How to stop a service denial attack before it stops you

How to stop a service denial attack before it stops you<@VM>Under the gun: Here's what to do<@VM>Who can you trust? One man is making a list

BY SHAWN P. MCCARTHY | SPECIAL TO GCN

It's not easy to defend a federal Web server against distributed service denial attacks, but it's not impossible either.

For years now, the government has been under the gun in an undeclared cyberwar with hackers around the globe. The simplest and so far the most common attack is denial of service, which keeps a server so busy with fake data traffic that it can't do its real job.

A distributed denial-of-service attack pits multiple computers across the Internet against a single target server. Most serious attacks today orchestrate the use of hundreds of machines and take the target server out of commission for the duration of the attack.

Site managers are busy searching for ways to defend themselves. It will take a more centralized effort to make a real difference, plus a commitment from Internet service providers to truly put a lid on the monster.

The first defensive step is understanding how the game is played.

It used to be possible to tell who was sending too much data traffic by examining the data packets. But hackers have taken up IP spoofing, which conceals the address of the originating machine. The Internet, designed to share data openly, is very trusting. Dump a data packet anywhere on the Net, and it will be delivered without prejudice.

Styles of attack

When a server comes under attack, it's important to recognize the style of attack. Sometimes it's a combination of styles.

Captus Networks Corp. of Woodland, Calif., has identified four types of attacks as most common:


  • Internet Control Message Protocol flooding. An ICMP ping on a server produces an echo response to confirm the server's presence. When enough pings are sent, the target server can do nothing but respond to the requests.


  • Smurf attack. It appears to originate from the target server's own IP address or somewhere on its network. Targeted correctly, it can flood the network with pings and multiple responses.


  • User Datagram Protocol flood. UDP diagnostic services generate characters that are echoed back from the receiving end to the host. This can swamp the network with useless data.


  • TCP SYN flood. Multiple spoofed requests for Transmission Control Protocol connections force the server to keep ports open, waiting for responses.















Incoming! Be alert for four common raid styles







' Internet Control Message Protocol flooding. Numerous pings overtake a server.

' Smurf attack. This attack method makes it possible for the offending request to masquerade as queries from a user's own server.

' User Datagram Protocol flood. UDP diagnostic services create characters that swamp the network with useless data.

' TCP SYN flood. Multiple spoofed TCP connection requests force the server to keep ports open.

DOS Artwork


These four types of attacks involve incoming traffic. At a higher and more serious level, a target server is compromised and used to attack machines elsewhere. It becomes necessary to monitor the server's outgoing traffic, too.

Many agencies have installed two basic defenses:


  • A firewall where the agency LAN connects to an Internet service provider or other network access point. A firewall can keep hackers out, but it's not good at stopping a distributed service denial attack.


    Many firewalls can be configured to act as packet-filtering routers, which means they strip out bad packets and still let legitimate traffic through. But by the time the bad traffic reaches the firewall, it's already clogging the Internet connection.



  • A network-based intrusion detection system. An IDS is generally set to so-called promiscuous mode so it can see all passing data. It can log improper data or trigger an alarm. A host-based IDS is similar, but set to monitor a single service on a host.


    Both types of intrusion detection systems can be configured to look for specific data signatures or anomalies. They don't react directly to the intrusion, but they can trigger separate filtering systems.


    One disadvantage is that they, like PC antivirus software, must constantly be updated with suspect data signatures.




Firewalls and intrusion detection systems are reactive measures. They won't stop an attack, and they can shut only part of it down.

Bad traffic can be shut down at two points:


  • The most effective roadblock is to work with the Internet provider to filter out the flow of bad data, based on analysis of the arriving packets. This is time-consuming but worthwhile because it keeps the network free of unwanted traffic.


  • A quicker but less effective method is to install a traffic-limiting intrusion detection system that looks for unusual or anomalous traffic. It takes advantage of a feature in TCP/IP to confirm whether traffic comes from a nonspoofed source.



A traffic-limiting IDS can also reframe data communications between two points by asking the sender to slow down the rate of data acknowledgment. Legitimate servers will do so.

Those that don't are deemed untrustworthy, so their packets are then filtered out.

This method is mainly effective against what security expert Steve Gibson has dubbed 'script kiddies,' who work within Microsoft Windows and download hacking scripts from the Internet. Such hackers don't know sophisticated methods of concealing their IP addresses.

