DDoS attacks

DDoS attacks
Name	DDoS attack

DDoS attacks are a type of cyberattack in which an attacker attempts to make a computer network or machine unavailable by overwhelming it with a large amount of traffic from multiple sources, often using botnets such as Zeus (malware) and Conficker. This can be achieved by using malware to compromise computer systems, such as those running Windows XP or Linux, and then using these systems to send large amounts of traffic to the targeted network or machine, similar to the MyDoom computer worm. DDoS attacks can be launched from anywhere in the world, making them difficult to track and prevent, and have been used by hacktivist groups such as Anonymous (group) and LulzSec to target organizations such as Visa Inc. and Mastercard. The impact of DDoS attacks can be significant, with eBay and Amazon (company) being notable examples of companies that have been affected.

Overview

DDoS attacks typically involve a large number of computer systems, often botnets, which are used to send traffic to the targeted network or machine, overwhelming its resources and making it unavailable to legitimate users, similar to the SQL Slammer computer worm. The traffic can be in the form of TCP or UDP packets, and can be sent from a variety of sources, including compromised websites and infected computers, often using exploit kits such as Blackhole (exploit kit) and Angler (exploit kit). DDoS attacks can be launched using a variety of tools, including Low Orbit Ion Cannon and High Orbit Ion Cannon, which were used by Anonymous (group) to target organizations such as PayPal and Sony. The goal of a DDoS attack can be to extort money from the targeted organization, or to disrupt their operations, as seen in the 2016 Dyn cyberattack which targeted Dyn (company) and affected Twitter, Netflix, and Amazon Web Services. DDoS attacks have been used by nation-state actors, such as China and Russia, to target organizations such as Google and Microsoft, and have also been used by terrorist organizations, such as ISIS, to target organizations such as CNN and Fox News.

Types of DDoS attacks

There are several types of DDoS attacks, including volumetric attacks, which attempt to overwhelm the targeted network or machine with a large amount of traffic, and application-layer attacks, which target specific applications or services, such as HTTP or FTP, often using SQL injection and cross-site scripting attacks. Other types of DDoS attacks include protocol attacks, which exploit weaknesses in network protocols, and amplification attacks, which use DNS amplification or NTP amplification to increase the amount of traffic sent to the targeted network or machine, similar to the 2013 Spamhaus DDoS attack which targeted Spamhaus and affected CloudFlare and Google. DDoS attacks can also be classified based on their vector, such as network-based or application-based, and can be launched using a variety of tools, including DDoS tools such as LOIC and HOIC, which were used by LulzSec to target organizations such as Sony and Nintendo. The 2016 Bangladesh Bank heist is an example of a DDoS attack being used to distract from a larger cybercrime operation, which targeted Bangladesh Bank and involved SWIFT.

Motivations and perpetrators

The motivations behind DDoS attacks can vary, but common motivations include extortion, hacktivism, and cyberwarfare, as seen in the 2014 Ukraine cyberattack which targeted Ukraine and was attributed to Russia. DDoS attacks can be launched by a variety of perpetrators, including individual hackers, hacktivist groups, and nation-state actors, such as China and North Korea, which have been accused of launching DDoS attacks against organizations such as Google and Sony. The 2015 Office of Personnel Management data breach is an example of a DDoS attack being used as a smokescreen for a larger data breach, which targeted Office of Personnel Management and involved China. DDoS attacks can also be launched by organized crime groups, such as cybercrime rings, which have been known to launch DDoS attacks against organizations such as eBay and Amazon (company), and have been involved in Operation Aurora and Operation Shady RAT.

Mitigation and defense

There are several ways to mitigate and defend against DDoS attacks, including using firewalls and intrusion detection systems to block traffic from known botnets, and using content delivery networks to distribute traffic and reduce the load on individual servers, as seen in the 2016 Dyn cyberattack which targeted Dyn (company) and affected Twitter, Netflix, and Amazon Web Services. Organizations can also use DDoS protection services, such as Akamai and CloudFlare, to help mitigate the impact of DDoS attacks, and can implement security measures such as two-factor authentication and encryption to reduce the risk of data breaches, as recommended by National Institute of Standards and Technology and SANS Institute. The 2014 Heartbleed bug is an example of a vulnerability that can be exploited by attackers to launch DDoS attacks, and highlights the importance of patch management and vulnerability management.

Legal and ethical aspects

DDoS attacks are illegal in many countries, including the United States, United Kingdom, and Australia, and can result in significant fines and imprisonment for those found guilty of launching such attacks, as seen in the 2013 Spamhaus DDoS attack which targeted Spamhaus and affected CloudFlare and Google. The Computer Fraud and Abuse Act and the Electronic Communications Privacy Act are examples of laws that prohibit DDoS attacks, and the Federal Bureau of Investigation and the National Cyber Security Alliance are examples of organizations that work to prevent and investigate DDoS attacks, and provide guidance on cybersecurity and incident response. The 2015 Office of Personnel Management data breach is an example of a DDoS attack being used as a smokescreen for a larger data breach, and highlights the importance of data protection and privacy.

Notable incidents

There have been several notable DDoS attacks in recent years, including the 2016 Dyn cyberattack which targeted Dyn (company) and affected Twitter, Netflix, and Amazon Web Services, and the 2013 Spamhaus DDoS attack which targeted Spamhaus and affected CloudFlare and Google. The 2014 Ukraine cyberattack is an example of a DDoS attack being used as a tool of cyberwarfare, and the 2015 Office of Personnel Management data breach is an example of a DDoS attack being used as a smokescreen for a larger data breach, which targeted Office of Personnel Management and involved China. The 2017 WannaCry ransomware attack and the 2017 NotPetya cyberattack are examples of ransomware and wiper attacks that have been used in conjunction with DDoS attacks, and highlight the importance of cybersecurity and incident response, as recommended by National Institute of Standards and Technology and SANS Institute.

Category:Cyberattacks