talk about karma~
Side-effects of DDOS attackSmall packets The most common side effect is the impact of huge numbers of small packets to be
handled by inline network or security devices. Depending on functionalities implemented on such devices, forwarding a packet from one interface to another may need several operations. A simple router must make a decision according to its routing table. In case of packet filtering operations, layer 4 headers must be checked to validate filters. Stateful inspection adds complexity as it is needed to check session tables. Last application layer devices such as reverse proxy must handle the packet at layer 7. Some other operations such as packet mangling or NAT requires even more processing as the packet has to be rewritten and several checksums recalculated.
The effect of small packets can be easily described with figures. On average, a device specified to handle a specific bandwidth will hardly provide a throughput of more than 10 percent of announced performances when dealing with 64 byte packets. Any attack relying on packets smaller that 100 bytes may first bring router and firewalls down instead of only impacting the target server.
Uplink flooding Another common side-effect is the flooding of links on the path to the target.
Requests and packets sent by the attacker rarely generate enough traffic to fill up the links. However, responses from the target usually add considerably the traffic. A basic example is that of a SYNFlood. A SYN packet of 64 bytes causes the target to generate 3 SYN-ACK (due to retransmission attempts). This kind of effect is even more efficient in the case of application-based attacks. A simple HTTP request is usually around 200 bytes when the data sent back to the client is usually around 10.000 bytes.
In “one-to-one” attacks it is essential that the response from the server doesn’t make its way to the attacker, as this would eventually also flood the attacker’s link. In
such case, it is necessary for spoofing to be possible and easy to perform. UDP based applications are perfectly suitable for generating such effects. This is particularly simple to demonstrate in the case of DNS floods (see logical weaknesses / operation mode). Without any consideration of requests to TLD and SOA (which again, increases the traffic through target Internet link), a request for MX records on an important domain will provide an interesting multiplication factor to the original request volume.
# dig radware.com mx
? ? ?
Request: 71 bytes Answer: 551 bytes Multiplication factor = 73?These side effects are to be considered as a major concern, especially in a shared infrastructure where an attack targeted at a single server may impact dozens of systems relying on the same infrastructure as the original target.
what else If found guilty, the attackers could face a maximum sentence of six years in jail. by Graham Cluley on May 9, 2012
Two teenagers have been arrested in Norway in connection with a series of distributed denial-of-service (DDoS) attacks against websites in the country, and elsewhere around the world.
Norway's National Criminal Investigation Service (NCIS) has refused to go into much detail of which websites were targeted by the attacks, but news reports have suggested that victims are believed to include the Norwegian Lottery, the Norwegian Police Security Service, the Norwegian bank DNB, Germany's Bild Magazine, and the UK's Serious Organised Crime Agency (SOCA).
SOCA was hit by a high profile denial-of-service attack last week, preventing internet users from reaching it.
The motivation for the attacks is presently unclear.
The arrested teenagers, who have not been named, are aged 18 and 19 years, and are said to have launched the attacks over a period lasting "several weeks", flooding websites with unwanted traffic to such an extent that legitimate visitors would find them inaccessible. In simple terms, a DDoS attack is the equivalent of "15 fat men trying to get through a revolving door at the same time" - nothing can move.
If found guilty, the teenagers could face a maximum sentence of six years in jail.
Once again, it seems worth reminding computer users that participating in a denial-of-service attack is against the law, and is not viewed leniently by the authorities.