Denial of Service

Executive Summary

A denial of service (DoS) is any condition — intentional or accidental — that prevents legitimate users from accessing a service. DoS does not require an external attacker; misconfigured infrastructure, network design errors, and environmental failures account for a significant portion of availability incidents. This advisory establishes the threat taxonomy, documents attacker motivations relevant to threat modeling, and addresses unintentional DoS vectors that are frequently overlooked in security planning focused exclusively on external threats.

Attack Classifications

Attacker Motivations

• Competitive disruption: Rendering a competitor's service unavailable during a critical business period redirects traffic and revenue. E-commerce and booking platforms are common targets during high-value windows (sales events, peak booking periods).
• Extortion: Attack is initiated or threatened; victim is offered cessation of the attack in exchange for payment. Crypto-extortion groups combine this with ransomware campaigns.
• Hacktivism: Politically or ideologically motivated groups target organizations to demonstrate opposition or cause reputational damage. Availability attack as a protest action.
• Smokescreen: The DoS attack is a deliberate distraction — it triggers incident response and consumes the security team's full attention while a second, more sophisticated attack (credential compromise, data exfiltration, DNS modification) proceeds undetected on another part of the network. The DoS is not the objective; the noise it creates is.

Unintentional (Friendly) DoS Vectors

Availability incidents caused by internal error are common and frequently more disruptive than external attacks because they occur without warning and may take longer to diagnose. Three recurring patterns:

• Layer 2 network loop: A switch port connected to two uplinks without Spanning Tree Protocol (STP) properly configured creates a broadcast storm. A single broadcast frame circulates at wire speed, duplicating itself with each pass. Within seconds, all available bandwidth is consumed. All devices on affected switches lose network connectivity. Resolution: remove the looping cable; verify STP configuration on all switches before connecting redundant uplinks.
• Bandwidth saturation: A large uncontrolled transfer (backup job, software deployment, ISO download) over a constrained link saturates the connection's capacity. All latency-sensitive applications on the same link — VoIP, real-time transactions, video conferencing — degrade or fail. Resolution: implement bandwidth monitoring, QoS policies, and rate-limiting for non-critical transfers.
• Physical infrastructure failure: Corroded water pipes above a server room, failed UPS units, HVAC failure, and similar infrastructure events produce service outages with no malicious actor involved. These are addressed through facilities management, redundancy design, and environmental monitoring rather than security controls.

Executive Summary

A distributed denial of service (DDoS) attack uses a large number of geographically distributed sources — typically a botnet of compromised machines — to flood a target simultaneously. The distributed nature makes source-based blocking impractical. The scale advantage makes volumetric DDoS an asymmetric threat: the attacker's marginal cost to add another participating machine is near zero, while each additional gigabit of attack traffic imposes proportional cost on the victim's mitigation posture. This advisory describes botnet architecture, the Zeus botnet as a historical scale reference, and the controls available to organizations facing volumetric DDoS.

Technical Analysis — Botnet Architecture

A botnet is a collection of compromised systems under unified remote control. Individual machines — referred to as bots or zombies — are infected with malware that establishes a persistent communication channel to attacker-controlled command-and-control (C2) infrastructure. The infected machines belong to legitimate users: home computers, small business servers, university lab machines, and misconfigured IoT devices are common bot classes.

Modern botnet C2 channels use encrypted HTTPS, domain generation algorithms (DGA) to evade blocklists, and peer-to-peer communication architectures to eliminate single points of failure. When the botnet operator issues an attack command, all enrolled bots begin sending traffic to the specified target simultaneously. From the victim's perspective, the attack traffic originates from millions of geographically distributed legitimate IP addresses — one of the primary reasons source-based blocking is ineffective against large botnets.

Scale Reference — Zeus Botnet

The Asymmetric Threat Model

DDoS is described as an asymmetric threat because the ratio of attacker investment to victim impact is radically skewed. The attacker does not own or operate the 3.6 million machines in their botnet — they were compromised months or years earlier at near-zero ongoing cost. Sending an attack command costs the operator effectively nothing. The victim must provision, operate, and pay for mitigation infrastructure at the scale required to absorb or deflect the attack volume. A botnet generating 500 Gbps of attack traffic may require the victim to engage a DDoS mitigation provider with scrubbing capacity exceeding that volume across a global anycast network — a significant recurring expense. The attacker incurs no additional cost.

