Cybercrime magazine stated that the total number of DDoS attacks globally are anticipated to double to 14.5 million by 2022. Now that’s a huge number, isn’t it? Do you know the financial Brunt a DDoS attack causes?
once again according to cybercrime magazine, a denial of service or a DDoS attack could cost up to $120,000 for a small company are more than $2 million for a larger one with financial loss, even reputation gets hampered.
There are a few industries that are more susceptible to DDoS attacks. And according to the Cisco reports, the online gaming and the gambling industry are a prime target. Now, let me talk about a few real life DDoS attacks that have happened in the past.
First example.
Our first example is the DDoS. Attacks faced by dyn, dyn is an internet performance management and web application security company that was acquired by Oracle in 2016. On October 21 2016, dyn phase two serious distributed denial of service attacks that targeted systems operated by DNS provider dyn.
The DDoS attack lasted roughly for a day, with spikes coming in going up to 1.5 terabits per second report state that attack was carried out using a weapon called the Mirai botnet, about 10% or 20% of all the 500,000 Also known Mirai bots were involved. In addition to other devices.
The findings revealed that Mirai was the primary source of malicious attack traffic. The attack affected a large number of users in North America and Europe. several large businesses with high traffic like Amazon Kora, Airbnb HBO, The New York Times, Twitter, visa and CNN were affected
Second example.
Our next example is Amazon Web Services, a subsidiary of Amazon which works on providing on demand cloud computing platforms. In the month of February 2020, Amazon stated that AWS shield observed and mitigated a 2.3 terabits per second DDoS attack.
AWS shield a managed DDoS protection service that is responsible for safeguarding applications running on AWS mitigated this attack. The attack was carried out using hijack CL dot web servers and cost three days Have a way to trade for its AWS shield stuff.
The DDoS attack had a peak volume traffic of 2.3 terabits per second, which is the largest ever recorded. detailing the attack in its q1 2020. Threat report, Amazon said its AWS shield service mitigated the largest DDoS attack ever recorded, stopping a 2.3 terabits per second attack in mid February this year.
Now that we have seen a few real life DDoS attacks, let’s move on to understanding what exactly a DDoS attack is.
What is DDoS attack.
A DDoS attack works closely like a denial of service attack. The only difference is that here multiple systems are used to launch the attack, you can call DDoS attack as a large scale attack operation based on a denial of service attack.
DDoS stands for Distributed Denial of Service. Here several systems target a single system with malicious traffic. When multiple systems are used, the attacker can put the system offline more easy.
DDoS attack is faster than a normal denial of service attack and DDoS attacks are difficult to trace.
Now that we know what a DDoS attack is, Let’s try and understand the motive behind DDos attacks.
Motive behind DDos attacks.
first reason
The first reason can be guessed well by all of you and that is grandson. Just like any other cyber attack, the primary reason is monetary gain. A website owner can be asked to pay a ransom for attackers to stop a DDoS attack.
The ransom prices to stop the DDoS attacks vary from small amounts to hefty amounts of money. In most cases, the ransom is usually charged in Bitcoins.
second reason
The second reason is hacktivism or protest hacktivism occurs with the intention of spreading a message. The aim of this is to usually protest against an ideology or for political agenda. The target of many hacktivism DDoS attacks are government financial or business websites.
Attackers launch DDoS attacks to shut up website see for a political reason. Thus trying to make a statement. A person with a financial or an ideological motive is capable to damage an organization by launching a DDoS attack against it.
Lastly, these attacks can be carried out for a specific reason called targeted attacks. For example, it can be done to damage an organization’s reputation. It is to be noted that DDoS attacks can be deployed against big or small sites, and can be driven by either competition or pure boredom, or also for the need for challenge. The magnitude of these attacks can vary from small to big.
How DDoS Attack Work ?
- botnet
Let’s now move on and understand a little more about the workings of a DDoS attack. An attacker is required to gain control off a network of online machines in order to carry out a DDoS attack.
Computers and various other IoT devices are infected with malware, and these turn into a port also known as a zombie. A group of such bots is called a botnet.
Once a botnet created the attacker takes over the remote control axes. A DDoS is usually launched through a network of remotely controlled bots or hacked computers.
botnets can range from hundreds to thousands of computers controlled by hackers, it is possible that your computer could be a part of a botnet without even you knowing it.
- IP address
The next step is to target the IP address of the victim by the botnet. Once this is done, each bot will bombard the target with fake service requests. The botnets send more connection requests than a server can handle.
In some cases, they send huge volumes of data that exceed the bandwidth range of the victim. By doing so the targeted server or network will overflow and thus resulting in a denial of service to normal traffic.
It is not possible to identify the bot as it looks like a legitimate internet device. A successful DDoS attacks lose a website prevents users from accessing it, resulting in financial loss And performance issues.
So now that you know how a DDoS attack is carried out, let’s have a look at the types of DDoS attacks.
Types of DDoS attacks.
Different DDoS attack vectors target the different components of a network connection. DDoS attacks can be divided into three types.
1. volume based attacks
we have the volume based DDoS attack. As the name suggests, this attack depends on the volume of the inbound traffic to the target. This attack aims at overloading the website’s bandwidth or causes usage issues.
It creates a congestion by consuming all the available bandwidth. Here massive volumes of data are sent to the victim by using a form of an application or request from a botnet. It is very simple the more the volume The higher the success rate of the attack.
The volume based DDoS attacks include UDP floods, ping that is ICMP flood And other spoofed packets floods.
