DDoS Attacks

Distributed Denial of Service Attack (DDoS) Definition

A distributed denial of service (DDoS) attack is a malicious attempt to make an online service unavailable to users, usually by temporarily interrupting or suspending the services of its hosting server.

A DDoS attack is launched from numerous compromised devices, often distributed globally in what is referred to as a botnet. It is distinct from other denial of service (DoS) attacks in that it uses a single Internet-connected device (one network connection) to flood a target with malicious traffic. This nuance is the main reason for the existence of these two somewhat different definitions.

This is part of an extensive series of guides about hacking

“And that concludes our DDoS party: Escapist Magazine, Eve Online, Minecraft, League of Legends + 8 phone requests.” Tweeted by LulzSec – June 14, 2011, 11:07PM

Broadly speaking, DoS and DDoS attacks can be divided into three types:

Common DDoS Attack Types

While a DDoS attack intends to disrupt some or all of its target’s services, not all DDoS attacks are the same. They feature unique characteristics, methods, and attack vectors. There are three common types of DDoS attacks:

• Volumetric (Gbps)
• Protocol (pps)
• Application layer (rps) attacks.

Since these three are categorized as DDoS attacks, the terms are often confused or used interchangeably by accident. Complicating matters, there are times when these types of DDoS attacks overlap during a single attack to generate greater impact.

Attackers don’t make clean distinctions between these three types of DDoS attacks. Their goal is to disrupt your business. When attacking their target, they’ll combine volumetric, protocol, and application layer attacks into a multi-vector attack. Multi-vector attacks hit the target in varying forms and disrupt the processes at a higher level.

What is a Gbps or Volumetric DDoS Attack

A volumetric DDoS attack is what most people associate with the term “DDoS” because it is the most common. The first volumetric DDoS attack made headlines in the late 1990s and has since spawned an army of copycats.

Volumetric attacks can also be called “floods” because an attack floods a target’s server with requests, like unwanted pings. Attacks are measured in bits per second (bps) or Gigabits per second (Gbps).

The concept of a volumetric attack is simple: send as much traffic as possible to a site to overwhelm the server’s bandwidth. Volumetric attacks are typically produced using amplification techniques. DNS amplification is one of the more common techniques attackers use to carry out a volumetric attack. The bad actor sends small DNS requests with the victim’s spoofed source IP address to a DNS server. When the server receives the request, it responds to the victim with a large response.

Attackers also create volumetric attacks using botnets made up of exploited IoT devices. Connected devices usually lack basic security defenses, but because they’re connected to the Internet and can execute code, they can be easily exploited.

The proliferation of cheap IoT devices like toys, small appliances, thermostats, security cameras, and Wi-Fi routers makes it easy to launch an effective attack with just a few clicks. A hacker can easily leverage the extensibility of the internet to launch a successful volumetric DDoS attack with few resources.

The Mirai botnet is an example of the devastation of leveraged, unsecured IoT devices. Mirai targeted IoT devices, using each infected device to join a volumetric DDoS attack. It resulted in successful attacks against some of the world’s largest organizations.

What is a PPS or Network Protocol DDoS Attack?

An internet protocol is a discrete set of rules for exchanging information across the internet. TCP/IP is one of the most well-known rules for exchanging requests and data. A bad actor can severely disrupt an online service by exploiting these rules.

Protocol attacks often work at layers 3 and 4 of the OSI model on network devices like routers. Because they are on the network layer, they are measured in packets per second (pps).

Below is a sampling of different network-layer DDoS attack types:

• UDP floods
• SYN floods
• NTP amplification
• DNS amplification
• SSDP amplification
• IP fragmentation
• SYN-ACK floods

Examples of a Network Protocol DDoS Attack

• The ping of death (POD) is an IP fragmentation attack that exploits the inherent size limitation of a packet. By manipulating parts of the packet or fragments, the exploit can overflow the memory buffers allocated to that packet and then deny service to legitimate packets.
• A TCP SYN flood is another common protocol attack. Here, a surge of TCP SYN requests directed towards a target overwhelms the target and makes it unresponsive.

