Threat 2: SYN flood
In this case, a normal Internet connection is apparently initiated, yet no more than the initial sequence is sent. The server, however, in keeping with the protocol, continues to wait for additional packets. This leads to an overload and, finally, to a server crash, because its systems are only able to handle a limited number of such requests at the same time. This threat affects:
- Server performance
- Router and firewall performance
Threat 3: application load & flaws
By targeting requests, just four normal PCs were able to overload a well-known Internet banking application. This occurred even though there was enough bandwidth available and the requests were distributed over (supposedly) enough systems. Potential victims are first analyzed, then attackers send normal requests to the victim's servers. The requests are so well targeted that they are enough to cause server failure.
In addition, a large number of applications contain weaknesses and potential sources of error that are not evident in normal operation. Yet experienced hackers are able to identify these weak spots . and take advantage of them very quickly. Firewalls offer no real protection here, since the aim is not to intrude but merely to make the victim's services unavailable.
In the normal case, all of these threats are carried out at the same time and take up bandwidths of over 1 Gbit/s!
Countermeasure #1: defense!
There is usually no point in trying to hunt down the party attacking you. It makes more sense to act quickly in defense.
|
