Understanding DDoS Attacks: An Overview

What is a DDoS (Distributed Denial of Service) Attack?

Detailed Description

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other networked resources such as IoT devices.

From a technical perspective, DDoS attacks can be classified into three types:

• Volume-based attacks: Includes UDP floods, ICMP floods, and other spoofed-packet floods. The attack’s goal is to saturate the bandwidth of the attacked site, and magnitude is measured in bits per second (Bps).
• Protocol attacks: Includes SYN floods, fragmented packet attacks, Ping of Death, Smurf DDoS and more. This type of attack consumes actual server resources, or those of intermediate communication equipment, such as firewalls and load balancers, and is measured in packets per second (Pps).
• Application layer attacks: Includes low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD vulnerabilities and more. These attacks target the layer where web pages are generated on the server and delivered in response to HTTP requests. Measurement is in requests per second (Rps).

DDoS attacks are becoming more sophisticated and larger in scale, making them a significant threat to business continuity.

Examples for DDoS Attacks

Case Study: GitHub DDoS Attack

In 2018, GitHub was hit by a massive DDoS attack that peaked at 1.35 Tbps. This attack was notable for its size and the method of exploitation. Attackers used an amplification technique by spoofing GitHub's IP address and bombarding it with data that appeared to be legitimate requests.

The attack was mitigated by GitHub's use of a DDoS protection service, which routed all traffic to the site through its scrubbing centers, filtering out malicious packets.

Security Recommendations

To protect against DDoS attacks, organizations can implement several strategic, architectural, and operational measures:

• Increased Bandwidth: While not a solution by itself, having bandwidth that exceeds the average expected peak can allow a site to handle sudden spikes in traffic, whether legitimate or malicious.
• DDoS Protection Services: Specialized DDoS protection providers such as Cloudflare, Akamai, and Arbor Networks can detect and mitigate attacks before they reach the targeted site or service.
• Redundancy: Implementing a redundant infrastructure across multiple data centers can help to mitigate the risk of a single point of failure.
• Network Hardware: Upgrading routers and firewalls to handle DDoS attacks can be beneficial. Some hardware is designed to recognize and filter out attack traffic.
• Security Policies and Response Plan: Developing a formal DDoS prevention plan, including detection, response, and mitigation strategies, is crucial for rapid response to attacks.

References

• Cloudflare - What is a DDoS Attack?
  
• Akamai Security Resources
  
• Arbor Networks DDoS Protection
  
• Wired - How GitHub Survived the Biggest DDoS Attack in History
  

Understanding and preparing for DDoS attacks is essential for maintaining the availability and reliability of services in the digital age.

By implementing robust security measures and maintaining awareness of the evolving nature of DDoS tactics, organizations can better protect themselves from these disruptive threats.

Frequently Asked Questions