{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/denial-of-service","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/denial-of-service/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/denial-of-service/"},"term":{"en":"Denial of service (DoS/DDoS)","da":"Overbelastningsangreb (DoS/DDoS)"},"aka":{"en":["DoS","DDoS","distributed denial of service"],"da":["DoS-angreb","DDoS-angreb"]},"domain":["security"],"cluster":"fundamentals","layer":"network","status":"current","era":1996,"summary":{"en":"An attack that floods a website or service with so much traffic that real users can no longer reach it.","da":"Et angreb, der oversvømmer en hjemmeside eller tjeneste med så meget trafik, at rigtige brugere ikke længere kan komme til."},"body":{"formal":{"en":"An attack that aims to make a system unavailable by using up its capacity, often by sending huge numbers of requests from many machines at once (a distributed attack, DDoS).","da":"Et angreb, der skal sætte et system ud af drift ved at bruge al dets kapacitet - ofte ved at sende enorme mængder forespørgsler fra mange maskiner på én gang (et distribueret angreb, DDoS)."},"plain":{"en":"Thousands of fake customers crowding a shop's doorway so the real ones cannot get in.","da":"Tusindvis af falske kunder, der fylder hele butiksdøren, så de rigtige ikke kan komme ind."},"inPractice":{"en":"On election day, a municipality's website is hit by traffic from thousands of hacked devices and stays down for hours, until its hosting provider turns on filtering that drops the fake requests.","da":"På valgdagen bliver en kommunes hjemmeside ramt af trafik fra tusindvis af hackede enheder og er nede i flere timer, indtil hostingudbyderen slår en filtrering til, der sorterer de falske forespørgsler fra."},"whyItMatters":{"en":"No data needs to be stolen for the damage to be real - a business that cannot serve its customers loses money and trust.","da":"Der behøver ikke blive stjålet data, før skaden er reel - en virksomhed, der ikke kan betjene sine kunder, mister penge og tillid."}},"deepDive":{"en":"Denial-of-service attacks are usually sorted by the resource they exhaust. Volumetric attacks saturate link bandwidth and are measured in bits per second; protocol or state-exhaustion attacks fill connection tables in servers, firewalls and load balancers and are measured in packets per second; application-layer (layer 7) attacks send valid-looking requests that are expensive to serve, such as uncached search queries or login attempts, and are measured in requests per second. A DDoS spreads the source across many machines, today typically botnets of compromised IoT devices, routers and rented cloud servers, as with Mirai, whose 2016 attack on the DNS provider Dyn disrupted many large sites.\n\nThe classic protocol attack is the TCP SYN flood: the attacker sends SYN segments, usually with spoofed source addresses, and the server keeps a half-open entry for each until it times out, as described in RFC 4987. SYN cookies, devised by Daniel J. Bernstein after the 1996 attack on the ISP Panix, encode the connection state in the server's initial sequence number so no memory is allocated until the handshake completes. Slowloris-type attacks exhaust worker threads by holding HTTP connections open with deliberately slow headers, and the HTTP/2 Rapid Reset technique (CVE-2023-44487) abused stream cancellation to generate record request rates.\n\nReflection and amplification rely on connectionless UDP services that answer a small spoofed request with a much larger response sent to the victim. The amplification factor varies widely by protocol: DNS and NTP (the monlist command) gave large multipliers, and exposed memcached servers produced the extreme factors behind the 2018 attack on GitHub. The root enabler is IP source spoofing, which BCP 38 (RFC 2827) ingress filtering would prevent if networks deployed it universally.\n\nMitigation combines capacity and filtering. Anycast networks and CDNs spread load across many sites; upstream scrubbing centres divert traffic by BGP or DNS and return cleaned traffic; operators can use remotely triggered black-holing (the BLACKHOLE community, RFC 7999) or BGP Flowspec (RFC 8955) to drop attack traffic upstream, at the cost of also dropping legitimate traffic to the blackholed prefix. Layer 7 attacks need rate limiting, caching, challenge pages and WAF rules. A common failure mode is protecting the website but not the DNS servers, VPN gateway or API that the service also depends on.