A single source denial of service (DoS) attack tries to take a service offline by having one system overload it with requests or exploit a weakness.
Unlike a distributed DDoS attack, it comes from just one computer or connection.
Types of DoS Attacks
DoS attacks fall roughly into two groups: attacks that exhaust resources through volume, and attacks that exploit flaws in software or protocols.
Flood Attacks
In a flood attack, the attacker sends so many packets or requests that bandwidth, memory or processing time run out.
Well-known examples are SYN floods, ICMP floods and HTTP floods against expensive pages such as search or login.
Logical Attacks
Logical attacks need little traffic.
They use malformed input, slow connections as in Slowloris, or expensive queries that crash or block a service.
How Are DoS Attacks Carried Out?
The attacker first looks for a spot where little effort on their side creates a heavy load on the target.
They then use scripts or tools that hit this spot constantly and quickly, often with forged sender addresses.
Use of Botnets
If one system is not enough, attackers turn to botnets, networks of hijacked computers and devices.
The DoS then becomes a distributed DDoS attack, which is much harder to fend off.
Effects of DoS Attacks
Websites and shops become unreachable, customers abandon purchases and staff cannot work.
On top come costs for defence and clean-up and damage to reputation.
Sometimes a DoS is also a distraction for another attack.
Preventing DoS Attacks
- Rate limiting per address and connection on the web server and firewall
- Timeouts against slow connections and size limits for requests
- Filtering by the provider or a protection service against large floods
- Computational cost for bots on forms and logins, for example with CDPCaptcha
- Monitoring and an incident plan so that countermeasures take effect quickly
Conclusion
A single source DoS attack is easy to launch but can usually be fended off well with rate limiting, filtering and good configuration.
The key is to know the expensive parts of an application and protect them specifically.