How Does a Denial of Service Attack Work?

TL;DR

A denial of service attack disrupts system availability by crashing a target with a crafted message, exhausting its resources through repeated requests, or flooding it from a distributed botnet. Effective defenses combine redundancy, traffic pacing, filtering, system hardening, patching, continuous monitoring, and prepared incident-response playbooks because unlimited capacity is financially impractical.

Transcript

Your systems are up in smoke, or at least it seems like that nothing is working. The CPU is 100% and you don't know why. You can't get anything done. Well, what's happened is you've been DoSed. It's a denial of service attack. In a previous video, I talked about the CIA triad in particular. One of those aspects was this business of availability, a ... Read More

Key Insights

• A denial of service attack is an attack against system availability. Its objective is to prevent normal work or access, which may appear as unresponsive services, overloaded resources, or CPU utilization reaching full capacity without an obvious legitimate cause.
• A targeted denial of service attack is capable of disabling a system with one specially crafted message. The message may violate a protocol rule or exploit a buffer overflow by sending more information than the receiving buffer was designed to handle.
• A SYN flood works by repeatedly initiating TCP sessions without completing the three-way handshake. The attacker supplies false source addresses, causing the server to reserve resources and wait for acknowledgments from systems that did not initiate the requests.
• A distributed denial of service attack is generated from many compromised systems rather than directly from one attacking machine. An attacker activates a botnet of unsuspecting users' devices, which then bombard the chosen target with more traffic than it can handle.
• Infinite capacity is presented as the theoretical defense against any volume of hostile traffic, but it is too expensive to be practical. Redundancy is the next best option because multiple systems prevent one failed machine from becoming a single point of failure.
• Traffic pacing is a defensive control that limits how much traffic a system accepts or sends during a defined interval. Filtering can also block traffic associated with certain locations or IP addresses, although distributed attacks make source-based filtering difficult because requests appear to originate everywhere.
• Egress filtering is a shared defensive responsibility because it examines traffic leaving a network. An internet service provider that detects customers sending SYN messages with source addresses that do not belong to them could block that suspicious traffic close to its origin.
• Prepared incident response is essential after monitoring identifies an availability problem. SIEM and XDR provide monitoring capabilities, while SOAR supports security orchestration, automation, and response. Dynamic playbooks guide rapid action, reducing the harm experienced when organizations encounter denial of service attacks.

Questions & Answers

Q: What is a denial of service attack?

A denial of service attack targets the availability of a system, preventing users from getting work done or accessing expected services. It can disable a target through one specially crafted message, gradually exhaust resources with repeated incomplete requests, or overwhelm capacity with traffic sent from many compromised systems acting together as a botnet.

Q: How can one packet cause a denial of service?

One packet can cause denial of service when it is specially constructed to exploit a weakness in the target. It might violate a rule in the protocol or trigger a buffer overflow by supplying more information than the receiving buffer expects. When the vulnerable system processes that packet, the resulting failure can take it down immediately.

Q: How does a SYN flood attack exhaust server resources?

A SYN flood repeatedly sends TCP SYN messages that begin the three-way session handshake. The attacker provides a false source address, so the server sends its SYN-ACK elsewhere. The server allocates resources, starts a timer, and waits for an acknowledgment that never arrives. Enough incomplete sessions eventually consume the server's available resources.

Q: What is the difference between DoS and DDoS attacks?

A basic denial of service attack can originate from one place, such as a machine sending a crafted packet or repeated requests. A distributed denial of service attack uses many compromised systems. The attacker sends a command to a botnet, and those systems collectively bombard the target, making the attack appear to come from many locations.

Q: Why is redundancy important for DoS protection?

Redundancy prevents one system from becoming a single point of failure. The transcript describes a rule of three, meaning organizations should aim to have at least three of important systems. If one goes down, the organization does not immediately fall to half capacity and can retain a usable service, although the extra systems increase expense.

Q: How do pacing and filtering reduce denial of service risk?

Pacing limits the volume of traffic accepted or sent during a specific interval, reducing the ability of repeated requests to consume resources without restraint. Filtering can block traffic from selected locations or IP addresses and can be activated during an attack. DDoS traffic complicates filtering because malicious requests can appear to come from everywhere.

Q: Why should networks use egress filtering?

Egress filtering examines data leaving a network and can stop harmful traffic near its source. In the SYN flood example, an internet service provider could notice that a customer is sending many SYN messages containing an address that does not belong to that customer. Blocking such traffic helps the intended target and the wider network community.

Q: How should an organization prepare for a denial of service incident?

An organization should combine hardened systems, current software patches, monitoring, and a defined incident-response process. Hardening removes unnecessary services, identities, and capabilities while changing default credentials where possible. SIEM and XDR can help identify unusual load, while SOAR and dynamic playbooks guide quick action after the organization confirms that an attack is underway.

Summary & Key Takeaways

• Denial of service attacks target availability, but they do not all operate in the same way. A specially crafted message can exploit a protocol violation or buffer overflow and crash a system in one strike. This targeted method differs from attacks that gradually consume resources or overwhelm a target with distributed traffic.

• A SYN flood begins sessions with TCP SYN messages while using false source addresses. The server allocates resources, starts timers, and waits for acknowledgments that never arrive. Repeating this process eventually exhausts available resources. Distributed attacks expand the same general pressure by directing many compromised systems to bombard one target simultaneously.

• Defending availability requires several complementary controls. Redundant systems reduce single points of failure, while pacing and filtering constrain traffic. Hardening and patching reduce exploitable capabilities. Monitoring helps distinguish legitimate demand from an attack, and incident-response playbooks allow organizations to recognize problems, activate controls, and respond quickly when service is threatened.