What is an RPS or Application Layer DDoS Attack

While volumetric attacks and — to a lesser extent — protocol attacks compromise a service with the sheer number of requests, application layer attacks, or layer 7 attacks, target an edge server that executes a web application.

These threats are harder to detect because attackers usually make requests like legitimate users. Consequently, these attacks often show up as smaller traffic spikes and do not require the assistance of a botnet.

Application layer attacks are measured in requests per second (RPS) — the number of requests an application makes. An application layer attack is considered a resource-based attack; therefore, it takes fewer requests to bring down an application because the attack is focused on overwhelming the CPU and memory.

An application layer attack typically includes hitting the web server, running PHP scripts, and contacting the database to load web pages. A single HTTP request, which is simple to execute on the client side, can cause a server to execute many internal requests and load numerous files to fulfill the request, which slows the system.

An application layer attack can also be a multi-vector attack that uses a combination of volumetric and protocol attacks to increase the likelihood of taking a service offline. Because of their complexity and effectiveness, multi-vector attacks are increasingly popular among cybercriminal groups.

The Motivation Behind DDoS Attacks

DDoS attacks are quickly becoming the most prevalent type of cyber threat, growing rapidly in the past year in both number and volume, according to recent market research. The trend is towards shorter attack duration but bigger packet-per-second attack volume.

Attackers are primarily motivated by:

• Ideology – So-called “hacktivists” use DDoS attacks to target websites they disagree with ideologically.
• Business feuds – Businesses can use DDoS attacks to strategically take down competitor websites, e.g., to keep them from participating in a significant event, such as Cyber Monday.
• Boredom – Cyber vandals, a.k.a. “script-kiddies,” use prewritten scripts to launch DDoS attacks. The perpetrators of these attacks are typically bored, would-be hackers looking for an adrenaline rush.
• Extortion – Perpetrators use DDoS attacks, or the threat of DDoS attacks, to extort money from their targets.
• Cyber warfare – Government-authorized DDoS attacks can be used to both cripple opposition websites and an enemy country’s infrastructure.LOIC (Low Orbit Ion Cannon): an “entry-level” DoS attack tool used for cyber vandalism

Imperva solutions mitigate DDoS damage

Imperva seamlessly and comprehensively protects websites against all three types of DDoS attacks, addressing each with a unique toolset and defense strategy:

Volume Based Attacks
Imperva counters these attacks by absorbing them with a global network of scrubbing centers that scale, on-demand, to counter multi-gigabyte DDoS attacks.

Protocol Attacks
Imperva mitigates this type of attack by blocking “bad” traffic before it even reaches the site, leveraging visitor identification technology that differentiates between legitimate website visitors (humans, search engines, etc.) and automated or malicious clients.

Application Layer Attacks
Imperva mitigates Application Layer attacks by monitoring visitor behavior, blocking known bad bots, and challenging suspicious or unrecognized entities with JS tests, Cookie challenges, and even CAPTCHAs.

Imperva mitigates a 250GBps DDoS attack—one of the Internet’s largest.

In all these scenarios, Imperva applies its DDoS protection solutions outside your network, meaning only filtered traffic reaches your hosts. Moreover, Imperva maintains an extensive DDoS threat knowledge base, which includes new and emerging attack methods. This constantly updated information is aggregated across our entire network – identifying new threats as they emerge, detecting known malicious users, and applying remedies in real time across all Imperva-protected websites.

See Additional Guides on Key Hacking Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of hacking.

Email Security

Authored by Perception Point

• Email Security: Threats, Solutions, and 10 Critical Best Practices
• Email Spoofing: How It Works, Detection and Prevention
• Characteristics of Best Email Security Solution

Cloud Security

Authored by Tigera

• Cloud Workload Protection Platforms (CWPP): A Complete Guide
• Cloud Security: Challenges and 5 Technologies That Can Help
• 4 Types of Cloud Firewalls and Why You Need Them

See how Imperva DDoS Protection can help you with DDoS attacks.

Request demo Learn more

Attack Surface

Authored by HackerOne

• What Is the Attack Surface – How to Analyze, Manage & Reduce It
• What Are Attack Vectors & 8 Ways to Protect Your Organization 
• What Is Attack Surface Management and a 5-Step ASM Process