distributed denial of service (DDoS) attack

Contributor(s): Kevin Beaver

A distributed denial-of-service (DDoS) attack is an attack in which multiple compromised computer systems attack a target, such as a server, website or other network resource, and cause a denial of service for users of the targeted resource. The flood of incoming messages, connection requests or malformed packets to the target system forces it to slow down or even crash and shut down, thereby denying service to legitimate users or systems.

DDoS attacks have been carried out by diverse threat actors, ranging from individual criminal hackers to organized crime rings and government agencies. In certain situations, often ones related to poor coding, missing patches or generally unstable systems, even legitimate requests to target systems can result in DDoS-like results.

How DDoS attacks work

In a typical DDoS attack, the assailant begins by exploiting a vulnerability in one computer system and making it the DDoS master. The attack master system identifies other vulnerable systems and gains control over them by either infecting the systems with malware or through bypassing the authentication controls (i.e., guessing the default password on a widely used system or device).

A computer or networked device under the control of an intruder is known as a zombie, or bot. The attacker creates what is called a command-and-control server to command the network of bots, also called a botnet. The person in control of a botnet is sometimes referred to as the botmaster (that term has also historically been used to refer to the first system "recruited" into a botnet because it is used to control the spread and activity of other systems in the botnet).

Botnets can be comprised of almost any number of bots; botnets with tens or hundreds of thousands of nodes have become increasingly common, and there may not be an upper limit to their size. Once the botnet is assembled, the attacker can use the traffic generated by the compromised devices to flood the target domain and knock it offline.

Types of DDoS attacks

There are three types of DDoS attacks. Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol attacks target network layer or transport layer protocols using flaws in the protocols to overwhelm targeted resources. And application layer attacks overload application services or databases with a high volume of application calls. The inundation of packets at the target causes a denial of service.

While it is clear that the target of a DDoS attack is a victim, there can be many other victims in a typical DDoS attack, including the owners of the systems used to execute the attack. Although the owners of infected computers are typically unaware their systems have been compromised, they are nevertheless likely to suffer a degradation of service during a DDoS attack.

Internet of things and DDoS attacks

While the things comprising the internet of things (IoT) may be useful to legitimate users, in some cases, they are even more helpful to DDoS attackers. The devices connected to IoT include any appliance into which some computing and networking capacity has been built, and, all too often, these devices are not designed with security in mind.

Devices connected to the IoT expose large attack surfaces and display minimal attention to security best practices. For example, devices are often shipped with hard-coded authentication credentials for system administration, making it simple for attackers to log in to the devices. In some cases, the authentication credentials cannot be changed. Devices also often ship without the capability to upgrade or patch device software, further exposing them to attacks that leverage well-known vulnerabilities.

Internet of things botnets are increasingly being used to wage massive DDoS attacks. In 2016, the Mirai botnet was used to attack the domain name service provider Dyn, based in Manchester, N.H.; attack volumes were measured at over 600 Gbps. Another late 2016 attack unleashed on OVH, the French hosting firm, peaked at more than 1 Tbps.

DDoS defense and prevention

DDoS attacks can create significant business risks with lasting effects. Therefore, it is important for IT and security administrators and managers, as well as their business executives, to understand the threats, vulnerabilities and risks associated with DDoS attacks.

Being on the receiving end of a DDoS attack is practically impossible to prevent. However, the business impact of these attacks can be minimized through some core information security practices, including performing ongoing security assessments to look for -- and resolve -- denial of service-related vulnerabilities and using network security controls, including services from cloud-based vendors specializing in responding to DDoS attacks.

In addition, solid patch management practices, email phishing testing and user awareness, and proactive network monitoring and alerting can help minimize an organization's contribution to DDoS attacks across the internet.

This was last updated in April 2019

Continue Reading About distributed denial of service (DDoS) attack

Dig Deeper on DDoS attack detection and prevention

Join the conversation


Send me notifications when other members comment.

Please create a username to comment.

Have you experienced a DDoS attack? How did you respond?
Denial of service attack may not be distinguishable from real requests. Sometimes a spike in popularity of the web site causes the same effect as a malicious DDOS attack. In my 10 years of blogging a few times I indeed observed situations when rush of visitors made my blog serving 503s ("temporarily unavailable").
I seriously need help it’s taken my life over and I have seen him control my phone
What measures do you take to prevent, or minimize the impact of, distributed denial-of-service attacks?
Yes I can’t get away from it even after 30 phones in six months I need help and nobody will help me I don’t go out doors much cause f being followed and tracked I’ve seen this person my x control my phone my identy my credit school loans have been hit my fb of ten yrs they know everything about me I don’t know what to do
Someone please reach me at 9 3 7 6 2 4 7 1 6 2
So, what a pleasant image, the zombie army. Is there any way to detect if one's computer has become a zombie? Thanks for the overview anyway.
The software engineers who made Ufonet are simply evil people who are working for the American federalism. They made Ufonet intentionally buggy in order to work only on MACintosh platforms.  It does not work on Linux nor on Windows.  When one will try to install Python on MS-Windows the Python software will not setup a Path environment variable thus Ufonet will not work and there are no explanations about how to set it up correctly on MS-Windows. There are no distributions for the Linux operating system, there is only the source code.  Because the federal police is behind it than it becomes the work of the devil and those who think are doing something good are instead becoming zombies.  It is just a marketing trick to gain power with the federal police.  Be aware of the bad dog!
Can anyone help me I can’t get away from it and them I’m always followed I’ve seen him control my phone my phone is on my brain work vpn and so is my moms 1000 miles away I can’t even make calls to feds or cops please someone help me
Our customers do experience DDoS Attack before coming to us. Its mainly because they rely on DDoS Mitigation so much so that they think that DDoS Mitigation would never let the attack happens. Basically, DDoS Mitigation work only at the beginning and gradually fails because every-time the new changes are made in the network, mitigation is not properly configured. Leaving systems vulnerable to attacks. When we talk to such customer, we inform them that they need a solution which would integrate with existing DDoS Mitigation and will keep watch on DDoS Mitigation and your network configurations.
Very helpful article, thanks. I recently learned about this type of attack and I think that I was very lucky and my data was not affected. I believe that you have done a lot of work on studying such problems, because it seems to me after reading your article and this one that such attacks are the most dangerous threat to the data of ordinary users and even corporations.