2.1.2 Types of DoS Attacks
The following lists some of the more popular DoS attacks:
- Ping of death — Changing the IP portion of the header to indicate the packet has more data than it really does can cause some systems to crash.
- Packet fragmentation attack — This attack takes advantage of a bug that is triggered when a buffer is overrun on certain hosts or internetworking equipment.
- SYN flood attack — Occurs when too many TCP ports are opened up, tying up the computer or network equipment with so many false requests, that services are denied to others.
- CPU hogging — An attack by CPU hogging uses a Trojan horse, or a virus that ties up CPU cycles, memory, or other resources, thereby denying these services to legitimate users and processes.
- Malicious code — These attacks are scripts or code segments (Java, JavaScript, ActiveX, or other programs) which act as Trojan horses or viruses, causing destruction or tying up resources on the computer or network device.
- Chargen attack — This attack connects UDP services in a way that causes a high character output. An example would be the host chargen service being connected to the echo service and congesting the network with the echoed chargen traffic.
- Router misconfiguration — Adjusting the parameters of routers so that packets are improperly or unreliably directed over the network.
- Out-of-band attacks — Attacks that send out-of-band data to port 139 on Windows 95 or Windows NT machines.
- Targa.c attack — A multi-function DoS attack for multiple platforms.
- Teardrop.c attack — An attack in which the IP fragmentation process is implemented in such a way that reassembly problems can cause a target machine to crash.
- Land.c attack — An attack that sends a modified TCP SYN packet with the same IP address as both source and destination, and uses the same port (such as 113 or 139) as both source and destination. This can cause the target system to stop functioning.
- Low-rate – Exploits TCP’s retransmission timeout mechanism to reduce TCP throughput. It eludes detection because it does not employ a high-rate transmission of packets.
- Banana – Redirects outgoing messages back to the client to flood the client with the sent packets thus preventing outside access.
- Fork bomb – Exploits the fork operation by creating a large number of processes very quickly to overwhelm the device’s operating system making the device unusable.