What Is a DDoS Attack?
DDoS attacks are one of the primary concerns in internet security today. Explore the details of how DDoS attacks work and how they can be stopped.
A Distributed Denial-of-Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.
DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other network-connected resources such as IoT devices.
At a high level, a DDoS attack is like an unexpected traffic jam clogging up the highway, preventing regular traffic from arriving at its destination.
How Does a DDoS Attack Work?
DDoS attacks are carried out using networks of internet-connected devices.
These networks consist of computers and other devices (such as IoT devices) that have been infected with malware, allowing attackers to control them remotely. These individual devices are referred to as bots (or zombies), and a collection of bots is called a botnet.
Once a botnet has been established, the attacker is able to direct an attack by sending remote instructions to each bot.
When a victim's server or network is targeted by the botnet, each bot sends requests to the target's IP address, potentially causing the server or network to become overwhelmed, resulting in a denial-of-service to normal traffic.
Because each bot is a legitimate internet device, separating the attack traffic from normal traffic can be difficult.
How to Identify a DDoS Attack
The most obvious symptom of a DDoS attack is that a site or service suddenly becomes slow or unavailable. However, since a number of causes — such as a legitimate spike in traffic — can create similar performance issues, further investigation is usually required. Traffic analysis tools can help you detect some of these telltale signs of a DDoS attack:
- Suspicious amounts of traffic originating from a single IP address or IP range
- A flood of traffic from users who share a single behavioral profile, such as device type, geographic location, or web browser version
- An unexplained spike in requests to a single page or endpoint
- Odd traffic patterns such as spikes at odd hours of the day or patterns that appear unnatural (e.g., a spike every 10 minutes)
There are other, more specific signs of a DDoS attack that can vary depending on the type of attack.
What Are Some Common Types of DDoS Attacks?
Different types of DDoS attacks target different components of a network connection. To understand how different DDoS attacks work, it is necessary to know how a network connection is made.
A network connection on the internet is made up of many different components or "layers." Like building a house from the ground up, each layer in the model has a different purpose.
The OSI model, illustrated below, is a conceptual framework used to describe network connectivity in 7 distinct layers.
While almost all DDoS attacks involve overwhelming a target device or network with traffic, attacks can be divided into three categories. An attacker may use one or more different attack vectors, or cycling attack vectors in response to countermeasures taken by the target.
Application Layer Attacks
Goal of the Attack:
Sometimes referred to as a Layer 7 DDoS attack (in reference to the 7th layer of the OSI model), the goal of these attacks is to exhaust the target's resources to create a denial of service.
The attacks target the layer where web pages are generated on the server and delivered in response to HTTP requests. A single HTTP request is computationally cheap to execute on the client side, but can be expensive for the target server to respond to, as the server often loads multiple files and runs database queries in order to generate a web page.
Layer 7 attacks are difficult to defend against, since it can be difficult to distinguish malicious traffic from legitimate traffic.
Example of an Application Layer Attack:
HTTP Flood
This attack is similar to pressing refresh on a web browser again and again across many different computers simultaneously — large numbers of HTTP requests flood the server, resulting in a denial of service.
This type of attack ranges from simple to complex.
Simpler implementations may hit a single URL with the same range of attacking IP addresses, referrers, and user agents. More complex versions may use a large number of attacking IP addresses, and target random URLs using random referrers and user agents.
Protocol Attacks
Goal of the Attack:
Protocol attacks, also known as state-exhaustion attacks, cause service disruption by excessively consuming server resources and/or network equipment resources such as firewalls and load balancers.
Protocol attacks exploit weaknesses in Layer 3 and Layer 4 of the protocol stack to render the target inaccessible.
Example of a Protocol Attack:
SYN Flood
A SYN Flood is analogous to a worker in a supply room receiving requests from the front of the store.
The worker receives a request, goes and retrieves the package, and waits for confirmation before bringing the package to the front. The worker then receives many package requests without confirmation until they can no longer carry any more packages, becomes overwhelmed, and requests start going unanswered.
This attack exploits the TCP handshake — the sequence of communications by which two computers initiate a network connection — by sending a large number of TCP "initial connection request" SYN packets with spoofed source IP addresses.
The target machine responds to each connection request and then waits for the final step in the handshake, which never occurs, exhausting the target's resources in the process.
Volumetric Attacks
Goal of the Attack:
This category of attacks attempts to create congestion by consuming all available bandwidth between the target and the larger Internet. Large amounts of data are sent to the target by using some form of amplification or another means of creating massive traffic, such as requests from a botnet.
Amplification Example:
DNS Amplification
DNS amplification is like someone calling a restaurant and saying "I'll have one of everything, please call me back and repeat my entire order," where the callback number actually belongs to the victim. With little effort, a lengthy response is generated and sent to the victim.
By making a request to an open DNS server with a spoofed IP address (the victim's IP address), the target IP address then receives a response from the server.
What Is the Process for Mitigating a DDoS Attack?
The primary concern in mitigating a DDoS attack is distinguishing between attack traffic and normal traffic.
For example, if a product release has a company website swamped with eager customers, cutting off all traffic would be a mistake. If this company experiences a sudden surge in traffic from known attackers, mitigation efforts are likely necessary.
The difficulty lies in telling real customers apart from attack traffic.
In the modern internet, DDoS traffic comes in many forms. Traffic can vary in design from single-source non-spoofed attacks to complex, adaptive multi-vector attacks.
A multi-vector DDoS attack uses multiple attack pathways in order to overwhelm a target in different ways, which may distract mitigation efforts on any single pathway.
An attack targeting multiple layers of the protocol stack simultaneously, such as DNS amplification (targeting layers 3/4) coupled with an HTTP flood (targeting layer 7), is an example of multi-vector DDoS.
Mitigating a multi-vector DDoS attack requires a variety of strategies to counter the different pathways.
Generally speaking, the more complex the attack, the more likely it is that the attack traffic will be difficult to separate from normal traffic — the attacker's goal is to blend in as much as possible, making mitigation efforts as ineffective as possible.
Mitigation attempts that involve dropping or limiting traffic indiscriminately may throw out good traffic along with the bad, and the attack may also modify and adapt to countermeasures. In order to overcome a complex disruption attempt, a multi-layered solution will provide the greatest benefit.
Blackhole Routing
One solution available to virtually all network administrators is to create a blackhole route and funnel traffic into that route. In its simplest form, when blackhole filtering is implemented without specific restriction criteria, both legitimate and malicious network traffic is routed into a null route, or blackhole, and dropped from the network.
If an internet property is under a DDoS attack, the property's internet service provider (ISP) may send all of the site's traffic into a blackhole as a defense mechanism. This is not an ideal solution, as it effectively gives the attacker their desired outcome: it makes the network inaccessible.
Rate Limiting
Limiting the number of requests a server will accept over a certain time period is also a way to mitigate denial-of-service attacks.
While rate limiting is useful in slowing web scrapers from stealing content and for mitigating brute force login attempts, it may alone not be enough to effectively handle a sophisticated DDoS attack.
However, rate limiting is a useful component in an effective DDoS mitigation strategy.
And that, my friend, concludes our mission successfully 
With greetings from the #Ezznology team
Find what you need at #our store
To subscribe to our newsletter on Google News click here 👇👇
Or scan the code
