|
'''Serangan penafian-perkhidmatan''' (''denial-of-service attack'', ''DoS attack'') ialah satu serangan terhadap [[sistem komputer]] atau [[rangkaian komputer]] yang menyebabkan ianya hilang keupayaan untuk memberikan perkhidmatan kepada pengguna, kebiasaannya kehilangan sambungan rangkaian dan perkidmatan dengan menggunakan ''bandwith''lebar jalur rangkaian mangsa atau membebani sistem komputer mangsa.
<!--
==Cara Serangan==
Not all service outages, even those that result from malicious activity, are necessarily denial-of-service attacks. Other types of attack may include a denial of service as a component, but the denial of service may be part of a larger attack.-->
==Cara serangan==
Serangan DoS boleh dilakukan dalam beberapa cara. Terdapat tiga jenis serangan asas:
# Membebani sumber komputasi seperti ''bandwith''lebar jalur, ruang diskcakera, atau Unitunit Pemprosespemproses Pusatpusat ([[CPU]])
# Pengganguan maklumat konfigurasi seperti maklumat ''[[routing]]''
# Pengganguan fizikal komponen rangkaian.
{{terjemahan}}
A [[Nuke (computer)|nuke]] attack sends a [[packet]], usually [[ICMP]], which is malformed or [[Fragmentation|fragmented]] in an invalid way, triggering a [[Computer bug|bug]] in the [[operating system]] and [[Crash (computing)|crashing]] the targeted computer. This is known as the [[ping of death]].
[[WinNuke]] is a similar kind of attack, exploiting the vulnerability in the [[NetBIOS]] handler in [[Windows 95]]. A string of out-of-band data is sent to [[Transmission Control Protocol|TCP]] port 139 of the victim machine, causing it to lock up and display a [[Blue Screen of Death]]. This attack was very popular between the [[Internet Relay Chat|IRC]]-dwelling [[script kiddie]]s, due to easy availability of a user-friendly click-and-crash WinNuke program.
Various DoS-causing [[Exploit (computer security)|exploits]] can cause server-running software to get confused and fill the disk space or consume all available memory or CPU time.
Other kinds of DoS rely primarily on brute force, flooding the target with an overwhelming flux of packets, oversaturating its connection bandwidth or depleting the target's system resources. Bandwidth-saturating floods rely on the attacker having higher bandwidth available than the victim; a common way of achieving this today is via '''Distributed Denial of Service''', employing a [[botnet]]. Other floods may use specific packet types or connection requests to saturate finite resources by, for example, occupying the maximum number of open connections or filling the victim's disk space with logs.
An attacker with access to a victim computer can bring it to a crawl or even to a crash by using a [[fork bomb]].
On [[Internet Relay Chat|IRC]], [[IRC floods]] are a common electronic warfare weapon.
[[Ping flood]] is based on sending the victim an overwhelming number of [[ping]] packets, usually using the "ping -f" command. It is very simple to launch, and a [[T1]] owner can easily defeat a [[dial-up]] user.
[[SYN flood]] sends a flood of [[SYN (TCP)|TCP/SYN]] packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a [[half-open connection]], by sending back a TCP/SYN-ACK packet, and waiting for an [[ACK|TCP/ACK]] packet in response from the sender address. However, because the sender address is forged, the response never comes. These half-open connections saturate the number of available connections the server is able to make, keeping it from responding to legitimate requests until after the attack ends.
A [[smurf attack]] is one particular variant of a flooding DoS attack on the public [[Internet]]. It relies on mis-configured network devices that allow packets to be sent to all computer hosts on a particular network via the [[broadcast address]] of the network, rather than a specific machine. The network then serves as a [[smurf amplifier]]. In such an attack, the perpetrators will send large numbers of [[Internet Protocol|IP]] packets with a faked source address, that is set to the address of the intended victim. To combat Denial of Service attacks on the Internet, services like the [[Smurf Amplifier Registry]] have given [[network service provider]]s the ability to identify misconfigured networks and to take appropriate action such as [[filtering]].
A "banana attack" is another particular type of DoS. It involves redirecting outgoing messages from the client back onto the client, preventing outside access, as well as flooding the client with the sent packets.
Attempts to "flood" a network with bogus [[packet]]s, thereby preventing legitimate network traffic, are the most common form of attack, often conducted by disrupting network connectivity with the use of multiple hosts in a '''distributed denial-of-service attack''' or '''DDoS'''. Specific means of attack include: a [[smurf attack]], in which excessive [[ICMP]] requests are broadcast to an entire network; bogus [[HTTP]] requests on the [[World Wide Web]]; incorrectly formed packets; and random traffic. The source addresses of this traffic is usually [[Internet protocol spoofing|spoofed]] in order to hide the true origin of the attack. Due to this and the many vectors of attack, there are no comprehensive rules that can be implemented on network hosts in order to protect against denial-of-service attacks, and it is a difficult feat to determine the source of the attack and the identity of the attacker. This is especially true with distributed attacks.
