Cybersecurity
DDOS (or Denial of Service) attack: what it is and how to defend against it
We are hearing more and more about institutional sites being taken down by DDoS attacks, a particular type of attack used to overload the victim’s systems and make them inaccessible by legitimate users, in the case of citizens using services provided by the government.
We have cited a possible example—one that is, in fact, quite common in the news—but DDoS attacks today are no longer something so far removed from the realm of corporate cybersecurity, as they can target public and private organizations in various and increasingly sophisticated ways. This scenario makes it necessary—and, above all, urgent—to adopt a specific approach to preventing DDoS attacks, as well as to know how to respond effectively in the early stages of a potential attack, before it’s too late.
Trends such as the proliferation of IoT systems and the rise of remote work, combined with the steady increase in the average number of devices connected to a network, have created a very fertile ground for infections by a wide variety of malware. Malicious software that enables the deployment and control of a botnet—through which DDoS attacks are launched—is certainly no exception.
These are the reasons why, even in the case of DDoS attacks, it is no longer possible to think solely in reactive terms; instead, we must adopt a proactive approach that combines prevention, protection, and mitigation of attacks: after all, it’s not all that different from how we deal with other online threats.
Let’s take a look at what a DDoS attack is, what the most common types are, and how to effectively protect IT systems from this cybersecurity threat.
What is a DDoS or Denial of Service attack
A denial-of-service (DoS) attack aims to prevent legitimate users from accessing IT resources by overwhelming them with such a high number of simultaneous requests that they cannot be managed in any way, effectively rendering the target unusable.
The systems most frequently taken offline by DDoS attacks are email services, websites, banking and financial services, government services, and, in general, any other type of service made available via servers over a network.
It is clear that organizations affected by a denial-of-service attack—as the term itself suggests—suffer damage the very moment they find themselves in a state of “denial of service,” that is, unable to provide IT services correctly and efficiently, whether internally or in relation to services intended for end customers.
What is the purpose of a DDOS attack?
The motivations that drive various types of cybercriminals to launch their DDoS attacks are quite diverse. Very often, these attacks are carried out by groups and collectives linked to hacktivism, whose protest actions aim to strike a target deemed ideologically unacceptable, in order to send a striking alternative message, often using the victim’s own channels.
There is no shortage of attacks carried out for financial gain, for the purpose of extortion, or on behalf of an organization seeking to target a rival, or even at the nation-state level, where some governments covertly fund cybercriminal organizations to target important strategic and operational objectives of rival nations—such as utilities and critical infrastructure—causing them significant harm.
In other cases, in a manner similar to hacktivism, there are individuals who act out of a sense of technical prowess, seeking to highlight vulnerabilities in the victim’s systems, often with the sole intent of making a point.
The different types of DDOS attacks
Although they all share the same objective, there are many types of DDoS attacks, which differ both in terms of the systems they target and the technologies and methods used to carry them out.
Generally speaking, there are three main types of DDoS attacks: volumetric, protocol-based, and application-level. However, let’s take a broader look to gain a comprehensive understanding of the mechanisms behind DDoS attacks and the behavior of cybercriminals.
Volumetric DDoS attack
This is the most well-known type of DDoS attack, which seeks to render a network unusable by flooding it with an enormous amount of data traffic, thereby congesting the bandwidth and effectively preventing legitimate users from accessing it. The services themselves are functioning, but they cannot be accessed because the network bandwidth is saturated.
Among the most common volumetric attacks are reflection attacks and amplification attacks.
The disruptions caused by a volumetric DDoS attack are typical of a service disruption and can result in economic losses if the victim is an e-commerce system that ends up losing orders; harm to citizens, who are unable to access public services, such as social and health care services; harm to businesses and professionals who are locked out of their online bank accounts, with the real risk of being unable to complete necessary transactions in a timely manner. These are just a few of the most common scenarios.