In theory, a traffic-limiting device installed outside the firewall should strip out and redirect bad traffic without becoming a choke point for good traffic. It could also deny inbound data from specified IP addresses, either for a set time or until an attack stops.

The denial automatically ends when traffic flow returns to normal.

Managers with such systems in place can set thresholds and policies for various triggers, as well as alerts and filters for bad traffic.

Only provider can bar packets

But this approach won't rid the network of unwanted packets. Only the Internet provider can keep them out. Also, it's nearly impossible for the straight traffic-limiting approach to succeed with heavily spoofed packets because each can arrive with a different fake IP address. The best overall bet is a multilevel approach:


  • A filtering and traffic-limiting device at the agency firewall will limit inbound service-denial traffic. If it does egress filtering, it can prevent agency servers from being used in an attack.


  • A similar setup at the highest bandwidth point will do even more. Large government networks have a slight advantage here because they don't have to count on commercial providers to install such devices.


  • Finally, having two or more gateways will make the agency's network redundant and therefore harder to shut down.



Shawn P. McCarthy designs products for a Web search engine provider. E-mail him at smccarthy@lycos-inc.com.
If you suspect a distributed denial-of-service attack is under way, reconfigure your network for real-time capture of packet traffic, then log the traffic. An intrusion detection system can do this.

In a limited data sample, you likely will see either large fragments of improperly formed packets aimed at any server port or large User Datagram Protocol packets aimed at some nonexistent port. You also might see Internet Control Message Protocol debris from large-packet ping commands.

It's likely your local router and firewall can discard this garbage, keeping it out of your main Web servers. But the data flood will still block legitimate traffic by using up bandwidth. Your true bandwidth is the limit of what your routers can handle.

The best place to filter out bad packets is before they leave the router of your main Internet connection. You should have a 24-hour engineering contact there, and keep the phone numbers handy.

Apply filters

A secondary and quicker solution is to install a traffic-limiting intrusion detection system, but it can't be done after an attack has begun.

Show the provider your analysis of the attack pattern, then ask for filters to be applied for specific UDP and ICMP traffic shown in your analysis.

This should reopen your connection while you work with the provider to try to trace the bad traffic further upstream.

The only real way to trace spoofed traffic upstream is to hop from router to router, involving other network administrators. This is a lengthy effort.

Generally speaking, distributed service denial attacks die out over time as other sites shut down their compromised servers. The flow gets shut off before traffic can be traced all the way back to the source.

'Shawn P. McCarthy There's only one sure way of stopping the spread of distributed denial-of-service attacks: Take away hackers' ability to spoof IP addresses.

It then becomes possible to trace and shut down the offenders'and to prosecute them.

'The processing power of the Internet is distributed, and so is the responsibility,' said security expert Steve Gibson of Gibson Research Corp. of Laguna Hills, Calif. 'Everyone needs to take some.'

Stop outgoing packets

He supports widespread configuration of routers for so-called egress filtering. If a packet leaving a network doesn't have a proper originating IP address within that network, then the router drops it before it can reach the Internet.

Often egress filtering requires adding only one line of code to a router configuration.

'If the major Internet service providers took responsibility for traffic egress from their networks, then no one could spoof an IP address from within those networks,' Gibson said. 'Even if a zombie [program] got into one of their customers' machines, it would be limited to the range of addresses in a specific section of a network.'

Of course, it's tough to get the entire Internet to cooperate. But Gibson has set up the Spooferino project to push things in that direction.

Spooferino is a downloadable software tool that sends a spoofed packet from the user back to Gibson's site, at www.grc.com.

From the data returned by Spooferino, Gibson is building a directory of providers that are not blocking spoofed traffic.

Shunning some ISPs

'It will start a discussion about who does and who doesn't filter,' Gibson said. 'ISPs that do not allow spoofed traffic out on the Internet are taking responsibility. Now look at my list of the ones that are not being good neighbors. Why not? It's certainly easy enough to do the filtering.'

He said he hopes for an eventual confrontation. Some parts of the Internet will threaten to close themselves off from the parts that are not trustworthy. That could mean big trouble for heedless providers.

Gibson believes they will fall into line to avoid being boycotted by the rest of the Net.

Big backbone providers could amend their contracts to say they won't renew bandwidth agreements unless the providers take responsibility for the dirt they're now allowing on the Net.

Government agencies can participate in this cleansing effort by requiring egress filtering on their routers.

'Shawn P. McCarthy

inside gcn

  • Pushing cybersecurity for counties

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group