A Lesson in Computer Security – Denial of Service Attack

(My research focuses on computer security. There is almost no writing on this topic in Bangla, except for some incorrect pieces by so-called “experts.” That’s why I’ve decided to write occasionally in this series. These posts will also be added to Bangla Wikipedia. Many of the technical terms are my own creations, so they might seem unusual. And since I am more of a technical person, the language and style may lack finesse, so please read with understanding.)

Denial of Service Attack or Service Disruption Attack is a technique aimed at preventing the legitimate users of a computer system’s resources or services from accessing them. By launching such attacks on a computer system or an internet website, the normal operation of the system or site is slowed down, or in many cases, brought to a complete halt.

A popular method of conducting this attack is to send a huge number of messages to the target system or site from outside. While the system is busy analyzing one message, more messages keep arriving, causing the system to become preoccupied with analyzing the attacker’s messages. As a result, genuine users experience significant delays.

There are two main methods of Denial of Service attacks:

* Resetting the targeted computer, or exhausting its limited resources to make them unavailable to others

* Cutting off the communication channel between the system or site under attack and its genuine users

Example

Suppose Karim owns a website called Kakhag dot com. The hosting plan for the site includes 1 GB of daily bandwidth. The site receives around 10,000 hits per day and usually does not require more than 400 MB of bandwidth. Now, an attacker named Shawkat writes a script to generate a huge number of fake hits on the site, and within less than an hour, 25,000 hits exceed the 1 GB bandwidth limit. As a result, no users can access the site anymore.

Now let’s say Karim arranges for unlimited bandwidth and bans the IP address of Shawkat’s computer. Shawkat then switches tactics… Instead of attacking directly, he launches a “Smurf attack”. In this attack, Shawkat does not attack Karim’s computer directly, but instead sends ping messages to thousands of sites across the internet. (Pings are used to test if a connection is okay. When a ping message is sent to a computer, it replies with another message.) However, before sending the pings, Shawkat forges the sender’s address in the message, replacing his own computer’s IP with Karim’s site’s IP. As a result, when these thousands of sites reply to the ping messages, all the replies get sent to Karim’s computer. Receiving thousands of messages at once, Karim’s computer doesn’t have time to communicate with real users. As a result, visitors trying to access the website will fail.

(For more details, see the English Wikipedia article.)