Such attacks—as we will see in detail when discussing how a DDoS attack works—are carried out by exploiting botnets, networks of individual devices—known as “zombies”—that are unaware they are being controlled by cybercriminals. These devices send individual requests to the victim’s network, whose bandwidth is easily saturated, resulting in the effects described above.
Application-level DDoS attack
An application-layer DDoS attack is easily recognizable because it targets only one or more specific applications, without necessarily affecting the network used to access them. These are otherwise known as Layer 7 DDoS attacks, in reference to the seventh layer of the ISO/OSI model, which pertains specifically to applications.
Difficult to prevent and far from easy to mitigate, application-layer DDoS attacks are also among the most common and easiest to carry out, partly because they typically require fewer botnet resources on average than volumetric attacks. As a result, they can last a long time and be extremely difficult to recover from.
DDoS attack on protocols
Another type of DDoS attack is capable of specifically targeting protocols in an attempt to compromise the processing capacity of the resources that make up the network infrastructure—such as servers and firewalls—thereby rendering the victim’s system inaccessible. The magnitude of these attacks is measured in packets per second (pps) or bits per second (bps). Among the most common protocol-based DDoS attacks are the SYN flood and the Smurf DDoS.
DDoS SYN flood attack
During the attack, clients controlled by cybercriminals send large numbers of SYN (synchronization) packets without the SYN-ACK (synchronization acknowledgment) packet, which is essential for completing the TCP (Transmission Control Protocol) handshake. This process easily causes the system to crash, as the server remains waiting for a response that is deliberately withheld and is unable to close the TCP connections, which exhaust the system’s capacity to accept new communication requests.
DDoS attack on protocols
Another type of DDoS attack is capable of specifically targeting protocols in an attempt to compromise the processing capacity of the resources that make up the network infrastructure—such as servers and firewalls—thereby rendering the victim’s system inaccessible. The magnitude of these attacks is measured in packets per second (pps) or bits per second (bps). Among the most common protocol-based DDoS attacks are the SYN flood and the Smurf DDoS.
Smurf DDoS Attack
A Smurf DDoS attack involves sending large quantities of ICMP (Internet Control Message Protocol) packets into the network with a maliciously forged source IP address that matches that of the targeted victim. All devices that receive these packets are, of course, unaware of the malicious intent and respond to the source IP address, gradually overwhelming its processing capacity.
DDoS UDP flood attack
UDP flood DDoS attacks are used to target networks with particularly high bandwidth by sending forged IP packets containing stateless UDP protocols, which overwhelm the victim’s host, causing it to automatically return a “destination unreachable” message. Once a certain threshold is exceeded, the victim’s system can no longer respond to requests—whether legitimate or not—thereby rendering the services provided to legitimate users inaccessible as well.
DDoS attack on DNS
This particular type of DDoS attack involves a DNS (Domain Name System) reflection attack, in which cybercriminals spoof the victim’s IP address to send massive amounts of requests to DNS servers; the responses from these servers then overload the victim’s system.
How a DDOS attack works
As we have examined from various perspectives, a DDoS attack employs various methods and vectors to overload the IT resources of a target system, with the aim of making its services inaccessible to legitimate users. But what are these vectors? How do they manage to send such large amounts of data—enough to overwhelm even the most robust infrastructure if it isn’t adequately protected?
To launch a DDoS attack, cybercriminals use a botnet—a network of devices known as bots or zombies because they are controlled remotely via malware.
The logic behind how a botnet is built seems fairly simple, although managing it is anything but straightforward. Cybercriminals exploit vulnerabilities in devices connected to the network to install malware, which remains active in the system with the aim of evading detection by any active anti-malware software.
The harmful presence of a botnet—if limited solely to this purpose—does not in itself cause performance issues, since it operates in the background most of the time with a low-priority process. This makes botnet agents difficult to detect.
Once the botnet has been created, cybercriminals can use the zombie devices to launch DDoS attacks, thanks to the firepower provided by many thousands of devices that can be activated within a short period of time—a strategy designed to catch the victim off guard and leave them as little time as possible to react, before their systems fail due to the excessive workload required to handle the enormous number of requests received.
