CS6262 Exam Lecture Study Guide with Complete Solutions RPKI - Correct Answers • Secure AS for BGP • AS obtain a cert (ROA) from regional authority (RIR) Name two types of amplification attacks and describe them. - Correct Answers DoS Bug: Design flaw allowing one Machine to disrupt a service
DoS Flood: Command botnet to generate flood of requests.
Describe a DoS attack at the link layer (L2) - Correct Answers Simply sends a significant amount of traffic to saturate the link.Describe a DoS attack at the TCP/UDP layer. - Correct Answers Send a significant amount of TCP traffic to consume resources (memory) of the server.Describe a DoS attack at the application layer. - Correct Answers Send many requests for data to exhaust server resources.Compare and contrast UDP and TCP - Correct Answers TCP - UDP Session Based - Connectionless Congestion control - Unreliable In order delivery - Best Effort Well known SYN flood attack - Correct Answers MS Blaster work (2003) • SYN flood on port 80 to windowsupdate.com • 50 syn packets per second at 40 bytes a piece What methods can be used to defend against low rate SYN flood defenses? - Correct Answers •
Syncookies: remove state from server
What is a syncookie? What does it prevent? - Correct Answers A SYN cookie is a specific choice of initial TCP sequence number by TCP software 1 / 2
Prevents low rate SYN flood.
Idea: use secret key and data in packet to generate server SYN
What advantage does a proxy (Prolexic/CloudFare) provide in case of a DoS attack? - Correct Answers The proxy will only forward established connections (three way handshake) to the back end server thus preventing TCP SYN floods.What is a disadvantage (to the attacker) of performing an HTTP DoS attack? - Correct Answers Attacker can no longer use random source IPs Reveals location of bot zombies.Proxy can now block or rate-limit bots.DoS via route hijacking - Correct Answers Intentionally advertising more specific BGP routes to force traffic intended for a service to be destined for a different end point.Pakistan accidentally did this when creating a BGP route that covered youtube's IP address causing all traffic intended for YouTube to route to Pakistan.List and describe common DoS mitigation methods - Correct Answers Client Puzzles
CAPTCHA
Source identification Traceback Edge Sampling What are some limitations to client puzzles for DoS mitigation? - Correct Answers Requires changes to both clients and servers Hurts low power legit clients during attack (cell phones, tablets, etc, cannot connect) What is the main idea behind a CAPTCHA? - Correct Answers Verify that the connection is from a human What layer does a CAPTCHA apply to? - Correct Answers Application Layer DoS
- / 2