EVERYTHING ABOUT DDoS ATTACK

A DDoS attack (Distributed Denial of Service) or in French "denial of service attack" is a computer attack consisting in targeting a computer system by flooding it with incoming messages or connection requests in order to cause a denial of service . Find out all you would like to understand about it.

The initials DDoS denote the term Distributed Denial of Service. In French, we mention a denial of service attack. This is a computer attack type of DOS (Denial Attack on Service) of attacking a computer system using a large number of hijacked computer systems (or intentionally used).

Examples of attacks

At the beginning of September, Wikipedia suffered an attack that affected its European infrastructure. The Spanish, French, Polish, Croatian, Austrian, German, British and Russian versions were not fully accessible. At the same time, Blizzard, the publisher of the World of Warcraft video game, reported a DDoS targeting the Classic version of the MMORPG. Again, users could not log in for several hours. Here, the targeted structures are not of vital importance. However, this causes great economic losses. In some cases, the targets are hospitals or administrations that manage sensitive data or operate critical services.

DDoS: How Do Denial of Service Attacks Work?

Typically, in a typical DDoS attack, the cybercriminal (DDoS Master) first takes control of many computer systems using malware or bypassing their security systems. It then creates a command-and-control type server. This one gives directives to its network of hijacked systems which one also calls botnet. Once the network is assembled, the DDoS Master can order his army to generate artificial traffic on the targeted system. It then sends a large number of requests to weaken its target, usually a web server.

How Do You Know If You Have A DDoS?

The targeted computer system then experiences unusually high traffic from a large number of sources. Several hundred or even several thousand hijacked systems can request the targeted system simultaneously. This causes a denial of service. That is, the service becomes unavailable for its legitimate users.

The use of a large number of hijacked systems makes the attack very difficult to ward off. It is impossible to stop the attack by blocking a single IP address. Moreover, distinguishing a legitimate user from a hijacked system is very difficult

In some cases, it should be noted that the computer systems used to request the targeted system are not always hijacked. It happens that a large number of Internet users voluntarily join the cause of a cybercriminal and all attack the same system simultaneously to cause the denial of service. However, when a system is well encoded, updated, stable and secure, legitimate requests are not expected to cause a denial of service.

What Are The Different Types Of DDoS Attacks?

There are many different types of DDoS attacks. There are, however, three main categories. The attack traffic (traffic attacks) are the most common. They consist in sending an immense volume of TCP, UDP and ICPM packets to the target. Thus, legitimate requests are lost. These attacks can be carried out through the exploitation of malware.

The attacks of bandwidth are to overload the target of unnecessary data. This causes a loss of bandwidth and of the resources necessary for its operation, causing a denial of service.

Finally, application attacks consist in sending large numbers of messages to the targeted application to consume its resources, making the resources of the target system unavailable.

How to Avoid Them?

In an article published on the ANSSI website, the authority shares a document in which there are means to reduce the effects of DDoS. One of the solutions is to deploy filtering equipment at the edge of an information system. However, this only partially protects the company. If the attacks exceed the capabilities of the network links then the attacker can make their way. Equipment capable of offering this partial protection are, for example, firewalls.

Specialized equipment is also used which allows specific filtering rules to be established and requests to be limited. Unfortunately some countermeasures are not directly applied. This extended response time of a few minutes is enough to cause extensive damage.