Example
Now let’s have a look at an example of the volume based attack that is the ping ICMP flood attack. The Internet Control Message Protocol ICMP, which is utilized in a ping flood attack is an internet layer protocol used by network devices to communicate.
an ICMP flood attack also known as ping flood attack is one of the most common denial of service attacks. Here the attacker overwhelms the target device with ICMP echo requests. Basically, ICMP echo request and echo reply messages are used to ping a network device to check the connection between the sender and the receiver.
And ICMP requests requires resources and bandwidth to process and reply to the requests. by flooding the target with request packets the network is forced to respond with an equal number of reply packets, thus making it unserviceable to normal traffic. Attackers would usually spoof in a bogus IP address in order to mask the sale device.
2. protocol attacks
The next type of DDoS attack we will be discussing about is the protocol based attack. When you learn networking, you will know that the internet is based totally on a set of protocols.
protocol attacks cause a service disruption by consuming intermediate communication equipment like firewalls and load balancers. DDoS attacks based on protocols exploit weaknesses in layer three and layer four protocol stacks.
protocol based attacks exploit your network by sending either more packets and what your server can manage, or more bandwidth and what your network ports can hold. This attack includes SYN floods, ping of death and smart DDoS to name a few.
Here we will have a look at an example of the protocol based attack that is the SYN flood attack. Here the attack exploits the TCP handshake. In a regular TCP IP network transaction there is a three way handshake mainly the sin, the economic judgment and the sin acknowledgement the sin as a service request.
The Act that is also known as the acknowledgment is the response from the target. And the sin acknowledgement is the original requester replying with something like a tax and return. Whereas in the SYN flood attack the SYN packets are created with fake IP addresses by the attackers.
The target as per the protocol then sends an acknowledgment to the dummy address. Unfortunately, this dummy address never responds. This is carried out a number of times, the target waits for the final step in the handshake and until it exhausts its resources in the process.
3. application layer attacks.
Next up, we have the application layer attack. The main motive of this attack is to bring down an online service or a website. These attacks are comparatively smaller but silent.
application layer attacks are also known as layer seven attacks. And it’s not only targets the application but also the network and it’s badWith application layer attacks include GET and POST floods, low and slow attacks and more.
Example
Let’s have a look at the famous HTTP flood attack as an example. HTTP flood is a type of distributed denial of service attack in which the attacker exploits legitimate looking HTTP GET or POST requests to attack a web server or an application.
Here, large numbers of HTTP requests flood the server resulting in denial of service. HTTP has generally two types of requests get a post, a get request is used to retrieve information while a POST request is often used when submitting a completed web form or when uploading a file.
Usually, HTTP flood attacks are harder to detect and glow. I had CTP flood attacks since what appears to be legitimate HTTP GET or POST requests to attack a web server or an application. These flooding attacks often rely on On a botnet.
How to Prevent DDos Attack ?
Now that we had a look at the types of DDoS attacks, let’s understand the measures we need to take up in order to prevent these attacks.
1. More bandwidth
The first step is to acquire more bandwidth, you must make sure that you have ample bandwidth to handle any spikes and traffic caused due to malicious activity.
Currently, with attackers being more careful and having more bandwidth raises the bar which the attackers have to overcome before launching a successful DDoS attack.
2. DDoS response plan ready
Next, make sure to develop a DDoS response plan ready. Usually when a DDoS attack takes place that is very less time to plan. Hence, it is wise to define a plan in advance as it will avoid and minimize any impacts.
To do this job, first, you would have to develop an incident response plan. Also make sure your data center is prepared and your team knows what to do.
This standard key elements include system checklist forming a response which would include the list of internal and external contacts as well, and the last being securing your network infrastructure.
3. securing your network
This can be done with the help of IPS that is intrusion prevention systems which combine firewalls, VPN load balancing and other layers of DDoS defense techniques
4. configure network hardware
At times small hardware configuration changes can help you prevent a DDoS attack. This is most often overlooked. Also make sure to protect your DNS servers as attackers can bring down your website and web servers offline by attacking your DNS servers.
5. leverage the cloud.
The conventional DDoS mitigation solutions oversize and network bandwidth and require complex hardware, which proves to be costly and also ineffective.
Whereas cloud has greater bandwidth and resources. Cloud based apps can absorb malicious traffic way before it reaches its intended destination. Therefore, it is good to outsource DDoS prevention to cloud based service providers.
6. monitoring your website traffic regularly for unusual activities.
It is a great thing if your website gets millions of new visitors in an hour. But isn’t that also suspicious? A sudden increase in traffic is an alarming situation. A DDoS attack usually gives a few red flags before it happens, looting should be wise enough to spot them beforehand.
example
The signs of such an attack for example, will be your website being unresponsive or responding slowly intermittent website shutdowns or probably the user having problems accessing the websites.
If these issues are prolonged, then the network is likely experiencing a DDoS and an action should be taken immediately.
7. keep everything up to date.
This might sound basic, but it goes a long way. All the systems should be kept up to date to make sure that any issues or bugs are fixed. It is always good to detect threats at an early stage. And finally, you can make use of DDoS prevention tools like imperva cloudfare f5 networks are both DDoS and lack low just to name a few.
These tools are very effective. For example, cloud has layer three and four protection absorbs an attack before it reaches the target server. This is not achievable by using firewalls, load balancers and routers.
Taking an example of our DDoS It is to be noted that it can deal with large volumes of malicious traffic without disrupting the regular traffic. This software is used to mostly protect enterprise or web hosting services.
