| 1.2 |  | Vulnerabilities and Threats |
| 1.2.7 |  | Denial of service |

| Denial of service (DoS) implies that an attacker disables or corrupts networks, systems, or services with the intent to deny services to intended users . DoS attacks involve either crashing the system or slowing it down to the point that it is unusable. But DoS can also be as simple as deleting or corrupting information. In most cases, performing the attack simply involves running a hack or script. The attacker does not need prior access to the target because a way to access it is all that is usually required. For these reasons, DoS attacks are the most feared.

DoS attacks take many forms. Ultimately, they prevent authorized people from using a service by using up system resources. The following are some examples of common DoS threats:

- Ping of death - This attack modifies the IP portion of the header, indicating that there is more data in the packet than there actually is, causing the receiving system to crash .
- SYN flood attack - This attack randomly opens up many TCP ports, tying up the network equipment or computer with so many bogus requests that sessions are thereby denied to others. This attack is accomplished with protocol analyzers or other programs .
- Packet fragmentation and reassembly - This attack exploits a buffer–overrun bug in hosts or internetworking equipment.
- E-mail bombs - Programs can send bulk e-mails to individuals, lists, or domains, monopolizing e-mail services.
- CPU hogging - These attacks constitute programs such as Trojan horses or viruses that tie up CPU cycles, memory, or other resources.
- Malicious applets - These attacks are Java, JavaScript, or ActiveX programs that act as Trojan horses or viruses to cause destruction or tie up computer resources.
- Misconfiguring routers - Misconfiguring routers to reroute traffic disables web traffic.
- The chargen attack - This attack establishes a connection between UDP services, producing a high character output. The host chargen service is connected to the echo service on the same or different systems, causing congestion on the network with echoed chargen traffic.
- Out-of-band attacks such as WinNuke - These attacks send out-of-band data to port 139 on Windows 95 or Windows NT machines. The attacker needs the victim’s IP address to launch this attack.
- Denial of Service - DoS can occur accidentally because of misconfigurations or misuse by legitimate users or system administrators.
- Land.c - This program sends a TCP SYN packet that specifies the target host address as both source and destination. The program also uses the same port (such as 113 or 139) on the target host as both source and destination, causing the target system to stop functioning.
- Teardrop.c - In this attack, the fragmentation process of the IP is implemented in such a way that reassembly problems can cause machines to crash.
- Targa.c - This attack is a multi-platform DoS attack that integrates bonk, jolt, land, nestea, netear, syndrop, teardrop, and winnuke all into one exploit.

| Web Links Cisco Secure Encyclopedia http://www.cisco.com/pcgi-bin/ front.x/csec/csecHome.pl Extensive Database of executable Denial of Service files
http://www.attrition.org/security/denial/

Miscellaneous
http://www.cert.org/tech_tips/
denial_of_service.html
http://www.irchelp.org/irchelp/nuke/
http://www.nwfusion.com/research/
dos.html