7

I'm currently researching DDoS attacks for an article I'm writing and apart from the obvious lack of availability of the target host and their services, is there anything else a DDoS can help accomplish?

I'm thinking things along the lines of a DDoS being the first step for a larger intrusion or compromise. Does it make it easier or assist an attacker in compromising the target. If so, how? Can you provide any attack vectors I can do further research on that depend on a DDoS or a simple explanation would be great.

Sajjad Pourali
  • 944
  • 1
  • 10
  • 22
Scott Helme
  • 3,228
  • 3
  • 23
  • 33

2 Answers2

8

There are a few ways a DDoS can help in perpetrating extra villainies:

  • If the DDoS target is a security service (e.g. an intrusion detection system), then deactivating the service can allow easier break-ins. For instance, if a hole is found in an operating system, which allows for remote code execution, then a DDoS on the OS vendor's update site will delay propagation of the fix, thus allowing for a longer exploitation window.

  • The DDoS itself is likely to generate tons of logs which will make detection of malicious non-DDoS actions harder: log entries which would normally trigger alarms fly under the radar, because the IDS and the people who look after it are overwhelmed by the DDoS-related flow.

  • Since a DDoS threatens the continuity of business activities, some organization may apply emergency procedures which aim at maintaining the service at the possible expense of security. For instance, if a DDoS implies an overload of an email-antivirus, then the organization may decide to switch off the antivirus, so that emails flow again; but then, virus may enter more easily. Another case is an organization who switches to an alternate site which might not be as well protected.

See this previous question on the same subject.

Community
  • 1
Tom Leek
  • 172,594
  • 29
  • 349
  • 481
  • Thanks for the answer, I hand't come across that previous question. – Scott Helme Sep 18 '13 at 17:35
  • Sooo.. it's a dupe? – Adi Sep 18 '13 at 17:40
  • @Anan Similar. Your question isn't specifically aimed at the same purpose of the other question. Yours is about other purposes in general other than denying service. the one that they have you marked as a dupe of it about specifically wants to know about the gaining access phase. I dont think it's a dupe, but from watching how stack exchange does their questions, it's a "Dupe" by their standards. Personally I think tom's approach of here are general reasons and a related question instead of a duplicate question. Just one word, but a lot of difference – PsychoData Sep 18 '13 at 20:11
7

One tactic that has been successfully used is to distract the victim with a DDoS in order to deter or delay their response to another compromise - as Register calls it, a cyberheist smokescreen. The idea being that fraudulent wire transfers may be reversible if caught quickly enough, and if a DDoS is going on the security people will be less available to catch and deal with fraud.

Also, DDoS is used as part of extortion schemes.

gowenfawr
  • 72,893
  • 17
  • 165
  • 200
  • Thanks for the response. I've actually covered distraction and extortion using http://www.itp.net/594617-hackers-use-ddos-to-mask-bank-thefts and http://www.infosecurity-magazine.com/view/33946/two-men-arrested-in-london-over-ddos-extortion-threats/ The smokescreen doesn't necessarily require the DDoS, it's just something to distract people. For the extortion it's just the threat of unavailability that is the problem. I'm wondering if a DDoS makes a system vulnerable in any way or allows an attacker to carry out another attack as a direct result. – Scott Helme Sep 18 '13 at 16:55
  • @ScottHelme If you havent checked out the link in tom's comment. It provides some answers specifically about that topic of "gaining access" – PsychoData Sep 18 '13 at 20:16
  • Since it showed up in my SANS Newsbites today, another example of using DDoS to cover for other crimes: http://www.v3.co.uk/v3-uk/news/2294837/police-arrest-teenage-hacker-behind-usd50-000-per-month-cyber-ring – gowenfawr Sep 19 '13 at 17:49