by 
A distributed denial of service DDoS attack is a malicious attempt to disrupt regular traffic to a targeted server, service, or network by flooding it with internet traffic from several sources.
A DDoS attack’s purpose is to prevent access to a specific resource, service, or website, rendering it unavailable to users. DDoS attacks generally employ botnets. Which are networks of infected computers infiltrated by software and controlled remotely by the attacker.
These botnets are used to flood the targeted resource with requests, such as effectively overloading it with traffic and causing it to slow down or even crash. DDoS attacks are carried out by a wide range of threat actors, from individual criminal hackers to organised crime groups and government organisations.
In some cases, such as those involving bad coding, missing patches, or unstable systems, legitimate, uncoordinated requests to target systems can appear to be DDoS attacks. When they are simply coincidental lapses in system performance.
One of the first DDoS assaults was perpetrated in 2000 by Michael Calce, a 15-year-old boy who known by the internet nickname “Mafiaboy.” He gained access to multiple colleges’ computer networks.
He launched a DDoS attack against multiple websites. Including eBay and Yahoo, using their servers. A significant DDoS attack that targeted Dyn in 2016 brought down well-known websites and services like Netflix, PayPal, Amazon, and GitHub.
How do DDoS attack work?
In a typical DDoS attack, the attacker exploits a weakness in one computer system, thereby making that machine the DDoS master. The assault master system detects additional vulnerable systems and takes control of them by infecting them with malware or bypassing authentication measures such as guessing the default password on a commonly used system or device.
The goal of this attack is to flood the targeted system, leaving it incapable of serving legitimate users. The attack is typically conducted out by a group of attackers. Who frequently use malware-infected computers or devices known as “bots” or “zombies.”
These bots are often operated by a centralised command and control server, also known as a “botnet.” The botnet operator commands the bots to deliver traffic to the target. Which is frequently performed with the use of specialised software that automates the attack.
The bots overwhelm the targeted system with traffic, using its bandwidth, processing power, and memory. Preventing it from responding to legitimate requests. Legitimate users may experience a denial of service as a result and be unable to access the targeted website or service.
DDoS assaults can come in a variety of shapes. Including HTTP, SYN, and UDP floods. While HTTP floods aim to overwhelm certain web pages, UDP and SYN floods often overwhelm a server with requests. Attackers may also combine different methods to make their attack more powerful.
Types of DDoS attacks
There are several types of DDoS attacks, including:
- Volumetric Attacks: The most frequent kind of DDoS attacks are known as volumetric attacks. They utilize a botnet to send an excessive amount of traffic over the network or server, more than the network can handle. With this attack, the target is overwhelmed with lots of random data. This causes a reduction in network bandwidth and may result in a complete denial of service. Examples, UDP flood and ICMP flood attacks.
- Protocol attacks: In order to overload targeted resources. These target network layer or transport layer protocols exploit protocol weaknesses. For example, a SYN flood attack delivers a lot of “initial connection request” packets with forged source IP addresses to the target IP addresses. Due to the ongoing barrage of requests. This prolongs the Transmission Control Protocol handshake. Which is never able to complete.
- Application Attacks: Attacks on the application layer (Layer 7 attacks) are slower and focus on the victim’s applications. As a result, they could at first seem like real requests from users, leaving the victim helpless to react. The layer where a server creates web pages and responds to HTTP requests is the target of these assaults. Attacks on the application level are integrated with other DDoS attacks that target apps, the network, and bandwidth. Threatening because they are more challenging for businesses to identify, these attacks.
- Fragmentation Attacks: The cybercriminal takes advantage of frangibility during the datagram fragmentation process. Which divides IP datagrams into smaller packets, transports them across a network, and then reassembles them. Fake data packets cannot be reassembled in such assaults.
Difference between DoS and DDoS
| DoS | DDoS |
|---|---|
| DoS Stands for Denial of service attack. | DDoS Stands for Distributed Denial of service attack. |
| In Dos attack single system targets the victim system. | In DDoS multiple systems attack the victim’s system. |
| Victim’s PC is loaded from the packet of data sent from a single location. | Victim PC is loaded from the packet of data sent from Multiple locations. |
| Dos attack is slower as compared to DDoS. | A DDoS attack is faster than Dos Attack. |
| Can be blocked easily as only one system is used. | It is difficult to block this attack as multiple devices are sending packets and attacking from multiple locations. |
| In DOS Attack only a single device is used with DOS Attack tools. | In a DDoS attack, The volumeBots are used to attack at the same time. |
| DOS Attacks are Easy to trace. | DDOS Attacks are Difficult to trace. |
| Types of DOS Attacks are: 1. Buffer overflow attacks 2. Ping of Death or ICMP flood 3. Teardrop Attack 4. Flooding Attack | Types of DDOS Attacks are: 1. Volumetric Attacks 2. Fragmentation Attacks 3. Application Layer Attacks 4. Protocol Attack. |
How to Stop a DDoS Attack
- Detect the attack: To determine the type and scale of the attack, use network monitoring tools. To identify the attack’s origin, you might also need to examine the logs of the systems that were targeted.
- Inform your ISP: Report the attack by getting in touch with your Internet service provider (ISP) as soon as you can. By removing the malicious traffic from it before it reaches your network, they might be able help you.
- Use a DDoS mitigation service: Consider using a DDoS mitigation solution that can identify and filter out unwanted traffic before it reaches your network.
- Configure firewalls and routers: Firewalls and routers should be configured to reject fake traffic, and both routers and firewalls should be kept up to date with the latest security patches. To stop malicious traffic, use rate limitation and access control list.
- Increase bandwidth:
- Increase bandwidth: Consider expanding the bandwidth of your network to manage the attack traffic. This may involve improving your internet connection or adding additional servers to your network.
- Keep software updates: Maintain software updates to ensure that you have the most recent security patches and updates that can guard against known DDoS attack tactics.
