DOS Attack on Web Servers and its prevention:

DOS Attack on Web Servers:

The main issue and threat persisting with the owners of the dedicated servers and for success companies in the internet is the Dos (Denial of Service) Attack on web servers. Even web giants like Yahoo, Google, MSN and Amazon feel the victims of Dos attacks, Are we safe?

What is Dos (Denial of Service) Attack?

A denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the means to, motives for and targets of a DoS attack may vary, it generally comprises the concerted, malevolent efforts of a person or persons to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely.

Affects of Dos (Denial of Service) Attack:

In a DoS attack, the attacker sends a stream of requests to a service on the server machine in the hope of exhausting all resources like "memory" or consuming all processor capacity.

It involves,

    * Jamming Networks

    * Flooding Service Ports

    * Misconfiguring Routers

    * Flooding Mail Servers

In general terms, DoS attacks are implemented by:

forcing the targeted computer(s) to reset, or consume its resources such that it can no longer provide its intended service; and/or,

obstructing the communication media between the intended users and the victim so that they can no longer communicate adequately.

Types of Dos Attacks:

The are various types of DDos attack listed below.

    * FTP Bounce Attacks

    * Port Scanning Attack

    * Ping Flooding Attack

    * Smurf Attack

    * SYN Flooding Attack

    * IP Fragmentation/Overlapping Fragment Attack

    * IP Sequence Prediction Attack

    * DNS Cache Poisoning

    * SNMP Attack

    * Send Mail Attack

Reason for DDos Attack:

The main cause for the attack are,

1) Running vulnerable softwares/Applications running on a machine or network.

2) Open network setup

3) Network/ machine setup without taking security into account.

4) No monitoring or DataAnalysis are being conducted.

5) No regular Audit / Software upgrades being conducted.

Preventing DDos Attacks:

Prevention is better than cure. The following are few steps to prevent attacks.

Disable ICMP in the server

Disable Extended Server Status in the server

Implement Sysctl protection against DDOS

Installing mod_evasive

Install Mod_security

Firewall Setup

Installing IDs on the gateways

Implementing security measures on server and network

Regular Security Audit

Implement a security team for your servers

Finding and fixing the vulnerable software/applications

24x7 Monitoring the server’s ports and its load

When something is different, ask why