CertiGuide to Security+  9  Chapter 1:  General Security Concepts (Domain 1.0; 30%)       9  1.4  Attacks            9  1.4.1  Denial of Service (DoS) / Distributed Denial of Service (DDoS)

SYN Floods 1 1.4.2  Backdoors

DDoS attacks are hard to prevent, and are, unfortunately, a fact of life on public networks. However, there are some simple precautions you can take.

First of all make sure you have a good relationship with your ISP and that you have an emergency contact number to reach a technical person. Time wasted calling around to find the right person to help means time wasted getting your public services back online.

Second, many operating systems & TCP/IP stack implementations provide an option to change the timeout on a TCP conversation. If you are able to reduce the amount of time before the reset of an unfinished TCP connection occurs, you will make it harder for an attacker to continually keep the server’s resources occupied. Some operating systems such as Windows 2000 and routers also include specific SYN Flood attack protection options.

Third, consider whether to configure your boundary routers and firewalls to drop ICMP packets. This is both a blessing and a curse. It does reduce the effectiveness of ICMP floods by preventing any responses from inside your network (note that it cannot by definition prevent ICMP packets from actually arriving at your network boundaries), however, troubleshooting network connectivity problems becomes much more difficult without the help of the good old ping and traceroute (or tracert for Windows users) commands, which use ICMP and won’t get through an ICMP block.

Finally, be a good bedizen. If client machines on your private networks have access to public systems, implement a technique known as “source filtering” on the firewalls and routers at the boundaries of your network. Source filtering prevents spoofed IP packets from leaving your network, as any device they pass through will check the source address against the known local network numbers. If the source IP address does not match an internal subnet, the packet is considered bogus, and discarded. We’ll discuss this more in section 1.4.3, on Spoofing.

SYN Floods 1 1.4.2  Backdoors