan Apr 8 '17 at 2:07
4

In principle a DDOS attack can send completely legitimate requests and thus overload the server. For example, just use a botnet to visit some persons blog and the server will potentially collapse under the load. There is no real way to protect against this because every request looks like a real request.

However, the often more interesting case is to intentionally violate the protocol on some level to boost the efficiency of an attack. For example opening a lot of TCP connections to a server but never sending anything is very cheap for a client but the server might run out of connections (in whichever sense) because he is waiting for them to time out. These kinds of problems can often be mitigated using appropriate safeguards in code and configuration settings.

So to answer your question: (D)DOS attacks can be carried out with any applicable protocol and often become more powerful by intentionally violating parts of the protocol.

  • Damn i forgot about that you dont need to actually send annything besides connecting to the server! Thanks for the awnser!! – jeyejow Apr 7 '17 at 9:11
  • @Elias "There is no real way to protect against this because every request looks like a real request" - There are several ways to protect against this. One of them is using specialized proxies like Cloudflare for example – niilzon Apr 7 '17 at 9:16
  • @niilzon All you can do is (1) employ heuristics about which requests might be part of the attack and (2) increase your computing power to withstand the attack. Both are an arms race but not a real solution. – Elias Apr 7 '17 at 9:22
2

A answer has been accepted here - and it does make some valid points, but did not mention reflected amplification attacks; with tcp only small amounts of data are exchanged (and must be exchanged between both the attacker and victim) before processing, memory and io resources can be consumed. A slowloris type attack as described by Elias exploits a constrained number of connection resources. However there are a number of differences with udp.

Firstly the request from the client to do something can be in the first packet sent by the client.

A consequence of this is that the attacker can forge the 'from' address on the packet - making it difficult to detect an attck, nevermind block it.

There are some udp protocols where a single small request can generate a much larger response - such behaviour was present in the DNS and NTP protocols. This is exploited in an amplification attack - the attacker sends a request to a vulnerable third party server with the 'from' address of the victim. The third party sends out several packets to the victim. Scaling this up to multiple third parties means that an attacker need only use a little bandwidth to fill up a fat network conection at the victim.

I don't know where you read that udp was "faster". Its performance characteristics are very different from tcp (that is part of the reason that they exist as different protocols) but the speed of an ip connection is not simply a question of the bandwidth on the network hops between client and server. Attempting to send large volumes of udp packets across the internet and you will likely end up DOSing your uplink router.

  • interesting info! appreciated! – jeyejow Apr 17 '17 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.