Attacks can be directed at any network device, including attacks on [[routing]] devices and [[World Wide Web|Web]], [[electronic mail]], or [[Domain Name System]] [[Server (computing)|server]]s.
=== Effects of DoS ===
Denial of Service attacks can also lead to problems in the network 'branches' around the actual computer being attacked. For example, the bandwidth of a router between the Internet and a [[Local Area Network|LAN]] may be consumed by a DoS, meaning not only will the intended computer be compromised, but the entire network will also be disrupted.
If the DoS is conducted on a sufficiently large scale, entire geographical swathes of Internet connectivity can also be compromised by incorrectly configured or flimsy network infrastructure equipment without the attacker's knowledge or intent. For this reason, most, if not all [[Internet Service Provider|ISP]]s ban the practice. poopity-doopity-doop
== Distributed DoS attacks ==
In a distributed attack, the attacking computer hosts are often [[zombie computer]]s with [[broadband]] connections to the [[Internet]] that have been compromised by [[computer virus|viruses]] or [[Trojan horse (computing)|Trojan horse]] programs that allow the perpetrator to remotely control the machine and direct the attack, often through a ''[[botnet]]/[[dosnet]]''. With enough such slave hosts, the services of even the largest and most well-connected websites can be denied.
=== Distributed reflected denial of service ===
A distributed reflected denial of service attack involves sending forged requests of some type
to a very large number of computers that will reply to the requests. Using
[[Internet protocol spoofing]], the source address is set
to that of the targeted victim, which means all the replies will go to (and flood) the target.
ICMP Echo Request attacks (described above) can be considered one form of
reflected attack, as the flooding host(s) send Echo Requests to the broadcast addresses of
mis-configured networks, thereby enticing a large number of hosts to send Echo Reply packets
to the victim. Some early DDoS programs implemented a distributed form of this attack.
The first major attack involving DNS servers as reflectors occured in January, 2001. The attack
was directed at the site Register.com, and was publicly discussed in [http://staff.washington.edu/dittrich/misc/ddos/register.com-unisog.txt a thread on the UNISOG mailing list]. This attack, which forged requests for the MX records of AOL.com (to amplify the attack) lasted about a week before it could be traced back to all attacking hosts and shut off. It used a list of tens of thousands of DNS servers that was at least a year old (at the time of the attack.)
Vern Paxson published [http://www.icir.org/vern/papers/reflectors.CCR.01/reflectors.html An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks] in June, 2001, describing the general problem of reflectors. He points out that many services can be exploited to act as reflectors, some
harder to block than others.
In July 2002, the [http://www.honeynet.org/reverse Honeynet Project Reverse Challenge] was issued.
The binary that was analyzed turned out to be yet another DDoS agent, which implemented
several DNS related attacks, including an optimized form of a reflection attack.
The book "''[http://vig.prenhall.com/catalog/academic/product/0,1144,0131475738,00.html Internet Denial of Service: Attack and Defense Mechanisms]''" published in 2005, describes distributed reflected
attacks on pages 19-20, 45, 51-52, and 297.
Randal Vaughn and Gadi Evron released [http://www.isotf.org/news/DNS-Amplification-Attacks.pdf an analysis of DNS Amplification Attacks] (which use distributed reflection and amplification) on March 17, 2006, the same day that [http://www.theinquirer.net/?article=30361 other news reports citing VeriSign as a source] were published. These attacks involved a new mechanism that increased the amplification affect, and used a much larger list of DNS servers, than during the 2001/2002 time
frame.
:''[Distributed reflector denial of service] attacks earlier this year used only about 6 percent of the more than 1 million name servers across the Internet to flood victim networks. Still, the attacks in some cases exceeded 8 gigabits per second, indicating a remarkably powerful electronic assault.'' [http://apnews.myway.com/article/20060316/D8GCJR7O0.html]
=== Unintentional/non-malicious DoS attacks ===
This describes a situation where a website ends up denied, not due to a deliberate attack by a single individual or group of individuals, but simply due to a sudden enormous spike in popularity. This can happen when an extremely popular website posts a prominent link to a second, less well-prepared site, for example, as part of a news story. The result is that a significant proportion of the primary site's regular users - potentially hundreds of thousands of people - click that link in the space of a few hours, having the same effect on the target website as a DDoS attack.
News sites and link sites - sites whose primary function is to provide links to interesting content elsewhere on the Internet - are most likely to cause this phenomenon. The canonical example is the [[Slashdot effect]], though sites such as [[Digg]] and [[Fark]] have their own corresponding "effects".
Routers have also been known to create unintentional DoS attacks, as both [[D-Link]] and [[Netgear]] routers have created [[NTP vandalism]] by flooding NTP servers without respecting the restrictions of client types or geographical limitations.
