Practical UNIX and Internet Security, 3rd Edition

Types of Attacks

Broadly speaking, there are two types of denial of service attacks:

Destructive attacks

Such attacks damage or destroy resources so you can’t use them. Examples range from causing a disk crash that halts your system to deleting critical commands such as cc and ls. Although many of these attacks require shell access to the system, there are also network-based denial of service attacks that are designed to crash servers.

Overload attacks

Such attacks overload some system service or exhaust some resource (either deliberately by an attacker, or accidentally as the result of a user’s mistake), thus preventing others from using that service. This simplest type of overload involves filling up a disk partition so users and system programs can’t create new files. The “bacteria” discussed in Chapter 23 perform this kind of attack. A network-based overload attack could bombard a network server with so many requests that it is unable to service them, or it could flood an organization’s Internet connection so that there would be no bandwidth remaining to send desired information.

Many denial of service incidents are the result of bugs or inadvertent emergent behavior, rather than an intentional malicious attack. For example:

• A programmer may make a typographical error, such as typing x=0 instead of x==0, which causes a program to never terminate. Over time, more and more copies of the program are left running, ultimately causing the denial of service.

• A web server may be correctly ...