Permanent Denial of Service (PDoS) attacks
Permanent Denial of Service (PDoS) attacks can render endpoint hardware useless, irrevocably damaging the hardware beyond use, facilitating the need for an expensive replacement. With time consuming consequences for the owner. Along with hardware replacement potentially data may be forever lost, some backups may fail leaving the user in a perilous position. The knock-on effect can cause huge damage to any organization.
The Syvir PDoS sensor works with Vector Phase Sensors, these are based on Syvirs AntiPDoS research technology. They determine if key system metrics are being overloaded by a hardware attack. The sensor is set to DOWN when a combination of Vector Phase Sensors are overloaded.
Some types of attacks may involve direct action by a hacker who has access to an endpoint, these types of attacks could involve encrypting data on the endpoints hard drive.To monitor these types of hardware attacks Syvir EndPoint use Vector Phase Sensors.We monitor several metric variables of internal components.We classify these into algorithms.
Several algorithms are used to determine if a PDoS attack is being carried out on the device. Once certain system conditions are exceeded an automatic hardware test is performed.
Vector Phases
A vector phase checks several key system operands.
One Minute Vector Phases.
When an attack vector or pseudo attack vector is created a process alert is created.
Systems with fast CPUs will generally see less false positives.
The process alerts scan for running processes that have been running for > 10 seconds. Clearly some normal Windows operations will exceed that time such as antivirus scans chrome edge etc.
It’s important to see in the process scan what unusual svhost or exe is running that you’re not familiar with and investigate further.
The LLA vector phase will automatically generate a process scan and possibly a hardware scan.
The cloud service will update when a sensor is set to WARNING or DOWN.
These could be false positives where hardware has naturally broken down…
Five Minute Vector Phases.
After 5 minutes a variety of algorithms are processed to determine if an attack vector or pseudo attack vector is in process.
If either attack type is determined a hardware scan takes place of hardware components.
The cloud service will update when a sensor is set to WARNING or DOWN.
These could be false positives where hardware has naturally broken down…
A combination of Vector Phase sensors provides the PDoS sensor with data. When an EndPoint starts to be overloaded with use the PDoS Sensor will be set to DOWN.
If the Vector Sensor Disk Time becomes more active, this triggers more alerts.This may point to the hard drive being encrypted by malware…