What Is a DDoS Attack and How to Stop it?

  • By David Lukic
  • Published: Mar 09, 2021
  • Last Updated: Mar 18, 2022

 Most people have heard the term Distributed Denial-of-Service Attack (DDoS), but most don’t really know what it is a DDoS and why it is so dangerous. Cybercriminals have used DDoS attacks for many years, but they are becoming more prevalent and more destructive. The goal is to overwhelm the service with more traffic than the system can handle so that it crashes. Hackers target web services, websites, and online applications with DDoS attacks.

What is a DDoS Attack?

A DDoS attack is when hackers attempt to crash a website or service and prevent it from reaching its destination (device, apps, networks, computer, server, etc.).

Often hackers use fake packets, email messages, or dozens of requests for connections to create abundant traffic, which then crashes the service. In more recent attacks, the threat actors demand ransom to stop bombarding the service with junk. They may also threaten a more severe attack if the company does not pay up.

According to Norton Antivirus, a hacker group named Armada Collective attacked banks, DNS, and web host companies using this tactic.

What is a DDoS Attack?

How Does DDoS Work?

The premise of a DDoS attack is quite simple. If a web host server, application, device, network, or service is flooded with too much network traffic, it is crippled and stops working. Basically, the service becomes overwhelmed and shuts down due to too many concurrent requests.

Norton Antivirus explains it well with:

“Network connections on the Internet consist of different layers of the Open Systems Interconnection (OS) model. Different types of DDoS attacks focus on particular layers. A few examples:

  • Layer 3, the Network layer. Attacks are known as Smurf Attacks, ICMP Floods, and IP/ICMP Fragmentation. 
  • Layer 4, the Transport layer. Attacks include SYN Floods, UDP Floods, and TCP Connection Exhaustion.
  • Layer 7, the Application layer. Mainly, HTTP-encrypted attacks.”

The most efficient way a cybercriminal group executes a DDoS attack nowadays is using botnets. Using malicious software, these hackers take control of other people’s computers, servers, and IoT devices and use them as “bots” or “zombie computers” performing tasks sent by the central controller. When enough of these computer devices are connected, they form a network of sorts called a botnet. Bad actors use these botnets to send communication requests to the same target all at once, overwhelming it until it crashes and stops working. In some instances, hackers have millions of devices connected. IoT devices are not as well secured and make great targets for a botnet. Things like baby monitors, home security cameras, smart TVs, printers, and even remotes are ideal for hacker takeovers.

These botnets are used for other nefarious tasks along with DDoS attacks.

The Different Types of a DDoS Attack

There are basically three types of DDoS attacks, one that exploits each layer.

  • A volume-based attack using ICMP, UDP, and spoofed-packets is employed to flood servers and overwhelm them until they break down and stop working.
  • A network-layer or protocol-layer attack sends massive numbers of fake packets directly to the network server administration or management tools. These types use SYN floods and Smurf DDoS.
  • An application-layer attack floods an application with malware requests to get it to stop working

The goal for any of these types of attacks is to crash the service and render it inoperable. In some cases, it may only make it slower and less responsive but not totally unusable.

The Different Types of a DDoS Attack
 

DDoS Attacks Examples

Probably the most famous DDoS attack was carried out by Michael Calce in 2000, a Canadian high schooler. The teenager nicknamed himself MafiaBoy and, using a sophisticated DDoS attack, managed to shut down Yahoo, CNN, Amazon, and eBay. Calce was charged and convicted in Montreal and later became a white-hat hacker working for the good guys identifying vulnerable systems for large, national companies.

In 2016, Dyn, a large domain name provider, was attacked by a massive DDoS event which also took down a lot of heavy-hitting websites like AirBnB, CNN, Netflix, PayPal, Spotify, Visa, Amazon, The New York Times, Reddit, and GitHub. During this attack, hackers used more than 100,000 infected botnet devices to send requests from tens of millions of IP addresses.

GitHub was hit hard with a massive DDoS attack in 2018. However, they were able to recover quickly (within 20 minutes) and were back up and running.

Over the past few years, cybercriminals have targeted huge companies, gaming organizations, software, and media conglomerates for DDoS attacks.

Sometimes DDoS attacks are used as a diversion so that while everyone is figuring out how to fix the unresponsive servers, hackers go to town installing malicious software and creating other problems such as perpetrating a data breach.

In other cases, these types of attacks are used by activists, other countries trying to disrupt U.S. government services, and sometimes they are just for show.
 

About the Author
IDStrong Logo

Related Articles

Secure Wi-Fi and Wireless Technology Security Tips

Your Wi-Fi network is another handy access point that hackers use to infiltrate your computers, st ... Read More

How Does a VPN Work and How to Choose one

VPN stands for virtual private network. It allows you to hide your public IP address and browse pr ... Read More

Complete Guide to Android Security

The Android platform offers a ton of flexibility and customization for users. However, all that fr ... Read More

Increase Your Google Privacy Settings in 4 Easy Steps

In this time of digital transparency and data breaches, it’s more important than ever to fee ... Read More

Instagram Privacy Policy: What You Should Know?

Instagram is a great place to share your best photos and messages with your followers, but have yo ... Read More

Latest Articles

Avoiding Scams During the 2024 Paris Olympics

Avoiding Scams During the 2024 Paris Olympics

Breakdancing is coming to the world stage while French citizens stage a creative protest with the hashtag "JeChieDansLaSeineLe23Juin.

What is a Brute Force Attack in Cybersecurity and How to Prevent it

What is a Brute Force Attack in Cybersecurity and How to Prevent it

In the world today, there is a plethora of critical data circulating the internet, leading to complex attacks like brute force attacks.

Watering Hole Attacks: What They Are and How to Prevent Them

Watering Hole Attacks: What They Are and How to Prevent Them

Hackers often lurk around the most popular websites, looking for ways to exploit users. These sites include ticket purchasing, travel, e-commerce, and banking.

Featured Articles

How to Buy a House with Bad Credit

How to Buy a House with Bad Credit

Buying your own home is the American Dream, but it might seem out of reach to those with bad credit. However, the good news is, if your credit is less than perfect, you do still have options and in most cases, can still buy a home.

How Secure Is Your Password? Tips to Improve Your Password Security

How Secure Is Your Password? Tips to Improve Your Password Security

Any good IT article on computers and network security will address the importance of strong, secure passwords. However, the challenge of good passwords is that most people have a hard time remembering them, so they use simple or obvious ones that pose a security risk.

Top 10 Senior Scams and How to Prevent Them

Top 10 Senior Scams and How to Prevent Them

Senior scams are becoming a major epidemic for two reasons. First, seniors often have a lot of money in the bank from a life of working hard and saving.

Notice

By proceeding with this scan, you agree to let IDStrong run a Free Scan of supplied parameters of your personal information and provide free preliminary findings in compliance with our Terms of Use and Privacy Notice. You consent to us using your provided information to complete the Free Scan and compare it against our records and breach databases or sources to provide your Free preliminary findings report.

Rest assured: IDStrong will not share your information with third parties or store your information beyond what is required to perform your scan and share your results.

Free Identity Threat Scan
Instantly Check if Your Personal Information is Exposed
All fields below are required
Please enter first name
Please enter last name
Please enter a city
Please select a state
Please enter an age
Please enter an email address
Close