DDoS attacks: what they are and how they work
DDoS attacks are one of the most dangerous threats in IT security. They are in fact able to render servers, data centres and various types of network totally unusable, all within a very short space of time (just a few minutes).
According to an authoritative source, the security experts and leading suppliers of CDN (content distribution networks) services Akamai, the entity of these attacks has increased, both in terms of quantity and size.
The objective of the hackers behind these attacks is to make network resources inaccessible. In order to do this, they attack individual websites, servers or DNS systems. They carry out these attacks for money or just for fun. In some cases, they launch an attack for so-called ‘good reasons’ (white-hat hacking).
DDos and DoS attacks; what are the differences?
DDos (Distributed Denial of Service) attacks are a particular type of DoS (Denial of Service) attack. The main purpose of the latter is to achieve the saturation of IT resources and the network of an individual IT system used to distribute specific types of service. In brief, DoS attacks focus on making specific sites inaccessible by saturating their communication bands.
DDoS attacks can be considered as a more powerful form of DoS attack. Their main peculiarity regards the fact that they do not affect just one single site, but make entire data centres inaccessible, similarly with content distribution networks or DNS services. The hackers who carry out these attacks can make use of a wide range of strategies and resources. Consequently, they can neutralise their target within a very short time period, usually just a matter of minutes. The damage caused by these attacks can be felt for days.
What you need to know about botnets
The term botnet refers to a fundamental part of the infrastructure of DDoS attacks. They are very dense networks of devices infected by malware or Trojans. All botnets are controlled remotely by either individual hackers or groups. They may also be defined as subdivisions of Internet nodes and can be used for various purposes. The main one is to carry out DDoS attacks. Up until a few years ago, infected devices were known as zombies.
The range of devices that can become part of a botnet is potentially very wide. It could affect a laptop or another device such as a smartphone or tablet. The list also includes IP security cameras, routers, smart TVs, network printers and smart thermostats.
DDoS attacks are powerful enough that any connectable device can be included in a botnet. That means that these networks can include smart appliances, cars and smart sensors. The Internet of Things, considered one of the main tech scenarios of the future, constitutes a fearful threat to IT security.
Types of DDoS attacks
DDoS attacks can be of various types, as follows:
- Attacks on the TCP connection;
- Volumetric attacks;
- Fragmentation attacks;
- Applicative attacks.
In the first case, the hackers exploit the peculiarity of the TCP protocol to quickly saturate the Internet resources of their target. In the second type, they saturate a communications band by sending a huge number of content access requests. Fragmentation attacks on the other hand, are aimed at consuming the calculation resources of the IT system under attack. In the case of applicative attacks, the hackers exploit flaws in the various apps to make servers or distribution networks inaccessible.
Translated by Joanne Beckwith
