Dos -Denial-of-Service
A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making
it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with
traffic, or sending it information that triggers a crash from a source. In both instances, the DoS
attack deprives legitimate users (i.e. employees, members, or account holders) of the service or
resource they expected.
Victims of DoS attacks often target web servers of high-profile organizations such as banking,
commerce, and media companies, or government and trade organizations. Though DoS attacks
do not typically result in the theft or loss of significant information or other assets, they can cost
the victim a great deal of time and money to handle.
DDoS- Distributed Denial-of-service
A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic
of a targeted server, service or network by overwhelming the target or its surrounding
infrastructure with a flood of Internet traffic.
DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as
sources of attack traffic. Exploited machines can include computers and other networked
resources such as IoT devices.
From a high level, a DDoS attack is like an unexpected traffic jam clogging up the highway,
preventing regular traffic from arriving at its destination
Botnet
The attacker will develop a malware program and distribute it over the internet and put it on
things like websites and email attachments. So if a vulnerable computer goes to these infected
websites or opens these infected email attachments, the malware will be installed on their
computer without the owner even knowing that their computer has been infected. So now their
computer has been recruited in an army of other infected computers to perform a DDoS attack.
And this army of infected computers is what's called a botnet. Now this botnet is not just limited
to a few computers, this botnet could be hundreds or even thousands of computers that are
scattered all over the world. So now this botnet can be controlled like an army, waiting to receive
instructions from the attacker, who is now like a centralized command and control center for the
botnet. And then the attacker can send out commands to all these computers and to tell them to
attack at a certain date and time. And then once that set time is reached, the attack begins.
Now a DDoS attack can last for hours or even days. It just depends on the attacker's intent.
Why do people do DDoS attacks?
DDoS attacks can happen for several different reasons.
● Financial Reasons
● Attacker Is Ddosing A Competitor In The Marketplace
● Political Reasons
● Just Doing It For Fun
Basic Categories of DoS/DDoS Attack Vectors
Volume Based Attacks
This category of attacks attempts to create congestion by consuming all available bandwidth
between the target and the larger Internet. Large amounts of data are sent to a target by using a
form of amplification or another means of creating massive traffic, such as requests from a
botnet.
Zero-Day DDoS Attack
A zero-day DDoS attack is delivered before the DDoS vulnerabilities of a system have been
patched or effective defensive mechanisms are implemented
Until the victim deploys a patch for the exploited DDoS vulnerability, an attacker can actively
block all the victim's resources and steal the victim's data
These attacks can cause severe damage to the victim's network infrastructure and assets
Protocol Attacks
Protocol attacks, also known as state-exhaustion attacks, cause a service disruption by
over-consuming server resources and/or the resources of network equipment like firewalls and
load balancers. Measured in packets per second (Pps).
SYN flood
This attack exploits the TCP handshake — the sequence of communications by which two
computers initiate a network connection — by sending a target a large number of TCP “Initial
Connection Request” SYN packets with spoofed source IP addresses.
The target machine responds to each connection request and then waits for the final step in the
handshake, which never occurs, exhausting the target’s resources in the process.
Application Layer Attacks
Sometimes referred to as a layer 7 DDoS attack (in reference to the 7th layer of the OSI model),
the goal of these attacks is to exhaust the target’s resources to create a denial-of-service.
The attacks target the layer where web pages are generated on the server and delivered in
response to HTTP requests. A single HTTP request is computationally cheap to execute on the
client side, but it can be expensive for the target server to respond to, as the server often loads
multiple files and runs database queries in order to create a web page.
Magnitude is measured in Requests per second (Rps).
HTTP flood
This attack is similar to pressing refresh in a web browser over and over on many different
computers at once – large numbers of HTTP requests flood the server, resulting in
denial-of-service.
This type of attack ranges from simple to complex.
Simpler implementations may access one URL with the same range of attacking IP addresses,
referrers and user agents. Complex versions may use a large number of attacking IP
addresses, and target random urls using random referrers and user agents.
How to identify a DoS/DDoS attack
● Suspicious amounts of traffic originating from a single IP address or IP range
● A flood of traffic from users who share a single behavioral profile, such as device type,
geolocation, or web browser version
● An unexplained surge in requests to a single page or endpoint
● Odd traffic patterns such as spikes at odd hours of the day or patterns that appear to be
unnatural
Mitigating a DoS/DDoS attack
Rate limiting
Limiting the number of requests a server will accept over a certain time window is also a way of
mitigating denial-of-service attacks.
While rate limiting is useful in slowing web scrapers from stealing content and for mitigating
brute force login attempts, it alone will likely be insufficient to handle a complex DDoS attack
effectively.