Denial of Service Attack

From Guidance Share

Jump to: navigation, search

Contents

Description

Attackers who cannot gain access often mount a denial of service attack to prevent others from using the application. For other attackers, the denial of service option is their goal from the outset. An example is the SYN flood attack, where the attacker uses a program to send a flood of TCP SYN requests to fill the pending connection queue on the server. This prevents other users from establishing network connections. Another example is deliberately supplying malicious input to exploit weak validation and cause program crashes.


Impact

  • Application or service is unavailable to other uses causing potential loss of business.


Vulnerabilities

  • Lacking or ineffective performance considerations (e.g., indices on data tables, using string instead of StringBuilder to build dynamic strings, etc.)
  • Accepting arbitrary sized requests
  • Building potential wildcard dynamic data queries using untrusted input (LDAP, SQL)
  • Inappropriately utilizing shared resources
  • In case of failure, application does not fail securely/intelligently


Countermeasures

  • Performance should be considered a requirement especially for areas of the application where availability of the service is essential
  • An upper limit on the size of a request should be enforced (e.g., 1 meg HTTP request)
  • Wildcard queries should be avoided - if they are necessary, consider using predefined views to speed up performance
  • Use of shared resources (e.g., shared files) should be considered at design time especially against their required access control (read-only file vs. file which is used for read and write)
  • Implement appropriate exception handling
  • Don't display detailed error messages to users (this is a bad practice that can also lead to discoverability of other potential vulnerabilities in your code)


Attack Patterns


How Tos

Personal tools