There has been a spike in distributed denial of service (DDoS) attacks in the IT industry recently. It was a few years back when DDoS attacks were seen as little more than inconveniences committed by beginner attackers who did it for the joy of it. But now the situation has changed. At this point, DDoS attacks are quite sophisticated.
What is a DDoS Attack?
To explain it plainly, DDoS attacks are attempts by cybercriminals to render an online service unavailable to their victims by temporarily stopping or suspending the operation of their infrastructure by disrupting the normal traffic with a high number of packets per second or requests per second.
To launch massive distributed denial-of-service (DDoS) attacks, hackers normally use a botnet, a collection of compromised devices spread throughout the globe. Meanwhile, for smaller and cheaper attacks hackers choose to use multiple machines such as VPS (Virtual Private Server), VDS (Virtual Dedicated Server), and dedicated servers, running those attacks with proxy lists, or hiring a DDoS-for-hire service such as stressers or booters.
It is unique from other denials of service (DoS) attacks in that it employs a single Internet-connected device (one network connection) to bombard a target with malicious traffic. As a result of this ambiguity, two somewhat different meanings of the term exist.
Main Categories of DDoS Attacks
There are three main types of DDoS attacks:
- Volumetric Attacks
- Protocol Attacks
- Application Layer Attacks
Volumetric Attacks
Volumetric attacks are among the most common type of DDoS attacks and usually involve flooding a target by consuming all available bandwidth with junk traffic, in this case, a large amount of data is sent to the target in form of an amplification attack or other kinds of methods/technologies with the achievement of creating massive traffic on the network.
Protocol Attacks
Protocol attacks exploit vulnerabilities in the protocols used to communicate between devices on a network, these attacks also cause exhaustion on their targets by consuming all the available resources of the device or the resources of the equipment responsible for the network. They often take advantage of known weaknesses in widely used protocols over the layer3 and layer4 levels.
Application Layer Attacks
Application layer attacks target the applications running on a server, such as a web server. It is quite difficult to defend against these attacks, as they often exploit vulnerabilities in the application code, or they use complex and advanced bot generations in order to bypass layer7 mitigation systems such as JavaScript Challenges. These attacks have an achievement of fully filling all the resources of an Application on the layer7 level, an example of these resources is the infrastructure processor.
Most Common Types of DDoS Attacks
Different types of DDoS attacks exist, and new ones are constantly being created. The most common types of DDoS attacks are:
Ping of Death
This attack involves sending a large ICMP (Internet Control Message Protocol) echo request packet to a target system. The size of the packet is larger than what the system can handle, and as a result, the system becomes overwhelmed and crashes.
SYN Flood
This type of attack exploits the way that TCP (Transmission Control Protocol) connections are established. When a client wants to connect to a server, it sends an SYN packet. What usually happens is that the server responds with an SYN-ACK packet, and the client responds with an ACK packet. This three-way handshake completes the connection.
In an SYN flood attack, the attacker sends a large number of SYN packets to the target system without completing the three-way handshake. The system becomes overwhelmed with incomplete connection requests and is unable to process legitimate requests.
DNS Amplification
This type of DDoS attack takes advantage of the fact that DNS (Domain Name System) queries can be much larger than the request that initiates them. The attacker sends a small DNS query to a server that is configured to amplify DNS responses. This causes the server to send a large DNS response to the target system, overwhelming it.
UDP Flood
UDP Flood involves sending a large number of UDP (User Datagram Protocol) packets to random ports on the target system. The system becomes overwhelmed with the influx of traffic and is unable to process legitimate requests.
HTTP Flood
This type of DDoS attack involves sending a large number of HTTP (Hypertext Transfer Protocol) requests to a web server. The server resources such as his processor become overwhelmed and are unable to process legitimate requests. DDoS attacks can be devastating to businesses, causing downtime, lost productivity, and lost revenue.
How Does DDoS Attack Work?
A typical DDoS attack makes use of a vulnerability in a single computer system, which becomes the DDoS master as a result of the attacker exploiting it. Attackers utilize the attack master system to find additional susceptible systems and take control of them using malware or breaching authentication restrictions by guessing a widely used system or device's default password. An intruder's control of a computer or network device is known as a "zombie" or a bot. In order to manipulate the bots in the network, the attacker sets up a command-and-control server, which is also known as a botnet. The botmaster is the person in charge of a botnet.
Because it is used to manage the spreading and activity of other systems in the botnet, that phrase has also been used to describe the first system recruited into the botnet. The number of nodes in a botnet can range from a few hundred to tens or even hundreds of thousands. It's possible that they can grow indefinitely. Once the botnet has been put together, the attacker can leverage the traffic generated by the hacked devices to overwhelm the target domain and take it down. Many devices are involved in a DDoS attack; therefore, the intended victim is not necessarily the only one who suffers. Although they are not the primary target, malicious traffic routing devices may also see a drop-in service.
Building botnets normally takes time and knowledge, so, most cybercriminals prefer to go on an easy way of attacking their target, by hiring a service, those services are normally open to anyone who wants to purchase, they are DDoS-for-hire services where anyone can pay via a website or application and get access to their hubs where they just have to write the IP/Website, port, time and then, choosing method/protocol to attack. In this case, those hubs are connected.
In basic terms, these hubs are connected to APIs, those APIs are responsible for the connections between the hub and the machines or botnets from these DDoS-for-hire providers, most of the time those machines are VPS (Virtual Private Server), VDS (Virtual Dedicated Server and they are the most used due to the fact of being cheap, not hard to set up and with no traffic limitations.
Normally, botnets are more focused on raw power, where they attack their targets by sending a high amount of packets or connections per second eating the whole network or the whole resources, while stressers/booters are normally more focused on bypassing a mitigation system.
Also, cybercriminals most of the time feel more confident by using stressers/booters since they are not responsible for the service or the DDoS infrastructure. Most of the time, these services don't have any kind of logs meaning that an attack can't be traced to them, it would be instead traced to the service owner.
Final Words
As we have seen, DDoS attacks can be extremely damaging to both businesses and individuals. In order to protect your business from these attacks, it is important to understand how they work and how you can prevent them.
However, there are multiple methods that you can use to prevent DDoS attacks from happening, but the essential thing is to be aware of the possibility and to take steps to protect your online presence.
Will DiamWall protect your service from DDoS attacks?
Completely yes! DiamWall is ready to defend any service against any kind, with any size of DDoS Attack we will drop any malicious traffic before it reaches your services.
You can see more topics related to DiamWall mitigation systems here!