What is a DDoS attack?

A DDoS attack is a distributed attack that creates a load on the server and leads to system failure. Under such conditions, users may not be able to access the site or web service, and project owners may lose revenue.

The reason for system failure is not always a DDoS attack. Server resources are limited, and if under normal load everything works, then with an abnormal spike, failures may occur. If you launched a promotion or advertising campaign on your site the day before, which caused a sharp spike in traffic, there may be problems with accessing the site.

If you are sure that the failure on the site is not related to your actions, read below why your site can be attacked by DDoS, how the attack itself occurs and how to deal with it.

Why can your site be attacked?

One of the reasons your site might be hit by a DDoS attack is competition. The attacked site is unavailable because it receives a very large number of requests and cannot cope with the load. After seeing a non-working site, the client can go to an accessible competitor’s site. If your business is successful and the competition in the market is significant, be prepared that your site may be hit by a DDoS at any moment.

In addition, your Internet resource can simply attract the attention of criminals. They may organize a DDoS attack for fun, personal enmity, or extortion.

Who carries out DDoS attacks

Hacktivists are political activists who use DDoS as a form of civil protest. In May 2020, the number of attacks on human rights organizations in the USA increased. The number increased 1,120 times and coincided with mass protests.

Anonymous – the most famous representatives of hacktivism. This is a decentralized group of hacktivists, which mostly consists of users of image boards and Internet forums. They are known for hacking resources with illegal content and subsequent publication of personal data of users of these resources. During their existence, they successfully attacked the sites of the Vatican, Interpol and the European Parliament.

They even had a symbol — the mask of the main character of the movie “V for Vendetta.” In this guise, he fought against the regime.

LulzSec is a group of 6 people. It appeared in May 2011 and lasted until June 26. In such a short period of time, the group managed to become famous for successful attacks on the servers of Sony, Nintendo, the servers of television companies FOX and PBS, as well as the website of the US Senate. LulzSec ceased operations after the arrest of several members of the group.

Also, ordinary DDoS blackmailers often act under the name of well-known groups. In 2020, some large companies received threats on behalf of Fancy Bear and Armada Collective – well-known hack groups. The imitators promised to launch an attack on the company’s website if they did not receive a ransom.

Which sites are most often attacked

The following sites are most often subjected to DDoS attacks:

• state institutions,
• large corporations,
• Health Care,
• online schools,
• game services,
• local and regional media,
• online cinemas,
• banks,
• hosting providers.

This list does not change from year to year. However, which sphere will suffer from attacks more often depends on those taking place in the world at a certain period of social and political events. Such dependence can be traced in the quarterly reports of cyber security companies.

How does a DDoS attack work?

The modern Internet works according to the OSI seven-layer network model. The model defines levels of system interaction, each level corresponds to a certain function.

A DDoS attack can occur at any of seven levels, but the most common are:

• Low-level attack – at the network and transport levels (the third and fourth layers of the OSI model). At these levels, “holes” in network protocols are used for attack.
• A high-level attack is an attack at the session and application levels (the fifth and seventh levels of the OSI model). Such attacks are similar to user behavior. Fine-tuning the server or paid DDoS protection can help in this case.

It is worth noting that DDoS attacks are diverse. Software developers improve protection methods by releasing updates, but every year attackers come up with a new way to fail the system.

A well-organized attack consists of many requests to the server from different parts of the world. But where do criminals get such resources?

By 2020, the most dangerous type of attack is considered to be a botnet attack.

A botnet is a unified network of devices on which autonomous software is installed. Malicious software disguised as programs, emails, files and other content is distributed by attackers, which is secretly installed on the victim’s device and can be launched at any moment. The intervention is invisible: users do not suspect the presence of malicious software.

Thus, any device that has access to the Internet (a mobile phone or a washing machine with WI-FI) can become a participant in a DDoS attack.

During an attack on a server, it is impossible to determine its initiator: requests come from all over the world, from different devices. The perpetrator, as a rule, remains unpunished.

Types of DDoS attacks

The classification of DDoS attacks is described in the article DDoS attacks: types of attacks and levels of the OSI model. The classification of DDoS attacks is described in the article DDoS attacks: types of attacks and levels of the OSI model.

• Ping of death. This is an attack that consists in sending an echo request that exceeds the permissible size of 65535 bytes. The device does not know how to process such a request and stops responding. Currently, Ping of death is no longer used – checking the size when compiling the package solved the problem. Packets that are larger than the allowed size are dropped as invalid. This attack belongs to the DoS class, since the sender is one computer, and not a network of different devices, as in the case of DDoS.
• SYN Flood. The client sends many SYN packets with a spoofed IP address to the server. The server responds to each request and waits for the client to connect. The client ignores the invitation and creates new requests, thereby overflowing the connection queue. As a result, the performance of the server drops to a complete shutdown.
• HTTP Flood. Each member of the botnet generates a large number of HTTP requests to the server, which greatly increases the load. It can be both GET and POST requests. In GET, the client requests the most difficult parts of the site. And in POST requests, it transmits large volumes of data to the server in the request body.
• UDP Flood. The attacker sends many large UDP packets to the victim to specific or random ports. The receiver consumes resources to process the request and send the ICMP reply, which may result in a denial of service.
• DNS Flood. This is a variant of UDP Flood. It differs in that the DNS server is vulnerable to attack. The server cannot distinguish the participant of such an attack from a normal user and processes all requests, which may not have enough resources.
• VoIP Flood. Again, the UDP Flood option, the purpose of which is IP telephony. The server receives requests from various IP addresses, which must be processed along with requests from legitimate clients.
• ICMP Flood. Many ICMP requests are sent to the victim server from different IP addresses. This type of flood can be used both to load the server and to collect information about the server in preparation for another attack.
• DNS amplification. Attackers send small queries to public DNS servers. Queries are formed so that the answer contains as much data as possible. In addition, in the request, the IP address of the real sender is replaced by the address of the victim, to which the DNS server will send responses. As a result, the victim will receive many large data packets from the DNS server, which will cause the channel to overflow.

Protection against DDoS attacks

Let’s consider the main actions that can be used to protect the server against DDoS attacks. To minimize the risk of an attack and its consequences:

1. Examine the software you plan to use in your project or already use for vulnerabilities and critical bugs. They should not be. Choose tools you are confident in. Update them regularly and back them up.
2. Use strong passwords to access the administrative parts of your resource.
3. Configure the network so that access to the admin area is only from the internal network or via VPN.
4. Connect WAF and CDN. WAF is a web application firewall for verifying the legitimacy of traffic and filtering it. CDN — a content delivery network allows you to distribute the load on servers and increase the speed of page loading due to geographically distributed servers.
5. Install a captcha or other components in the feedback form on the site. This will protect the site from spam bots.
6. Distribute site resources between multiple servers that depend on each other. In the event of failure of one of the servers, work will be provided by spare servers.
7. Redirect the attack to the attacker. In this way, you will be able not only to repel a blow, but also to harm the attacker. This requires specialists, but it is quite real.
8. Check with your hosting provider what level of protection they guarantee for your hosting or VDS. If the host does not protect, choose another provider.

As a general rule, if no defensive actions are taken, a DDoS attack will end in a couple of days. Therefore, you can choose the tactic of not interfering and wait for it to end.