Definition
A Distributed Denial of Service (DDoS) attack involves overwhelming a target server, service, or network with a flood of internet traffic, causing it to become unavailable to legitimate users. It is executed using multiple compromised computers, forming a botnet, to generate large amounts of traffic.How It Works
- 1Infection: Attackers infect numerous devices with malware to create a botnet.
- 2Command: The attacker commands the botnet to send requests to the target.
- 3Flooding: The target is overwhelmed by the massive volume of requests, leading to service disruption.
Key Characteristics
- Volumetric Attacks: Consume bandwidth with high traffic volume.
- Protocol Attacks: Exploit server resources and network equipment.
- Application-Layer Attacks: Target specific web applications, making them hard to detect.
Comparison
| Type | Scope | Origin | Example |
|---|---|---|---|
| DoS | Single | One source | SYN flood |
| DDoS | Multiple | Multiple sources | Mirai botnet attack |
Real-World Example
In 2016, the Dyn DNS provider was hit by a massive DDoS attack using the Mirai botnet, impacting major websites like Twitter and Netflix. No CVE was directly assigned, but the attack highlighted DNS vulnerabilities.Detection & Prevention
- Detection Tools: Use tools like Nmap and OWASP ZAP for vulnerability scanning.
- Traffic Monitoring: Implement network monitoring to detect abnormal traffic patterns.
- CDN Mitigation: Services like Cloudflare and AWS Shield absorb and mitigate attack traffic.
Common Misconceptions
- Myth: Only large organizations are targeted.
- Myth: DDoS attacks are always large-scale.