A DoS (short for "denial of service") attack is a form of attack used on web services which aims to "crash" the service.
Is there any motive of this form of attack besides crashing the service / website?
For example, I could think of blackmailing/ doing harm to a competitor / political reasons as a direct motive for DoS attack. But are there other, more indirect motives? Would it be possible to get data from the service with a DoS attack? If so, how?
In general a (Distributed) Denial of Service attack will not provide you with much information directly. However, there are a few scenarios where information could be gleaned as a result of a DoS. The following are a few examples, but this is not at all exhaustive:
Other motives for a Denial of Service attack become apparent if you consider the users of a system as targets in addition to the system itself: A Denial of Service attack against a website that sells concert tickets may allow an attacker to buy tickets to a event that would have otherwise sold out in minutes. A DoS against a version control system could prevent a development company from delivering software on time. A DoS against a social media site could make coordinating political protests more difficult, or event impossible.
In general, DoS attacks are only designed to cause (as their name suggests) a denial of service, i.e. a compromise of the availability of the service.
Other forms of DoS, e.g. triggering a null pointer dereference, might be used to compromise integrity by crashing a service without it having time to cleanly close files, leading to data corruption (loss of integrity). Databases are an obvious target for that kind of thing.
Firewalls and other security services should fail closed if they are effectively DoS'ed. I'm not aware of any case where something like that would fail open. However, I could foresee a scenario where a server behind a load balancer falls to a DoS attack, so the load balancer shifts to a secondary system, which is configured in a weaker manner, thus revealing that vulnerability externally.
Outside the CIA triad, you might find that DoS attacks are used to divert attention and staff resources away from a more subtle attack.
Yes, DoS attack can be useful to an attacker.
(By the way, it's not an attack only against web services. It can be directed against any network device).
The point of DoSing a device in such cases is to make it respond slower or later than it would normally do. From the top of my head, I see:
On a different note, DoSing clearnet servers (e.g. by a classical dos, or just by cutting network access) could be used to verify Tor's hidden service identity - e.g. it might have been used in pinpointing Silk Road's server.
In the similar vein, the Nazis during WW2 used a kind of DoS (switching off electricity in city quarters and streets) during la resistance radiostations' transimissions to find out their locations.
A DoS (short for "denial of service") attack is a form of attack used on web services which aims to "crash" the service.*
Not exactly. As the name implies, the aim is to make the service unavailable for legitimate users. The most common way to do this for an Internet service such as a web server is to saturate the connections so that nobody else can connect. This can be done e.g. via a SYN flood.
Edit: as @RoryAlsop commented, an attacker might also try to crash the service in order to make it completely off-line.
Would it be possible to get data from the service with a DoS attack? If so, how?
No, that's a completely different type of attack — which, however, could be carried out in conjunction with a DoS, the latter having the aim to saturate the resources of a security-related appliance e.g. an IDS, a firewall, or even a logger.
One result from a DoS attack that I believe was failed to be mentioned in any of the other answers, is the possibility that a particular action may result in data being stored, even if just bytes. For example, If visiting a particular URL may log something in a file, the attacker's goal could be to fill the hard drive.
This could create havoc for clearing the drive space, especially if the data is created in separate files, with possibly random names, or if the data is added to a database with legitimate data.
While a DoS cannot normally be used to cause damage other than simply knocking the server offline, in certain circumstances (most commonly due to poorly configured systems), they can lead to severe consequences, such as data leakage.
One famous example is the ACS Law website information leak. The poorly configured server, when restarted after the DoS attack ended, somehow lost its original settings and allowed its directory root to be viewable publicly.
“Their site came back online [after the DDoS attack] – and on their frontpage was accidentally a backup file of the whole website (default directory listing, their site was empty), including emails and passwords,” a leader of the attacking group told TorrentFreak. “The email contains billing passwords and some information that ACS:Law is having financial problems.”
This later led to serious financial and reputation repercussions for ACS Law.
I think of non-technical gains for the attacker:
Most answers on here mention side-effects of DOS-attacks. However, I think there's also the reverse option possible: that the DOS-attack is not the cause of the side effects, but instead is itself a side-effect of another attack. For example, a DOS-attack might be a side-effect of a botnet brute-force enumerating email addresses through a forgot password screen, slowing down the service or even crashing it.
The motive of this form of attack is not to take down the system, but instead to get a list of users of the service, where the method used to get the list of users has the side-effect of taking down the system.
Usually, but not necessarily. It all depends on what happens next when the intended service fails due to the attack. Imagine that the effect of the attack is to overload the user authentication for a site, and that the effect of the failure is to allow service instead of deny it. Probably not the intended behavior, easily one that could be missed in normal testing.
