April 6, 2013 Leave a comment
At the time of writing, the Wikipedia entry for DOS states:
In computing, a denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a machine or network resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the efforts of one or more people to temporarily or indefinitely interrupt or suspend services of a host connected to the Internet.
And this seems in line with every Denial Of Service Attack I’ve read about: it’s all about knocking the host offline.
However, when you lock at the term itself: “Denial Of Service”. It indicates that it is an attack whereby you deny users access to a service. Seems straight forward enough, but does one really need to take a service offline to deny users from using it.
A website offers an online directory where you can search for shops, restaurants, etc.. in your neighbourhood. Shops can register and fill out a little form online where they state their name, address, phone, business hours and more relevant info as such.
So the services offered here are:
- For shops to make them selves known to potential customers
- For potential customers to search fo nearby product/service vendors
Now, imagine someone identifies a security issue with the shops registration form that would allow them to mass registers shops.They then proceed by registering large numbers of shops/vendors with real looking data. This would make searching the site for nearby or local shops useless as valid entries would be drowned out by invalid entries.
At this point one might argue that a little database cleanup and fixing the issue with the registration form should suffice. But what if someone, in stead of drowning out valid results, would just insert a fair amount of invalid data. In this manner spiking search results with enough invalid, but real looking, data to make users no longer trust the search results?
In effect, the results, and therefore the services rendered by the site, have become unusable. The host is still online, and people can still connect to it, but they just don’t want to any-more.
Would you call that a Denial Of Service? Or an Introduction Of Disservice?