DDoS case

[kappatastic]

Hello hak5!

My name is Danny and im 20 years old. I come from Denmark and at this point I'm writing my final project.

My subject is "DDoS" - "How can the British authorities tackle DDoS-attacks"

Therefor I have to explain how a DDoS attack actually works.

Also I have to involve technical, legal and ethical issues that may arise in connection with DDoS-attacks.

I hope you can help me with some of these questions. Appreciated.

Regards from Kappa!

[tom564]

Maybe look into how different forms of DoS attacks work such as DNS amplification and how that could be mitigated (one example could be reducing the amount of incorrectly configured DNS servers)

This might be worth a watch: http://www.youtube.com/watch?v=1EAnjZqXK9E

[overwraith]

If you do happen to broaden the topic to Dos and DDoS, I found out while reading a hacking book that when I preformed an ARP cache poisoning attack on a host on the local LAN (my network) that I could deny that particular host service if I did not forward the packets that were being poisoned back to the host. This could also be useful to pen testers if they do happen to get local access to somebody's network. I don't expect it to be used very often however, being that you literally have to be in spitting distance of the target.

[digip]

If you do happen to broaden the topic to Dos and DDoS, I found out while reading a hacking book that when I preformed an ARP cache poisoning attack on a host on the local LAN (my network) that I could deny that particular host service if I did not forward the packets that were being poisoned back to the host. This could also be useful to pen testers if they do happen to get local access to somebody's network. I don't expect it to be used very often however, being that you literally have to be in spitting distance of the target.

The key word here LAN since an arp attack happens at layer 2, unless you have access to the actual routers/route at layer 2 to the target, arp attacks can only happen on the local lan, and can't be done from the internet against say, a website since you're hitting the IP of the site, and don't have access to layer 2, where the MAC address sits. You'd basically need to be on the lan or in control of the routers, and if in control of their router or routers connecting to them, you would probably just shut down routes to them vs an arp attack if you wanted to stop traffic to them. I think this is why we are now seeing more attacks going after the DNS servers so people can't resolve the hosts and route to the actual end points, which is a different kind of DoS attack than the conventional massive amounts of traffic requests to one address while it crumbles under the load. Edited December 13, 2013 by digip