WEBVTT

1
00:00.000 --> 00:00.060 align:middle line:84%


2
00:00.060 --> 00:02.227 align:middle line:90%
The next attack that we're
going to be talking about

3
00:02.227 --> 00:05.010 align:middle line:90%
is the Denial of Service attack,
or sometimes the Distributed

4
00:05.010 --> 00:06.605 align:middle line:84%
Denial of Service attack.

5
00:06.605 --> 00:07.980 align:middle line:90%
And what this one
really is, this

6
00:07.980 --> 00:09.630 align:middle line:90%
is when everybody is
going to the networking

7
00:09.630 --> 00:11.850 align:middle line:90%
person and their team going,
hey, is the internet down

8
00:11.850 --> 00:14.250 align:middle line:90%
because there's actually a
chance that the internet might

9
00:14.250 --> 00:14.910 align:middle line:84%
be down.

10
00:14.910 --> 00:17.118 align:middle line:90%
Let's jump on a whiteboard
and talk a little bit more

11
00:17.118 --> 00:19.553 align:middle line:90%
about what the DoS
or DDoS really is.

12
00:19.553 --> 00:21.720 align:middle line:90%
Now, it's time to talk about
one of the attacks that

13
00:21.720 --> 00:24.810 align:middle line:90%
makes the headlines the most
because it impacts the widest

14
00:24.810 --> 00:28.205 align:middle line:90%
range of people, and that's
the Denial of Service attack.

15
00:28.205 --> 00:29.580 align:middle line:90%
Now, the Denial
of Service attack

16
00:29.580 --> 00:31.740 align:middle line:90%
comes in different
shapes and sizes.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.580 --> 00:31.740 align:middle line:90%
comes in different
shapes and sizes.

17
00:31.740 --> 00:34.080 align:middle line:90%
Maybe you're a small
business operating

18
00:34.080 --> 00:36.210 align:middle line:90%
in New Orleans,
Louisiana and maybe

19
00:36.210 --> 00:38.130 align:middle line:90%
what you do is
you run a website.

20
00:38.130 --> 00:40.320 align:middle line:90%
Maybe that website
takes sale, and lets

21
00:40.320 --> 00:42.360 align:middle line:90%
say you have a
competitor in New York.

22
00:42.360 --> 00:45.520 align:middle line:90%
What I'm about to describe is a
perfectly valid and real world

23
00:45.520 --> 00:46.020 align:middle line:84%
scenario.

24
00:46.020 --> 00:47.395 align:middle line:90%
Trust me, this
sounds ridiculous,

25
00:47.395 --> 00:50.190 align:middle line:90%
but it's actually a real thing,
and this is your competitor up

26
00:50.190 --> 00:53.550 align:middle line:90%
here in New York, and what they
want for the Christmas holiday

27
00:53.550 --> 00:55.860 align:middle line:90%
is for your website
to be offline.

28
00:55.860 --> 00:57.720 align:middle line:90%
So what this
competitor can do is

29
00:57.720 --> 01:01.520 align:middle line:90%
they can actually go to
something called the darknet.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:57.720 --> 01:01.520 align:middle line:90%
they can actually go to
something called the darknet.

30
01:01.520 --> 01:03.840 align:middle line:90%
The darknet is
basically the internet,

31
01:03.840 --> 01:06.900 align:middle line:90%
where there's no indexing
done on search indexes

32
01:06.900 --> 01:08.040 align:middle line:84%
or anything like that.

33
01:08.040 --> 01:10.770 align:middle line:90%
You have to have specific
software installed in order

34
01:10.770 --> 01:12.660 align:middle line:90%
to access the
darknet, but this is

35
01:12.660 --> 01:15.370 align:middle line:90%
where a lot of illegal
activities take place.

36
01:15.370 --> 01:17.520 align:middle line:90%
So our competitor
goes through the steps

37
01:17.520 --> 01:20.730 align:middle line:90%
to get the darknet set up,
they actually reach out

38
01:20.730 --> 01:24.630 align:middle line:90%
to a hacker who is offering
their services on the darknet.