=== Well-known DDoS tools ===
* [[Stacheldraht]]
* [[Tribe Flood Network|TFN]]
* [[Trinoo]]
== Surviving distributed attacks ==
There are steps that can be taken to mitigate the effects of a DDoS attack. As mentioned in the previous section, the first thing to start is the investigative process. One determines which core [[router]] (a router that handles Internet backbone traffic) is passing the packets to one's border router (a router that connects his or her [[computer network|network]] to the [[Internet]]). One would contact the owners of the core router, likely a telecom company or the [[internet service provider]], and inform them of his or her problem. Ideally, there will be a process in place which can expedite one's requests for help. They, in turn, need to determine where the malicious traffic reaches their network and contact the source. By that point, it is out of one's hands.
Since it is not likely that the administrator will be able to quickly stop the DDoS flood, there are a few steps which might help mitigate the attack temporarily. If the target is a single machine, a simple [[IP address]] change can end the flood. The new address can be updated on internal [[DNS server]]s and given to a few crucial external users. This is especially useful for key servers (e.g. [[email]] or [[database]]) under attack on one's network.
There is a chance that some [[filtering]] techniques can help. If the attack is unsophisticated, there might be a specific signature to the traffic. A careful examination of captured packets sometimes reveals a trait on which you can base either router [[Access Control List|ACLs]] (access control lists) or [[Firewall (networking)|firewall]] rules. Additionally, a large amount of traffic may originate from a specific provider or core router. If that is the case, one might consider temporarily blocking all traffic from that source, which should allow a portion of legitimate activity through. One would also be blocking "real" packets, or legitimate traffic, but this may be an unavoidable sacrifice. However, depending on the method of attack, this option may be unavailable to you if, for example, the participants' [[IP address]]es are [[spoofing attack|spoof]]ed.
An alternative option, one which might be available to larger companies and networks, is to throw more [[hardware]] or [[bandwidth]] at the flood and wait it out. Again, it is not the best solution, nor the least expensive one. It may provide a temporary fix, nevertheless. A final method would be to simply disconnect the server from the network by physically pulling out the cable connecting the computer to the [[Internet]] (or disabling the hardware enabling this), which gives the SysAdmin a lot more time to work on the problem, but no service is then available for legitimate users. This method does not function on remotely-hosted servers such as [[virtual private server]]s which are then impossible to access for their administrators, so the problem is more difficult to fix.
The investigative process should begin immediately after the DoS attack begins. There will be multiple phone calls, call backs, emails, pages and faxes between the victim organization, one's provider and others involved. It is a time consuming process, so the process should begin immediately. It has taken some very large networks with plenty of resources several hours to halt a DDoS.
The easiest way to survive an attack is to have planned for the attack. Having a separate emergency block of IP addresses for critical servers with a separate route can be invaluable. A separate route (perhaps a DSL) is not that extravagant, and it can be used for load balancing or sharing under normal circumstances and switched to emergency mode in the event of an attack. Filtering is generally pretty ineffective, as the route to your filter will normally be swamped so only a trickle of traffic will survive.
== External links ==
* [http://staff.washington.edu/dittrich/misc/ddos/ Dave Dittrich's DDoS page]
* [http://chinese-school.netfirms.com/computer-article-denial-of-service.html Distributed Denial of Service Attacks] - general information of Distributed Denial of Service Attacks (DDoS)
* [http://www.surasoft.com/articles/ddosa.php SuraSoft DDoS] - DDoS Case study, concepts & protection
* [http://www.DoS-Attacks.com DoS/DDoS Attacks] - Everything you ever wanted to know about DoS/DDoS Attacks
* [http://www.tik.ee.ethz.ch/~ddosvax/ DDoSVax Research Project] - at [http://www.ethz.ch/ Swiss Federal Institute of Technology] in [[Zürich]]
* [http://www.honeypots.net/incidents/ddos-mitigation DDoS Mitigation Techniques] - research papers and presentations
* [http://www.denialinfo.com/ www.denialinfo.com] - Denial of Service (DoS) Attack Resources
* [http://newssocket.com/foonet/ www.newssocket.com] - Distributed Denial of Service (dDoS) for hire
* [http://www.grc.com/dos/drdos.htm Dos attacks explained by grc.com]
* [http://www.isotf.org/news/DNS-Amplification-Attacks.pdf DNS reflector / amplification DDoS attacks]
* [http://www.linuxsecurity.com/content/view/121960/49/ Preventing DDOS - By Blessen Cherian,Security Consultant ]
[[Kategori:Keselamatan rangkaian komputer]]
[[Category:Denial-of-service attacks| ]]
[[ar:هجمات الحرمان من الخدمات]]
[[ca:Denegació de servei]]
[[da:DDoS]]
[[de:Denial of Service]]
[[et:Denial of Service]]
[[en:Denial-of-service attack]]
[[es:Ataque de denegación del servicio]]
[[es:Ataque de denegación de servicio]]
[[fr:Déni de service]]
[[itid:DoSSerangan DOS]]
[[it:Denial of service]]
[[he:התקפת מניעת שירות]]
[[hu:DDoS]]
[[no:Tjenestenektangrep]]
[[pl:DoS]]
[[pt:Ataque de negação de serviço]]
[[pt:DDoS]]
[[ru:DoS-атака]]
[[sl:Napad za zavrnitev storitve]]
| 