Let's assume that a hacker has already infected an X number of PCs , each one of them is online. How will he actually perform this attack? Just send ping requests or use his very precious tool to do it(Having the risk of it being revealed) ? I do not understand the actual way
-
Have a look at this talk from the 32C3 for some more advanced attacks: media.ccc.de/v/32c3-7523-ddos_mitigation_epic_fail_collection– BeatMay 6, 2017 at 21:06
Add a comment
|
1 Answer
One possible way (UDP-Flood/Reflection/Amplification-Attack):
the attacker might use the zombies to invoke amplification/reflection-attacks like the ones performed some days ago link1 / link2; the attack was (probably) an NTP reflection attack
In other words:
- you have 20.000 bots
- you have a list of 100 vulnerable NTP-servers with an 100 mbit/s - uplink
- you are able to flood any target with (theoretical) 10 GB/s UDP - traffic
- the victim is attacked from the NTP-servers, who received spoofed requests from the bots
the same applies for DNS-amplification-attacks or any other UDP-based floods
picture taken from Secureworks-Blog DNS Amplification Variation Used in Recent DDoS Attacks
answered Jan 12, 2014 at 20:45
-
Nice answer , are the packets 'normal' or with some missing parts? Jan 13, 2014 at 12:28
-
1the packets are normal and legit, just with a spoofed sender-ip Jan 13, 2014 at 13:34