A distributed denial of service (DDoS) attack is when an attacker, or attackers, attempt to make it impossible for a service to be delivered. This can be achieved by thwarting access to virtually anything: servers, devices, services, networks, applications, and even specific transactions within applications.
Generally, these attacks work by drowning a system with requests for data. This could be sending a web server so many requests to serve a page that it crashes under the demand, or it could be a database being hit with a high volume of queries. The result is available internet bandwidth, CPU and RAM capacity becomes overwhelmed.
The impact could range from a minor annoyance from disrupted services to experiencing entire websites, applications, or even entire business taken offline.
DDoS attack symptoms
DDoS attacks can look like many of the non-malicious things that can cause availability issues – such as a downed server or system, too many legitimate requests from legitimate users, or even a cut cable. It often requires traffic analysis to determine what is precisely occurring.
DDoS attacks today
It was an attack that would forever change how denial-of-service attacks would be viewed. In early 2000, Canadian high school student Michael Calce, a.k.a. MafiaBoy, whacked Yahoo! with a distributed denial of service (DDoS) attack that managed to shut down one of the leading web powerhouses of the time. Over the course of the week that followed, Calce took aim, and successfully disrupted, other such sites as Amazon, CNN and eBay.
Certainly not the first DDoS attack, but that highly public and successful series of attacks transformed denial of service attacks from novelty and minor nuisance to powerful business disruptors in the minds of CISOs and CIOs forever.
Since then, DDoS attacks have become an all too frequent menace, as they are commonly used to exact revenge, conduct extortion, as a means of online activism, and even to wage cyberwar.
They have also gotten bigger over the years. In the mid-1990s an attack may have consisted of 150 requests per second – and it would have been enough to bring down many systems. Today they can exceed 1,000 Gbps. This has largely been fueled by the sheer size of modern botnets.
One of the most recent and powerful DDoS attacks occurred last fall when internet infrastructure services provider Dyn DNS (Now Oracle DYN) was stuck by a wave of DNS queries from tens of millions IP addresses. That attack, executed through the Mirai botnet, infected reportedly over 100,000 IoT devices, including IP cameras and printers. At its peak, Mirai reached 400,000 bots. Services including Amazon, Netflix, Reddit, Spotify, Tumblr, and Twitter were disrupt.
The Mirai botnet was significant in that, unlike most DDoS attacks, it leveraged vulnerable IoT devices rather PCs and servers, It’s especially scary when one considers that by 2020, according to BI Intelligence, there will be 34 billion internet connected devices, and the majority (24 billion) will be IoT devices.
Unfortunately, Mirai won’t be the last IoT-powered botnet. An investigation across security teams within Akamai, Cloudflare, Flashpoint, Google, RiskIQ and Team Cymru uncovered a similarly sized botnet, dubbed WireX, consisting of 100,000 compromised Android devices within 100 countries. A series of large DDoS attacks that targeted content providers and content delivery networks prompted the investigation.
DDoS vs DoS
In a DoS attack, it’s one system that is sending the malicious data or requests; a DDoS attack comes from multiple systems.
DDoS attack tools
Typically, DDoS attackers rely on botnets – collections of a network of malware-infected systems that are centrally controlled. These infected endpoints are usually computers and servers, but are increasingly IoT and mobile devices. The attackers will harvest these systems by identifying vulnerable systems that they can infect through phishing attacks, malvertising attacks and other mass infection techniques. Increasingly, attackers will also rent these botnets from those who built them.
Types of DDoS attacks
There are three primary classes of DDoS attacks – those that use massive amounts of bogus traffic to down a resource such as a website or server, including ICMP, UDP, and spoof-packet flood attacks. Another class of DDoS attack uses packets to target the network infrastructure and infrastructure management tools. These protocol attacks include SYN Floods and Smurf DDoS, among others. Finally, some DDoS attacks target an organization’s application layer and are conducted by flooding applications with maliciously crafted requests. The goal is always the same: make online resources sluggish or completely unresponsive.
How DDoS attacks evolve
As mentioned briefly above, it’s becoming more common for these attacks to be conducted by rented botnets. Expect this trend to continue.
Another trend is the use of multiple attack vectors within an attack, also known as Advanced Persistent Denial-of-Service APDoS. For instance, an APDoS attack may involve the application layer, such as attacks against databases and applications as well as directly on the server. “This goes beyond simply 'flooding,'” attacks says Chuck Mackey, managing director of partner success at Binary Defense.
Additionally, Mackey explains, attackers often don’t just directly target their victims but also the organizations on which they depend such as ISPs and cloud providers. “These are broad-reaching, high-impact attacks that are well-coordinated,” he says.
This is also changing the impact of DDoS attacks on organizations and expanding their risk. “Businesses are no longer merely concerned with DDoS attacks on themselves, but attacks on the vast number of business partners, vendors, and suppliers on whom those businesses rely,” says Mike Overly, cybersecurity lawyer at Foley & Lardner LLP. “One of the oldest adages in security is that a business is only as secure as its weakest link. In today’s environment (as evidenced by recent breaches), that weakest link can be, and frequently is, one of the third parties,” he says.
Of course, as criminals perfect their DDoS attacks, the technology and tactics will not stand still. As Rod Soto, director of security research at JASK explains, the addition of new IoT devices, rise of machine learning and AI will all play a role in changing these attacks. “Attackers will eventually integrate these technologies into attacks as well, making it more difficult for defenders to catch up with DDoS attacks, specifically those that cannot be stopped by simple ACLs or signatures. DDoS defense technology will have to evolve in that direction as well,” Soto says.
Read more about DDoS attacks