{"id":11618,"date":"2020-11-02T16:01:00","date_gmt":"2020-11-02T21:01:00","guid":{"rendered":"https:\/\/www.thesslstore.com\/blog\/?p=11618"},"modified":"2021-04-22T16:05:06","modified_gmt":"2021-04-22T20:05:06","slug":"what-is-a-ddos-attack","status":"publish","type":"post","link":"https:\/\/www.thesslstore.com\/blog\/what-is-a-ddos-attack\/","title":{"rendered":"What Is a DDoS Attack?"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\" id=\"h-a-distributed-denial-of-service-ddos-attack-is-kind-of-like-a-traffic-jam-on-a-website\">A distributed denial of service (DDoS) attack is kind of like a traffic jam\non a website<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">What is a DDoS attack and what does it mean for your website? Instead of jumping deep into technical details, let\u2019s start with a real-world analogy that makes it really easy to visualize what the meaning of a DDoS attack is\u2026<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Imagine, for a moment, that it\u2019s a Sunday afternoon and\nyou\u2019re driving down the highway with your family, headed to your favorite\npicnic spot. You\u2019re cruising down the highway at 70 miles an hour \u2013 it won\u2019t be\nlong before you\u2019re at the park enjoying a lovely autumn day!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2026That is, until you go around a curve and see this in front\nof you:<\/p>\n\n\n\n<figure class=\"wp-block-image is-style-default\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"600\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/traffic-jam.jpg\" alt=\"DDoS attack traffic jam\" class=\"wp-image-11619\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/traffic-jam.jpg 900w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/traffic-jam-300x200.jpg 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/traffic-jam-768x512.jpg 768w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It\u2019s a traffic jam \u2014 going as far as the eye can see!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You check your GPS traffic report, only to see that the jam\nextends for miles and there\u2019s no way around it. There\u2019s no way you\u2019ll make it\nto the park in time for your picnic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That\u2019s basically what a distributed denial of service (DDoS)\nattack is \u2013 lots of users (in this case, cars) that are jamming up a system\n(the highway) to deny you from accessing a service (the park).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Usually when we talk about DDoS attacks, the resource being\ndenied is a website and the \u201ctraffic jam\u201d was maliciously caused by a hacker. But\nthe concept is the same as a traffic jam on the highway. Let\u2019s dive into what\nDDoS means, the types of DDoS attacks, and methods of DDoS prevention.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Let\u2019s hash it out.<span id=\"newline\"><\/span><\/p>\n\n\n<span style=\"display:none\" class=\"tl-placeholder-f-type-shortcode_12753\"><\/span>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-what-is-a-ddos-attack-a-simple-definition\">What is a DDoS Attack? A Simple Definition<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Since we\u2019re all about making technical topics simple, let\u2019s start with a basic answer to the question: What does DDoS mean (a.k.a. \u201cWhat is a distributed denial of service attack\u201d)?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As mentioned above, a DDoS attack is a bit like a traffic jam on a website (but it\u2019s intentionally caused by a hacker).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Here\u2019s a simple definition for the meaning of DDoS:<\/strong><\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>A DDoS (distributed-denial-of-service) attack is when a hacker makes a website or other service inaccessible by flooding it with requests from many different devices.<\/em><\/p><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">If you\u2019ve also heard the term \u201cDoS attack,\u201d don\u2019t let that confuse you. A DDoS attack is just a specific type of DoS (denial-of-service) attack \u2014 one that uses multiple computers\/devices to attack with.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here&#8217;s a short video that explains a bit further&#8230;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<iframe loading=\"lazy\" title=\"What is a DDoS Attack?\" width=\"960\" height=\"540\" src=\"https:\/\/www.youtube.com\/embed\/z503nLsfe5s?feature=oembed\" frameborder=\"0\" allow=\"accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture\" allowfullscreen><\/iframe>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-does-a-ddos-attack-work-hint-it-involves-zombies\">How Does a DDoS Attack Work? (Hint: It Involves Zombies!)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Just like a traffic jam floods a highway with more cars than\nit can handle, a DDoS attack floods a website with more requests (i.e.\nvisitors) than the web server or other related systems can handle.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many hackers use botnets (a.k.a. zombie computers) to execute\nDDoS attacks. A botnet is a way for a single person (hacker) to control\nthousands of devices at once.