39
01:24.630 --> 01:27.480 align:middle line:90%
Basically, this is
hacker as a service,

40
01:27.480 --> 01:29.970 align:middle line:90%
and they pay this
hacker to do whatever

41
01:29.970 --> 01:33.930 align:middle line:90%
they can to take down your
website for the holiday season.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:29.970 --> 01:33.930 align:middle line:90%
they can to take down your
website for the holiday season.

42
01:33.930 --> 01:35.970 align:middle line:90%
That hacker can
then launch a bunch

43
01:35.970 --> 01:39.300 align:middle line:90%
of different types of attacks
that is designed to do nothing

44
01:39.300 --> 01:42.900 align:middle line:90%
more than to affect the
availability of your website

45
01:42.900 --> 01:47.610 align:middle line:90%
or deny that service, Denial
of Service, to the world.

46
01:47.610 --> 01:49.410 align:middle line:90%
Now, how do they
actually implement

47
01:49.410 --> 01:50.460 align:middle line:84%
this Denial of Service?

48
01:50.460 --> 01:52.127 align:middle line:90%
Well, there's a bunch
of different ways.

49
01:52.127 --> 01:54.990 align:middle line:90%
Again, it's limited
to your imagination.

50
01:54.990 --> 01:58.530 align:middle line:90%
Maybe they do social engineering
to find a way into your system,

51
01:58.530 --> 02:00.810 align:middle line:90%
and then encrypt it,
or they dupe someone
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.530 --> 02:00.810 align:middle line:90%
and then encrypt it,
or they dupe someone

52
02:00.810 --> 02:02.430 align:middle line:84%
into downloading a virus.

53
02:02.430 --> 02:04.890 align:middle line:90%
But typically, the way a
Denial of Service attack,

54
02:04.890 --> 02:08.789 align:middle line:90%
though, works is they're
designed to overload

55
02:08.789 --> 02:11.050 align:middle line:84%
your server, your web server.

56
02:11.050 --> 02:15.720 align:middle line:90%
So this could be doing something
like sending a flood of TCP SYN

57
02:15.720 --> 02:19.943 align:middle line:84%
requests, or HTTP requests.

58
02:19.943 --> 02:21.360 align:middle line:90%
Another thing that
they used to do

59
02:21.360 --> 02:23.490 align:middle line:90%
is something called
the ping of death.

60
02:23.490 --> 02:27.480 align:middle line:90%
This is less common nowadays
because firewalls and intrusion

61
02:27.480 --> 02:29.220 align:middle line:90%
devices are now
sophisticated enough

62
02:29.220 --> 02:31.140 align:middle line:90%
to detect it and
report it, but the idea
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

62
02:29.220 --> 02:31.140 align:middle line:90%
to detect it and
report it, but the idea

63
02:31.140 --> 02:33.540 align:middle line:90%
was they sent in a
gigantic ping, a ping that

64
02:33.540 --> 02:35.550 align:middle line:90%
was bigger than a
packet would allow,

65
02:35.550 --> 02:37.830 align:middle line:90%
and it would overflow
the server, which

66
02:37.830 --> 02:39.720 align:middle line:84%
is called the buffer overflow.

67
02:39.720 --> 02:42.060 align:middle line:90%
Now, the buffer overflow
has more components to it.

68
02:42.060 --> 02:44.590 align:middle line:90%
We're going to talk about
that in the next skill,

69
02:44.590 --> 02:48.160 align:middle line:90%
but the idea is that we
overwhelmed the CPU and RAM

70
02:48.160 --> 02:50.670 align:middle line:90%
of this server to the
point where it couldn't

71
02:50.670 --> 02:53.040 align:middle line:84%
respond to devices in general.

72
02:53.040 --> 02:56.010 align:middle line:90%
The kicker here, though, is
that what we've just described

73
02:56.010 --> 02:57.630 align:middle line:84%
is a Denial of Service attack.

74
02:57.630 --> 03:01.560 align:middle line:90%
A one or two machines are trying
to attack one server to bring
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

74
02:57.630 --> 03:01.560 align:middle line:90%
A one or two machines are trying
to attack one server to bring

75
03:01.560 --> 03:02.490 align:middle line:84%
down that server.

76
03:02.490 --> 03:05.730 align:middle line:90%
What's actually more common
now is the distributed Denial

77
03:05.730 --> 03:06.750 align:middle line:84%
of Service attack.