Recommended Mitigations

• DDoS mitigation services: CDN providers and specialized DDoS mitigation platforms use anycast routing to distribute incoming traffic across a global network of scrubbing centers. Attack traffic is absorbed across hundreds of distributed points of presence; clean traffic is delivered to the origin. For organizations without their own scrubbing infrastructure, a contracted mitigation service is the primary defense against large-scale volumetric attacks.
• Rate limiting and traffic shaping: Edge routers and load balancers configured with rate limits reduce the per-source impact of attack traffic and provide some mitigation against lower-volume floods. Insufficient against large botnets but effective as a first layer.
• Redundancy and geographic distribution: Services distributed across multiple data centers and geographic locations continue operating when one location is under attack. Anycast routing for DNS and edge services prevents single-point concentration of attack traffic.
• Vulnerability patching: For protocol-based DoS attacks (as opposed to volumetric floods), patching the specific software vulnerability eliminates the attack vector entirely.

Executive Summary

Reflection and amplification attacks use the asymmetric response characteristics of UDP-based protocols to convert a small volume of attacker-generated traffic into a massive flood directed at a victim. The attacker spoofs the victim's IP address as the source of protocol queries; legitimate internet infrastructure (DNS resolvers, NTP servers) sends large responses directly to the victim. The attacker is largely invisible; the traffic originates from legitimate servers the victim cannot block without disrupting normal operations. This advisory documents the DNS amplification technique specifically, with reference to NTP and ICMP variants, and identifies both victim-side and amplifier-side mitigations.

Technical Analysis — DNS Amplification Mechanics

DNS uses UDP (User Datagram Protocol) for most queries. UDP has no connection establishment — a sender can set any source IP address in the packet header, and the receiver sends its response to whatever address appears as the source. This property, combined with the size differential between DNS queries and DNS responses, creates the amplification opportunity.

A DNS ANY or DNSKEY query for a large, signed zone (such as a zone with extensive DNSSEC records) may be 15–40 bytes in size. The DNS server's response to the same query may be 1,200–3,500 bytes. The ratio of response size to query size is the amplification factor:

The attack chain: the attacker controls a botnet of machines. Each bot sends a small DNS query to an open DNS resolver (a server that responds to queries from any IP address, without authentication) with the victim's IP address forged as the source. The resolver sends its large response directly to the victim's IP. The attacker sends many small queries; the victim receives the aggregated large responses. The attacker's traffic is distributed across the internet and difficult to attribute; the victim receives an amplified flood from legitimate DNS servers it cannot distinguish from genuine DNS traffic.

Why Blocking Is Difficult for Victims

The traffic reaching the victim originates from legitimate DNS resolvers operated by ISPs, cloud providers, and enterprises worldwide. The victim cannot block "DNS traffic from the internet" because DNS resolution is operationally necessary. Blocking specific source IPs blocks legitimate resolvers that are being abused as amplifiers — not the actual attacker. Upstream filtering at the ISP or DDoS mitigation provider level is required to distinguish amplification traffic from legitimate DNS responses at the volume involved in large attacks.

Recommended Mitigations

• Do not operate open DNS resolvers: DNS resolvers should be configured to accept queries only from the organization's own IP ranges. An open resolver that responds to any source IP is an amplification platform for attackers. Verify recursion is restricted and remediate immediately if open resolution is confirmed.
• Disable NTP MONLIST: The NTP MONLIST command, which returns a list of the last 600 peers that contacted the server, provides extremely high amplification factors. Disable MONLIST on all NTP servers exposed to the internet (ntp.conf: disable monitor).
• BCP38 ingress filtering (ISP-level): Network ingress filtering (RFC 2827 / BCP38) at the ISP level prevents IP address spoofing from originating networks. When properly implemented by network operators, it eliminates the ability of botnet machines to spoof victim IP addresses as query sources. Adoption is partial but growing.
• DDoS mitigation service: For victim-side defense, a scrubbing service with anycast routing can absorb amplification floods before they reach the origin infrastructure. The mitigation service distinguishes amplification response traffic from legitimate DNS answers based on volume, source distribution, and traffic patterns.