Blog

DDoS/DoS attacks: experience-based insight. Part II

The goal of attacks on server`s memory is to fill the internal memory or a hard disk, or a critical part of memory completely. When the goal is reached the server is unavailable. The classic example of the attack is a TCP SYN flood attack.
18 November 2014
Cybersecurity testing
Web app testing
The article by a1qa
a1qa

The goal of attacks on CPU time is to reach a 100% load of CPU server. One of the options is to process a large amount of information from a database, which takes a lot of effort.

A great example of an attack on CPU time is a SSL Renegatiation DoS attack. To perform it a client repeatedly connects with the server applying SSL protocol, whereas the server needs 15 times more processing power than a client to process the request.

How to protect the server from this attack?

For security testers, the first step is to turn off SSL Renegatiation mechanism. Attacks on CPU time are very dangerous for all kind of services and result in serious damage. A software installed on you server and operating as a filter against potentially dangerous request can be a good security measure.

The goal of attacks on server`s memory is to fill the internal memory or a hard disk, or a critical part of memory completely. When the goal is reached the server is unavailable. The classic example of the attack is a TCP SYN flood attack. It`s main objective is to create multiple half open-connections to limit the access to the server. To reach the goal the attacker sends a number of TCP – segments with mounted SYN flash.

If your set up is correct, the information about new connection will be stored in the server`s response, that sends to the initiator of connection. When the server gets the client`s response it checks the information about the connection in the package. This security technology is called syncookies. It extracts the IP-address and the port from the income package, transforms the data into numbers and adds them to the Sequence Number + 1 field.

TCP FIN flood attack is similar to SYN flood attack but creates a number of half-open connections. In case like this, when the connection is established, a TCP-segment with FIN flag is sent to complete it. The server responds with FIN + ACK flagged segment and waits for the approval. If the approval is not send and the memory is filled. To fix the problem you need a patch from a product owner.

“Slow” attacks on HTTP protocol are performed in a bit different way. Apache web-server is most vulnerable to them.

The attacker acts in the following way: connects to a server and starts accepting and sending the data. He performs multiple connections to reach Denial-of-Service. As a result, server`s memory is filled due to the great number of data streams from the Apache server.

To protect the server you need to define the minimal and maximum time limit for sending the request and accepting the answer. If the client exceeds the limit the connection stops. Use specially created modules to set up the protection.

In the end, I would like to say that automatic systems are really important today. They manage various critical processes. Denial-of-Service attacks can lead to unexpected results, thus the issues of protection against DoS/DDoS attacks are as critical as never before and won`t be minor in future.

More Posts

On the pulse of 2024: optimizing the adoption of eHealth trends with QA
15 February 2024,
by a1qa
4 min read
On the pulse of 2024: optimizing the adoption of eHealth trends with QA
Generative AI, cybersecurity, AR/VR — come and explore how these trends are reshaping the future of healthcare and how QA helps implement them with confidence.
Cybersecurity testing
Functional testing
Performance testing
QA trends
Navigating the future: QA trends that will define 2024. Part 2
30 January 2024,
by a1qa
4 min read
Navigating the future: QA trends that will define 2024. Part 2
We continue exploring QA trends, helping businesses remain competitive in 2024.
Cloud-based testing
Cybersecurity testing
QA trends
Quality assurance
The year in valuable conversations: recapping 2023 a1qa’s roundtables for IT executives 
8 December 2023,
by a1qa
3 min read
The year in valuable conversations: recapping 2023 a1qa’s roundtables for IT executives 
From dissecting novel industry trends to navigating effective ways of enhancing software quality — let’s recall all a1qa’s roundtables. Join us!
Big data testing
Cybersecurity testing
Functional testing
General
Interviews
Performance testing
QA trends
Quality assurance
Test automation
Usability testing
Web app testing
black-friday
22 November 2023,
by a1qa
4 min read
Get ready for Black-Friday-to-Cyber-Monday shopping: 5 testing types to include in your QA strategy
What’s your nightmare during Black Friday and Cyber Monday shopping? If it’s a loss of sales, read about the ways to prevent this in the article.
Cybersecurity testing
Functional testing
Localization testing
Performance testing
Usability testing
6 top reasons why business should invest in software quality
9 November 2023,
by a1qa
4 min read
6 top reasons why business should invest in software quality
We congratulate you on the World Quality Day with the article by Alina Karachun, Account director at a1qa, having 10+ years of QA expertise. Delve into it to explore the reasons why businesses should prioritize software quality.
Cybersecurity testing
Functional testing
General
Interviews
Performance testing
Quality assurance
streaming services
30 October 2023,
by a1qa
3 min read
Enable crash-proof streaming platforms for Holidays season
Ho ho ho! It’s time to prepare your streaming products for the influx of viewers. Read about how to put peak-load anxiety behind by applying rigorous testing of your IT solution.
Cybersecurity testing
Functional testing
Performance testing
Usability testing
On the way to Web 3.0: key software testing aspects for seamless digital experiences. Part 2
12 October 2023,
by a1qa
4 min read
On the way to Web 3.0: key software testing aspects for seamless digital experiences. Part 2
Let’s analyze essential software testing checks to improve the quality of the business-critical Web 3.0 functionality.
Cybersecurity testing
Functional testing
Performance testing
Quality assurance
Test automation
Usability testing
gaming-qa
24 August 2023,
by a1qa
4 min read
Ready, steady, test: How QA drives seamless gaming experiences
Why is QA pivotal for delivering unmatched player experiences? How to level up video game quality? Find the answers in the article.
Cybersecurity testing
Functional testing
Localization testing
Performance testing
Quality assurance
Test automation
Usability testing
12jun202311
22 June 2023,
by a1qa
4 min read
The ins and outs of ensuring OSS/BSS software quality: a hands-on guide
The need for OSS/BSS’ flawless operation is undisputable, but how can we reach that goal? Inter alia, a1qa suggests focusing on delivering high software quality to the end users.
Cybersecurity testing
Functional testing
General
Performance testing

Get in touch

Please fill in the required field.
Email address seems invalid.
Please fill in the required field.
We use cookies on our website to improve its functionality and to enhance your user experience. We also use cookies for analytics. If you continue to browse this website, we will assume you agree that we can place cookies on your device. For more details, please read our Privacy and Cookies Policy.