A server with the IP address of 10.10.2.4 has been having intermittent connection issues. The logs show
repeated connection attempts from the following IPs:
10.10.3.16
10.10.3.23
212.178.24.26
217.24.94.83
These attempts are overloading the server to the point that it cannot respond to traffic. Which of the following
attacks is occurring?
A.
XSS
B.
DDoS
C.
DoS
D.
Xmas
Explanation:
A Distributed Denial of Service (DDoS) attack is an attack from several different computers targeting a single
computer.
One common method of attack involves saturating the target machine with external communications requests,
so much so that it cannot respond to legitimate traffic, or responds so slowly as to be rendered essentially
unavailable. Such attacks usually lead to a server overload.
A distributed denial-of-service (DDoS) attack occurs when multiple systems flood the bandwidth or resources of
a targeted system, usually one or more web servers. Such an attack is often the result of multiple compromised
systems (for example a botnet) flooding the targeted system with traffic. When a server is overloaded with
connections, new connections can no longer be accepted. The major advantages to an attacker of using a
distributed denial-of-service attack are that multiple machines can generate more attack traffic than one
machine, multiple attack machines are harder to turn off than one attack machine, and that the behavior of
each attack machine can be stealthier, making it harder to track and shut down. These attacker advantages
cause challenges for defense mechanisms. For example, merely purchasing more incoming bandwidth than
the current volume of the attack might not help, because the attacker might be able to simply add more attack
machines. This after all will end up completely crashing a website for periods of time.
Malware can carry DDoS attack mechanisms; one of the better-known examples of this was MyDoom. Its DoS
mechanism was triggered on a specific date and time. This type of DDoS involved hardcoding the target IP
address prior to release of the malware and no further interaction was necessary to launch the attack.