Denial-of-service (DoS) attacks attempt to make a computer resource unavailable or insufficiently available to its intended users. Distributed denial-of-service (DDoS) attacks are launched by two or more persons or bots. DoS and DDoS attacks are generally of greater concern for persistent, server-type systems than for desktop applications; nevertheless, denial of service issues can arise for all classes of application
There are several methods of causing a denial of service:
- Vulnerability attacks involve sending a few well-crafted packets that take advantage of an existing vulnerability in the target machine.
- Resource exhaustion attacks that consume computational resource such as bandwidth, memory, disk space, or processor time.
- Algorithmic attacks (such as on hash functions) by injecting values that force worst-case conditions to exist.
- Bandwidth consumption attacks that consume all available network bandwidth of the victim.
Denial of Service Through Resource Exhaustion
Denial of service can occur when resource usage is disproportionately large in comparison to the input data that causes the resource usage. This guideline is of greater concern for persistent, server-type systems than for desktop applications. Checking inputs for excessive resource consumption may be unjustified for client software that expects the user to handle resource-related problems. Even for such client software, however, should check for inputs that could cause persistent denial of service, such as filling up the file system.
| Wiki Markup |
|---|
The _Secure Coding Guidelines for the Java Programming Language_ \[ [SCG 2009|AA. Bibliography#SCG 09]\] lists some examples of possible attacks:
- Requesting a large image size for vector graphics, for instance, SVG and font files.
- "Zip bombs" whereby a short file is very highly compressed, for instance, ZIPs, GIFs and gzip encoded HTTP content.
- "Billion laughs attack" whereby XML entity expansion causes an XML document to grow dramatically during parsing. Set the XMLConstants.FEATURE_SECURE_PROCESSING feature to enforce reasonable limits.
- Using excessive disc space.
- Inserting many keys with the same hash code into a hash table, consequently triggering worst-case performance (O(n 2)) rather than typical-case performance (O(n)).
- Initiating many connections where the server allocates significant resources for each, for instance, the traditional "SYN flood" attack.
Rules for preventing regarding prevention of denial of service attacks resulting from resource exhaustion include:
| Content by Label |
|---|
| showLabels | false |
|---|
| maxResults | 99 |
|---|
| sort | title |
|---|
| showSpace | false |
|---|
| label | +resource-exhaustion,-void |
|---|
|
...
Concurrency-Related Denial of Service
Some denial of service attacks operate by attempting to induce concurrency-related problems such as thread deadlock, thread starvation, and race conditions.
Rules regarding prevention of denial of service attacks resulting from concurrency issues include:
| Content by Label |
|---|
| showLabels | false |
|---|
| maxResults | 99 |
|---|
| sort | title |
|---|
|
...
...
...
| label | +dos-cc,-void |
|---|
| space | @self |
|---|
|
Other Denial of Service attacks
Additional rules regarding prevention of denial of service attacks include:
...
| Content by Label |
|---|
| showLabels | false |
|---|
| maxResults | 99 |
|---|
| sort | title |
|---|
| showSpace | false |
|---|
| label | +dos,-void |
|---|
|
...
Precursors to Denial of Service
A number of additional rules address vulnerabilities that can enable denial of service attacks, but that are insufficient to cause denial of service on their own. These rules include:
| Content by Label |
|---|
| showLabels | false |
|---|
| maxResults | 99 |
|---|
| sort | title |
|---|
|
...
...
...
...
| +dos-enable,-void | | space | @self |
|---|
|
Bibliography
...