\n\nUnlike ransomware, a DoS attack does not touch data and usually ends when traffic stops, but it directly attacks availability. Under NIS2 Art. 23 an attack that causes severe operational disruption can be a significant incident with a 24-hour early warning, and Danish public websites have repeatedly been targeted by politically motivated hacktivist DDoS campaigns.","da":"Overbelastningsangreb inddeles normalt efter den ressource, de opbruger. Volumetriske angreb mætter båndbredden og måles i bit pr. sekund; protokol- eller state-angreb fylder forbindelsestabellerne i servere, firewalls og load balancere og måles i pakker pr. sekund; angreb på applikationslaget (lag 7) sender gyldigt udseende forespørgsler, der er dyre at besvare, fx søgninger uden cache eller loginforsøg, og måles i forespørgsler pr. sekund. Et DDoS-angreb spreder kilden over mange maskiner, i dag typisk botnet af kompromitterede IoT-enheder, routere og lejede cloudservere, som ved Mirai, hvis angreb i 2016 på DNS-udbyderen Dyn lagde mange store sites ned.\n\nDet klassiske protokolangreb er TCP SYN flood: angriberen sender SYN-segmenter, ofte med forfalskede afsenderadresser, og serveren holder en halvåben post for hver, indtil den udløber, som beskrevet i RFC 4987. SYN cookies, udviklet af Daniel J. Bernstein efter angrebet på internetudbyderen Panix i 1996, koder forbindelsens tilstand ind i serverens initiale sekvensnummer, så der ikke allokeres hukommelse, før håndtrykket er fuldført. Slowloris-lignende angreb opbruger worker-tråde ved at holde HTTP-forbindelser åbne med bevidst langsomme headere, og HTTP/2 Rapid Reset (CVE-2023-44487) misbrugte annullering af streams til at skabe rekordhøje forespørgselsrater.\n\nRefleksion og forstærkning udnytter forbindelsesløse UDP-tjenester, der besvarer en lille forfalsket forespørgsel med et langt større svar, som sendes til offeret. Forstærkningsfaktoren varierer meget: DNS og NTP (monlist-kommandoen) gav store multiplikatorer, og eksponerede memcached-servere gav de ekstreme faktorer bag angrebet på GitHub i 2018. Den grundlæggende forudsætning er forfalskning af IP-afsenderadresser, som ingress-filtrering efter BCP 38 (RFC 2827) ville forhindre, hvis alle netværk indførte det.\n\nAfværgning kombinerer kapacitet og filtrering. Anycast-netværk og CDN'er spreder belastningen over mange lokationer; scrubbing-centre hos udbyderen omdirigerer trafikken via BGP eller DNS og sender renset trafik tilbage; operatører kan bruge remotely triggered black-holing (BLACKHOLE-communityen, RFC 7999) eller BGP Flowspec (RFC 8955) til at droppe angrebstrafik opstrøms, med den pris at også legitim trafik til det sortholdte prefix forsvinder. Lag 7-angreb kræver rate limiting, caching, challenge-sider og WAF-regler. En typisk fejl er at beskytte hjemmesiden, men ikke DNS-serverne, VPN-gatewayen eller det API, som tjenesten også afhænger af.\n\nModsat ransomware rører et DoS-angreb ikke data og stopper som regel, når trafikken stopper, men det rammer tilgængeligheden direkte. Efter NIS2 art. 23 kan et angreb, der giver alvorlige driftsforstyrrelser, være en væsentlig hændelse med krav om en tidlig varsling inden for 24 timer, og danske offentlige hjemmesider har gentagne gange været mål for politisk motiverede DDoS-kampagner fra hacktivister."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/threat","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/ransomware","why":{"en":"Both make systems unusable, but a flood blocks them from outside while ransomware locks the data from inside.","da":"Begge gør systemer ubrugelige, men en oversvømmelse blokerer udefra, mens ransomware låser data indefra."},"confidence":"medium","strength":"minor"},{"type":"exploits","to":"security/vulnerability","why":{"en":"It abuses the fact that every system can only handle so much, and uses up all of it so the system is no longer there when needed.","da":"Det udnytter, at ethvert system kun kan klare en vis mængde, og opbruger det hele, så systemet ikke længere er der, når der er brug for det."},"confidence":"medium","strength":"primary"}],"depth":1,"sources":[{"title":"Cyber Security Fast Track - Ordliste (Tilgængelighed)","tier":"course-material"},{"title":"NIST Glossary - Denial of Service","url":"https://csrc.nist.gov/glossary/term/denial_of_service","tier":"standard","publisher":"NIST"}],"draft":true}