A network denial of service attack does not break into anything. It fills the pipe. T1498, Network Denial of Service, degrades or blocks availability of targeted resources by exhausting the network bandwidth they depend on. MITRE files it under impact, for Windows, IaaS, Linux, macOS and containers.
How attackers use it
Example targets include specific websites, email services, DNS and web based applications. MITRE notes that adversaries have conducted these attacks for political purposes and to support other malicious activity, including distraction, hacktivism and extortion.
The attack succeeds when the bandwidth of the target's connection is exhausted by malicious traffic aimed at the resource, or at the connections and devices it relies on. MITRE's illustration is simple: 10 Gbps of traffic sent to a server hosted on a network with a 1 Gbps internet connection. The traffic can come from one system or many spread across the internet, which is a distributed denial of service attack.
Two aspects apply to many methods. The first is IP address spoofing. Adversaries may use the real source address of an attacking system or spoof it, which makes traffic harder to trace and can enable reflection. It also reduces or removes the value of filtering by source address on network defenses. The second is botnets, whether built by the adversary or rented.
The technique has two sub techniques: direct network flood (T1498.001) and reflection amplification (T1498.002). Attacks that target the host's own resources instead of the network are covered by endpoint denial of service (T1499).
MITRE's examples include a 2016 DDoS attack against an anti-doping agency, a malware family that can run TCP, UDP and HTTP DoS attacks, and another that provides several network DoS capabilities across protocols after installation.
How to detect it
MITRE's detection strategy is behavioral and has two analytics.
- An executable or script that generates heavy outbound traffic to remote hosts or toward known amplification ports.
- Flooding tools such as hping3 or nping sending large packet volumes across many ports or IP addresses.
These two analytics look at your own hosts as the source, which matters if your systems have been recruited into a botnet. If you are the target, the detection is more direct: your monitoring will show a sharp rise in inbound traffic, saturated links and degraded services.
MITRE names no log sources or indicators for the parent technique. Useful data includes interface and flow statistics, per service availability checks, edge device logs, and process activity on your own hosts.
The outbound side is easy to forget. A server that suddenly sends large volumes of packets to many destinations may be part of someone else's attack.
How to reduce the risk
MITRE lists one mitigation, filtering network traffic. When flood volume exceeds the capacity of the targeted connection, it is typically necessary to intercept incoming traffic upstream to filter out the attack traffic from legitimate traffic. This can be provided by the hosting internet service provider, or by a third party such as a content delivery network or a provider that specializes in DoS mitigation.
That tells you what to prepare. Filtering at your own firewall cannot help if the link itself is full.
- Decide before an attack who your upstream provider is and how to reach them in an emergency.
- Put public services behind a content delivery network or DoS mitigation service where it fits.
- Keep DNS on a resilient provider, since DNS is a common target.
- Rehearse the runbook: who declares the incident, who calls the provider, and how users are told.
- Make sure your own hosts cannot send spoofed traffic or run flooding tools.
Check your own environment
- Write down the bandwidth of each internet connection and compare it with your peak traffic.
- Confirm that public services have an upstream mitigation arrangement.
- Check egress rules on servers and containers so they can reach only what they need.
- Confirm you have an alert on outbound traffic volume per host.
- Find the contact path for your ISP or mitigation provider and test it.
Quick check
Why does source address filtering often fail against these attacks?
Adversaries may spoof the source IP, and large botnets spread traffic across many real addresses.
Where does MITRE say mitigation usually has to happen?
Upstream, by the ISP, a CDN or a DoS mitigation provider, when flood volume exceeds the capacity of the targeted connection.
What is the difference from endpoint denial of service?
Network DoS exhausts bandwidth. Endpoint DoS targets the host's own resources or causes crashes.