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"615\" src=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-1024x615.png\" alt=\"what is ddos botmaster\" class=\"wp-image-11628\" srcset=\"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-1024x615.png 1024w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-300x180.png 300w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-768x461.png 768w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-698x419.png 698w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-400x240.png 400w, https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster-460x276.png 460w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s how a botnet works to execute a DDoS attack:<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-step-1-building-the-botnet\">Step 1: Building the Botnet<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To create a botnet, a hacker needs a way to take control of\nthousands of devices \u2014 these could be computers, mobile phones, or IoT devices such\nas webcams or smart refrigerators. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are quite a few ways the hacker could find and take\ncontrol of these devices. For example, they might write a virus that propagates\nand gradually takes over more and more computers. Or, they might find a\nspecific IoT device with a known vulnerability (for example, poor default login\nsecurity) and build a bot to scan the internet and hack as many of those devices\nas possible. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you want to read more about how hackers do this, check\nout our post on <a href=\"https:\/\/www.thesslstore.com\/blog\/hacking-iot-devices-create-botnet-refrigerators\/\">Hacking\nIoT Devices: How to Create a Botnet of Refrigerators<\/a>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-step-2-controlling-the-botnet\">Step 2: Controlling the Botnet<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">As the hacker takes control of each device, they\u2019ll do\nsomething so it will obey any instructions the hacker sends to the device. (For\nexample, installing a small program on it.) <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are a few different approaches the hacker can use\n(client-server model, P2P model based on digital certificates, etc.), but the\nend result is the same \u2014 the hacker can issue a command and all the devices in\nthe botnet will do whatever the hacker instructed them to do. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-step-3-executing-the-attack\">Step 3: Executing the Attack<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once the hacker has thousands of devices at his beck and\ncall, he can execute the DDoS attack. There are a few different types of DDoS\nattacks (more on that later), but the basic idea is the same: flood a web\nserver with more requests than it can handle.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attacker will typically research the target website carefully\nto identify a weakness to exploit, then craft a request that will target that\nvulnerability. Finally, the attacker will instruct their zombie computers to\nexecute that request (repeatedly).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here\u2019s an example: Let\u2019s say Bob\u2019s botnet has 100,000\ndevices in it. He issues a command to the botnet to send an HTTP request to\nexample.com once per second. That\u2019s 60 visits per minute times 100,000 devices.\nThat adds up to 360 million visits per hour, or 8.6 billion visits per day.\nThat\u2019s far more than most web servers are designed to handle. If the attack was\nplanned well, the web server will be overloaded and any real people who try to\nvisit the site will get an error message. DDoS attack success!<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-ddos-the-lazy-way-rent-a-botnet\">DDoS the Lazy Way: Rent a Botnet!<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If it sounds like a lot of work to build a botnet and\nexecute a DDoS attack, you\u2019d be right. But (unfortunately) there\u2019s an easier\nway \u2014 lazy attackers can just go on the dark web and <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/ddos-attacks-are-10-per-hour-on-the-dark-web\/\">rent\na botnet for as little as $10 per hour<\/a>! <a href=\"https:\/\/www.thesslstore.com\/blog\/2018-cybercrime-statistics\/\">Cybercrime<\/a>\nis a booming industry, and services such as DDoS botnet rentals and <a href=\"https:\/\/www.thesslstore.com\/blog\/phishing-as-a-service-turn-key-phishing-kits\/\">phishing\nas a service<\/a> solutions are just a few of the options available for purchase.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-types-of-ddos-attacks\">Types of DDoS Attacks<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Our simplified definition of what DDoS is left out one detail: there are many different types of DDoS attacks that attackers can use depending on what specific server resource they\u2019re trying to overload. Since we\u2019re trying to keep things simple, we\u2019ll just briefly highlight the broad types of DDoS attacks commonly used.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As mentioned previously, DDoS attacks are designed to jam up a website, usually by overloading a specific aspect of the site. For example, an attack could target the following to overload them:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Web server resources such as CPU or RAM<\/li><li>Database servers<\/li><li>Network bandwidth<\/li><li>DNS servers<\/li><li>Etc.