A Free Educational Resource Created by Carnegie Mellon University to Empower You to Secure Your Part of Cyberspace

Denial of Service

An attack whereby excessive traffic is sent deliberately to a connection

Denial of service (DoS) attacks interfere with an Internet connection by deliberately sending more traffic to the connection than it can handle. A network is designed to be able to handle only a certain amount of traffic, so when this level is exceeded it won't let any more connections be made, like a telephone sending out a busy signal. This causes problems not only for the computer that's being bombarded with traffic, but also for the computers that are legitimately trying to make a connection with that computer.

A distributed DoS attack (DDoS) involves multiple unsuspecting computers in the attack. The attacker forms an attack network by looking for computers that are highly vulnerable. This may be because they have no anti-virus software, their virus definitions aren't up-to-date, or they do not have the latest operating system or other software patches.

The intruder installs programs that will carry out the DoS attack on these computers, and each added computer then recruits more computers for the attack network. Once the network is built, the intruder attacks the targeted system. Attacks can be performed from different legal jurisdictions, time zones, or IP addresses to reduce the risk of being discovered. Using a different, or "spoofed," IP address from that of the attacker's machine makes it difficult to detect the source of an attack.

Protective Measures

Practices

  • Check for telltale signs of a DoS attack or distributed DoS attack network: The following could be signs that your computer is subject to a DoS attack or has been made part of a distributed DoS attack network:

    • Your computer runs noticeably more slowly than usual
    • Your Internet connection is slower than usual
    • The activity lights on your high-speed (cable or DSL) modem are solid (i.e., on almost all of the time)

  • Report suspicious activity to your Internet Service Provider (ISP): Call your ISP if you believe you are under DoS attack or have been made part of a distributed DoS attack network. Follow the instructions they provide.

Settings

  • Set your anti-virus package for "Real-time Protection": Anti-virus software should provide the option of real-time protection, which means that it actively checks files that come into your system while you work. This lowers your chances of contracting a computer virus. To set real-time protection (using Symantec Norton Antivirus as an example), right-click on the Symantec Norton Antivirus icon in the icon tray in the right-hand bottom corner of the screen, then select "Enable File System Real-time Protection."

  • Set your anti-virus package for the types of files you want it to check: To set the types of files the anti-virus software will check, click on Start, then Programs, and start your anti-virus package. Usually, the program gives you the option of choosing between a few scanning methods. Symantec, for example, offers:

    • Scanning all files: All files on the computer will be checked regardless of the extension or file type.
    • Scanning by file type: The package will check all files of the chosen type, regardless of the potentially deceptive file extension. This is especially important in catching files with a double ending such as ".gif.doc".
    • Scanning by file extension: This scan is the fastest, since only files with the chosen extension will be checked.

    If you have a different brand of antivirus software, consult the manual for instructions on how to configure the settings for real-time scanning and scanning method.

  • Turn off Bluetooth on your phone when you’re not using it: Some mobile phone models can be attacked through their Bluetooth functionality. To make sure this does not happen, turn off Bluetooth when you are not using it. To turn off Bluetooth on a Windows Pocket PC-enabled device:

    1. Click on the Windows icon in the top left corner of the screen and choose Settings.
    2. In Settings, choose Connections and then Bluetooth. This brings up the screen in the figure below.
    3. If you see that Bluetooth is turned on, click on the Turn Off button.
    Turn off Bluetooth

  • Use the passkey option to eliminate unwanted connections: When you use the passkey option, only people who have a password that you give them can connect to your device. This way, you are notified if anybody tries to establish a connection with you. To use passkey, click on the Bluetooth Manager and select Passkey. The screen shown below will appear.

    Passkey
  • Disable discovery by other devices: You can protect your mobile device by preventing other devices from finding you and connecting to you. This way, you can still connect to other devices, but they cannot connect to you first. This protects you from sneak attacks. To disable discovery on a Windows Pocket PC-enabled device:

    1. Click on the Windows icon in the top left corner of the screen and choose Settings.
    2. In Settings, choose Connections and then Bluetooth.
    3. Click on Accessibility to get to the screen shown in the figure below.
    4. Uncheck the “Allow other devices to connect” and “Other devices can discover me” boxes.
    Turn off Bluetooth

Tools

  • Anti-virus software: The popularity of the Microsoft Windows operating system makes it a prime target for hackers and other virus writers, so anti-virus software is crucial for users of this system. Anti-virus software works by identifying files that match definitions of known viruses and keeping them from infecting the system. Make sure that your virus definitions are kept up to date by automatically or manually downloading them from your software manufacturer's Web site. Do not install more than one anti-virus program because incompatibility issues between the programs may end up leaving your system unprotected.

    Two popular anti-virus packages are Symantec’s Norton AntiVirus  and McAfee AntiVirus . AVG , AntiVir  and ClamWin  are free alternatives. The major anti-virus programs, such as Symantec and McAfee, can protect against worms and Trojan horses as well as viruses.

    PDA and mobile phone anti-virus applications normally interact with the full version on a PC and hold fewer virus definitions. New virus updates are automatically transferred from your desktop computer each time you synchronize your PDA. Therefore it is important to keep your desktop computer's anti-virus software updated and synchronize your PDA regularly. Some commonly used anti-virus packages are Trend Micro's PC-cillin for Wireless  and Symantec AntiVirus for Windows Mobile .

  • Firewall: A firewall is like a security guard for your computer that monitors the traffic into and out of your computer. A firewall is your first line of defense against intrusions, especially Trojan horses. One popular firewall is Symantec's Norton Personal Firewall . The Windows operating systems such as Windows XP and Windows Vista  include a firewall that is turned on automatically. This built-in firewall is described in more detail on the Microsoft site .

Connect Safely from Different Places

Office

If you believe you are under DoS attack or have been made part of a distributed DoS attack network, notify your company’s system administrator to let him or her know what is happening.

Mobile

Mobile devices like PDAs and smart phones used to be safe from DoS attacks simply because hackers didn't bother to target them. However, because these devices have become so common and can connect to the Internet in so many different ways (Bluetooth, WiFi, etc.), they are now also targets of DoS attacks.

If you have reason to believe that your mobile device is being subjected to a DoS attack or is being made part of a DDoS attack, switch it off or disconnect from the network. This will stop the flow of DDoS traffic, although it is only a temporary solution.

On the road

You should be especially careful when you use a laptop on a wireless connection, because many wireless networks are not secure, and it may be easy for malicious intruders to install such programs on your system.

Ethical Issues

Downloading or uploading files takes up network resources that you share with others. Be aware of the resources you use, and make sure that your file sharing activities do not use up too much bandwidth.

Legal Issues

If not configured properly, applications such as Kazaa, eDonkey, or LimeWire can involuntarily create a denial of service attack on a server or computer because of the large amount of traffic they produce. Denial of service attacks are illegal, so if such an attack is traced back to you, you could face severe consequences.

Privacy Issues

If your computer is acting strangely and you find that you can no longer access the Internet, someone may be using your computer to launch a DDoS attack. If you think this may be the case, call your Internet Service Provider for assistance.

My home page