Botnets enable cybercriminal organizations to develop new business models based on service-oriented models, making them available to third parties or acting on commission to achieve specific objectives, such as attacking specific victims.
Identifying an attack
In the early stages, DDoS attacks do not exhibit symptoms that are significantly different from those associated with technical issues, such as a certain slowness in network performance—whether in general traffic or when opening files. In other cases, users may experience difficulty accessing websites, which can escalate to obvious problems with Internet browsing. In the most extreme cases, the attack makes it virtually impossible to carry out any activity under normal conditions.
To detect and identify a DDoS attack before its effects have reached an advanced stage, it is necessary to implement a system for monitoring and analyzing network traffic, for example, by routing the traffic through a next-generation firewall equipped with artificial intelligence-based features that automatically recognize anomalous patterns, such as a high number of access attempts from IP addresses that differ from normal conditions.
If you have a traditional firewall, it is still advisable to have an intrusion detection system (IDS) active on the network that can perform a similar function. Administrators can set rules that are more or less restrictive to minimize false alarms, without, however, underestimating the risks of a potential DDoS attack.
Monitoring systems, such as modern SIEMs, are comprehensive tool platforms that work together to detect and identify potential threats originating from the network through behavioral analysis, which is based on various activities, including:
- An IP range that makes many requests in a short period of time;
- Demands from certain types of devices, operating systems, browsers, or geographic location, especially if the latter does not coincide with one’s target audience;
- Communication problems with servers, or error messages due to overload or maintenance
- Sudden increases in network bandwidth utilization and particular, as well as unexpected, spikes in traffic, especially when directed to a single active resource on a specific server, as in the case of a website.
Through behavioral analysis, a monitoring system is able to identify the type of a suspected attack and automatically trigger the necessary procedures to ensure the security of the systems under attack.
In other words, these are operations that it is now impossible to imagine performing manually. Preventing a DDoS attack requires specific systems capable of analyzing logs and automating a large number of tasks, with real-time visibility into what is happening on IT systems. Furthermore, these operations should always be accompanied by regular oversight from cybersecurity experts, whose expertise is essential in selecting and configuring the technologies used.
How to defend against a DDOS attack
Defense against a DDoS attack relies largely on prevention, precisely because its stealthy nature makes it very difficult to detect in its early stages, when it is still possible to successfully implement mitigation measures. This is the case with redirecting requests to the IP addresses of virtual servers—which are different from that of the actual target—thereby preventing the overload that the attacker intends to cause in order to render the available resources unusable.
The technical diversity and constantly evolving tactics of cybercriminals make defending against DDoS attacks a truly compelling challenge for corporate cybersecurity professionals, who are tasked with ensuring the very survival of their organizations.
Among the best practices for defending against DDoS attacks, it is advisable to consider risk assessment, traffic differentiation, black hole routing, bandwidth limiting, and, more generally, the use of firewall technologies capable of analyzing data packets, taking into account all seven layers of the ISO/OSI model.
This aspect appears to be of vital importance, since a great many cybersecurity attacks—not just Denial-of-Service attacks—are now carried out at the application layer (ISO/OSI Layer 7), whereas traditional firewalls provide effective protection only for the first four ISO/OSI layers, since they primarily focus on closing ports and blocking IP addresses without interpreting the content of network traffic in real time.
Among the most effective firewall technologies for defending against DDoS attacks are NGFWs (Next-Generation Firewalls) and WAFs (Web Application Firewalls). WAFs act as reverse proxies between the internet and the servers they are designed to protect, and are equipped with intelligent technologies to monitor traffic in real time, identifying potentially suspicious activity.
As for mitigation, as previously noted, one of the most effective methods is to redirect requests to multiple virtual servers, thereby protecting the actual target from the overload that would otherwise be devastating.
If you want to be guided by us, find out about our services
