Human-Targeted Denial of Service

By Evgeniy Gabrilovich, Alex Gontmakher

June 30, 2003

(Human-Targeted Denial of Service :  Page 1 of 1 )

The infrastructure of the World Wide Web has been fairly stable over the years, consisting of servers that offer services like HTTP, e-mail and IRC, and client programs that allow users to access these services. Traditionally, services are provided by computer programs, while clients are controlled in a variety of ways—some of them operated manually, and others running in unattended mode.

However, the world is changing. Online services are increasingly being provided by real humans sitting behind computer monitors. For example, many high-profile sites such as eBay and Microsoft bCentral use live chat technology to offer their users interactive human assistance, as the presence of a real person makes the users feel more comfortable with the site.

Providing live support over the Net is much cheaper than the 1-800 option since an operator can handle several chat sessions simultaneously. The downside of this approach, however, is that "the human in the loop" can now be a target of a new class of network attacks. Take a simple chat-bot program that connects to an online chat service. Smart it is not—an operator can tell it's not a human after a few sentences. But that would be too late—the bot has already wasted a few precious minutes of the human assistant's time at the expense of only a few milliseconds of the attacker's CPU time. And several hundreds of such bots can easily overwhelm the whole team of support operators. In a sense, this amounts to a semantic Denial of Service (DoS) attack targeted against real people on the Net. We call this attack Human-Targeted Denial of Service, or HTDoS.

In the past, denial of service attacks have frequently been employed by hackers to plague network services with spurious requests, while semantic attacks have been used to dupe unsuspecting Internet users into various get-rich-quick scams. The former are directed against computers and are completely automatic, while the latter class of attack (also known as cognitive hacking) exploits human perceptions and beliefs.

 Page 1 of 1