78
03:06.750 --> 03:07.540 align:middle line:84%
So here we are.

79
03:07.540 --> 03:09.050 align:middle line:90%
We've got our
hacker who may be--

80
03:09.050 --> 03:11.890 align:middle line:90%
let's pretend they're in
Perth, Australia, for example.

81
03:11.890 --> 03:14.670 align:middle line:90%
What that hacker can
actually do is deploy

82
03:14.670 --> 03:18.750 align:middle line:90%
a virus or worm or trojan
that infects computers

83
03:18.750 --> 03:20.473 align:middle line:84%
all around the world.

84
03:20.473 --> 03:21.390 align:middle line:84%
I'm just putting dots.

85
03:21.390 --> 03:22.973 align:middle line:90%
These are going to
represent computers

86
03:22.973 --> 03:25.770 align:middle line:90%
that are infected all around
the world just like this,

87
03:25.770 --> 03:29.880 align:middle line:90%
and these infected computers
are sometimes called a botnet

88
03:29.880 --> 03:32.310 align:middle line:90%
or sometimes they're
just called zombies.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

88
03:29.880 --> 03:32.310 align:middle line:90%
or sometimes they're
just called zombies.

89
03:32.310 --> 03:34.320 align:middle line:90%
They're interchangeable
used here.

90
03:34.320 --> 03:37.500 align:middle line:90%
And this hacker can now
advertise in the darknet,

91
03:37.500 --> 03:39.900 align:middle line:90%
I have a botnet around
the world that's

92
03:39.900 --> 03:42.310 align:middle line:90%
ready to attack whatever
resource you want.

93
03:42.310 --> 03:45.150 align:middle line:90%
So now, when the hacker
wants to attack our server,

94
03:45.150 --> 03:47.760 align:middle line:90%
all of these computers
around the world

95
03:47.760 --> 03:49.950 align:middle line:90%
in a coordinated
effort are all going

96
03:49.950 --> 03:51.900 align:middle line:90%
to flood and converge
upon my server

97
03:51.900 --> 03:53.100 align:middle line:84%
and totally overwhelm it.

98
03:53.100 --> 03:54.720 align:middle line:90%
What may be more
likely to happen

99
03:54.720 --> 03:57.090 align:middle line:90%
and what certainly
makes more deadlines--

100
03:57.090 --> 03:59.760 align:middle line:84%
maybe like Cloudflare or Google.

101
03:59.760 --> 04:02.640 align:middle line:90%
And all of these
botnets around the world
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

101
03:59.760 --> 04:02.640 align:middle line:90%
And all of these
botnets around the world

102
04:02.640 --> 04:07.090 align:middle line:90%
attack the DNS service at once,
and when global DNS goes down,

103
04:07.090 --> 04:07.590 align:middle line:84%
guess what?

104
04:07.590 --> 04:11.070 align:middle line:90%
The entire internet or at
least a region of the internet

105
04:11.070 --> 04:15.330 align:middle line:90%
goes down and that
has tremendous impacts

106
04:15.330 --> 04:18.360 align:middle line:90%
on the global economy, because
all of a sudden, commerce

107
04:18.360 --> 04:20.940 align:middle line:90%
stops for an extended
period of time

108
04:20.940 --> 04:22.710 align:middle line:90%
while all of the
other services are

109
04:22.710 --> 04:24.370 align:middle line:84%
trying to thwart this attack.

110
04:24.370 --> 04:27.180 align:middle line:90%
So the idea here is
that the attack itself

111
04:27.180 --> 04:29.970 align:middle line:90%
is distributed around
the world, and that's

112
04:29.970 --> 04:33.510 align:middle line:90%
what makes it the distributed
Denial of Service attack.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

112
04:29.970 --> 04:33.510 align:middle line:90%
what makes it the distributed
Denial of Service attack.

113
04:33.510 --> 04:36.452 align:middle line:90%
So that sets up an
availability attack, the DDoS.

114
04:36.452 --> 04:38.160 align:middle line:90%
I hope this has been
informative for you,

115
04:38.160 --> 04:40.820 align:middle line:90%
and I'd like to thank
you for viewing.