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">&nbsp;As Gregory Kelley, chief\ntechnology officer at <a href=\"https:\/\/www.vestigeltd.com\/\">Vestige Digital\nInvestigations<\/a>, explains:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u201cDDoS attacks can be categorized as either volume based or application based. Volume based attacks will attempt to flood a website, server or internet connection with more traffic than it can handle. Application based attacks usually look to exploit a vulnerability or defect in a protocol to tie up a specific service, such as a website.\u201d<\/em><\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-the-motive-behind-the-attack-why-do-hackers-ddos\">The Motive Behind the Attack: Why Do Hackers DDoS?<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p><em>&#8220;Some men aren&#8217;t looking for anything logical, like money. They can&#8217;t be bought, bullied, reasoned, or negotiated with. Some men just want to watch the world burn.&#8221;<\/em> <\/p><cite> Alfred Pennyworth, The Dark Knight <\/cite><\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes, DDoS attacks have a direct goal in mind (such as\nmoney). In other cases, people just want to cause trouble and feel powerful.\nGregory Kelley explains that the top reasons he sees are:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Financial gain.<\/strong> The hacker may be seeking\nto hold a company at ransom \u2013 demanding that they pay money to stop the attack.<\/li><li><strong>Diversion.<\/strong> Another reason is to distract\na company\u2019s cyber defenses so that the hacker can try to infiltrate the company\nin another fashion.<\/li><li><strong>Hacktivism.<\/strong> The hacker could be doing it\nto protest actions on the part of a company or government (such as <a href=\"https:\/\/www.ohio.com\/news\/20191003\/akron-man-sentenced-to-6-years-in-federal-prison-for-attacking-akrons-website\">the\ncase of James Robinson<\/a>).<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-are-ddos-attacks-illegal\">Are DDoS Attacks Illegal?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Short answer: yes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Slightly longer answer: The specific laws around DDoS vary depending\non where you\u2019re located. Some countries have lax laws (or insufficient\nenforcement), so DDoS attackers may operate out of those countries.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the U.S., DDoS attacks are illegal under the Federal\nComputer Fraud and Abuse Act. The punishment can be substantial, too \u2014 up to 10\nyears of prison and up to $500,000 in fines. In fact, <a href=\"https:\/\/krebsonsecurity.com\/2019\/01\/courts-hand-down-hard-jail-time-for-ddos\/\">a\nman from Connecticut recently got a 10-year prison sentence for DDoS attacks\nagainst hospitals<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Identifying and prosecuting attackers is often complex,\nsince the attacks commonly span multiple countries. As Maria Sirbu from <a href=\"https:\/\/www.voxility.com\/\">Voxility<\/a> explains:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-style-default is-layout-flow wp-block-quote-is-layout-flow\"><p><em>\u201cDDoS attacks often involve tools from several countries: the target IP is located in one country, the attacker is located in another, the command and control servers are in a different country, and the bots used in DDoS attacks come from multiple places. For this reason, investigating attacks, blocking botnets and discovering attackers has become serious business.\u201d<\/em><\/p><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-ddos-mitigation-what-you-can-do-if-you-re-attacked\">DDoS Mitigation: What You Can Do If You\u2019re Attacked<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As DDoS attacks are <a href=\"https:\/\/www.thesslstore.com\/blog\/largest-ddos-attack-in-history\/\">becoming\nbigger and more common<\/a>, the tools we have to fight back have gotten better,\ntoo. Now even the smallest businesses can get good DDoS prevention solutions.\n(Although most DDoS attacks still target larger companies.)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here are a few tactics any website owner can implement to\nprotect their site:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Contact your web host to find out what their\npolicies and protections are against DDoS.<\/li><li>Contact your DNS provider to see if they protect\nagainst DNS flood attacks.<\/li><li>Use a content delivery network (CDN) with a web\napplication firewall (WAF) and DDoS protection built in. Essentially, the CDN\nsits between the attacker and your web server, so it can dilute and\/or block\nthe attack before it reaches your web server.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">As always, leave any questions or thoughts in the comments!<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A distributed denial of service (DDoS) attack is kind of like a traffic jam on a website What is a DDoS attack and what does it mean for your website?&#8230;<\/p>\n","protected":false},"author":23,"featured_media":11628,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[3803,150],"class_list":["post-11618","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-ddos","tag-ddos-attacks","post-with-tags"],"views":52524,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2019\/10\/what-is-ddos-botmaster.png","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=11618"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/11618\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/11628"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=11618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=11618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=11618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}