Distributed Denial Of Service Attack (Ddos) Types

A DDoS attack is an evil try to make an online service unavailable to users, usually by temporarily interrupting or suspending the benefits of its hosting server.

Fremont, CA: A DDoS(distributed denial of service) attack is started from many compromised devices, usually distributed globally in what is noted as a botnet. It is different from another denial of service (DoS) attacks in that it employs a single Internet-connected device (one network connection) to flood an objective with malicious traffic.

This nuance is the prime reason for the existence of these two somewhat different definitions.

Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.

This is part of an expansive series of guides about Cybersecurity.

DoS and DDoS attacks can be segregated into three types:

Volume Based Attacks

Incorporates UDP floods, ICMP floods, and other spoofed-packet floods. The attack's objective is to suffuse the bandwidth of the attacked site, and magnitude is measured in bits per second (Bps).

Protocol Attacks

Comprises SYN floods, fragmented packet attacks, Ping of Death, Smurf DDoS and more. This attack consumes existing server resources or intermediate communication equipment, such as firewalls and load balancers, and is calculated in packets per second (Pps).

Application Layer Attacks

Involves low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD vulnerabilities and more. Comprised of apparently legitimate and innocent requests, these attacks aim to crash the web server, and the magnitude is gauged in Requests per second (Rps).

Common DDoS attacks types

Some of the most often used DDoS attack types include:

UDP Flood

A UDP flood is any DDoS attack that floods a focus with User Datagram Protocol (UDP) packets. The episode's goal is to flood random ports on a remote host. This causes the host to continually check for the application listening at that port and (when no application is found) respond with an ICMP' Destination Unreachable' packet. This process saps host resources, which can finally lead to inaccessibility.

ICMP (Ping) Flood

Like the UDP flood attack, an ICMP flood overcomes the target resource with ICMP Echo Request (ping) packets, usually sending packets as fast as possible without waiting for replies. However, this attack can consume both outgoing and incoming bandwidth since the victim's servers often try to respond through ICMP Echo Reply packets, resulting in a significant overall system slowdown.

SYN Flood

An SYN flood DDoS attack exploits a known weakness in the TCP connection sequence (the "three-way handshake"), wherein an SYN-ACK response from that host must answer an SYN request to initiate a TCP connection with a host and then be confirmed by an ACK response from the requester.

In an SYN flood scenario, the requester sends multiple SYN requests but either does not react to the host's SYN-ACK response or transmits the SYN requests with a spoofed IP address. Either way, the host system waits for acknowledgment for each request, binding resources until no new connections can be made, ultimately resulting in a denial of service.

Ping of Death

A ping of death ("POD") attack includes the attacker sending many malformed or malicious pings to a computer. The utmost packet length of an IP packet (comprising header) is 65,535 bytes. Nevertheless, the Data Link Layer usually limits the total frame size – for example, 1500 bytes over an Ethernet network.

If so, a large IP packet is split across multiple IP packets (known as fragments), and the recipient host rebuilds the IP fragments into the complete packet. In a Ping of Death scenario, after malicious manipulation of fragment content, the recipient ends up with an IP packet more significant than 65,535 bytes when reassembled. This can surplus memory buffers allocated for the packet, causing a denial of service for legitimate packets.

Slowloris

Slowloris is an extremely-targeted attack, allowing one web server to take down another server without impacting other services or ports on the intent network. Slowloris does this by keeping as many connections to the target web server open for as long as possible.

It achieves this by creating links to the target server but sending only a partial request. As a result, Slowloris constantly sends more HTTP headers but never completes a request. The focused server keeps each of these false connections open. This ultimately overflows the maximum concurrent connection pool and leads to the denial of additional references from legitimate clients.

NTP Amplification

In NTP amplification attacks, the perpetrator's abuse publically-accessible Network Time Protocol (NTP) servers to overwhelm a targeted server with UDP traffic. The episode is an amplification assault because the query-to-response ratio in such scenarios is between 1:20 and 1:200 or more. Any attacker that acquires a list of open NTP servers can quickly generate a destructive high-bandwidth, high-volume DDoS attack.

HTTP Flood

In an HTTP flood DDoS attack, the attacker abuse apparently-legitimate HTTP GET or POST requests to attack a web server or application. HTTP floods don't utilize malformed packets, spoofing or reflection techniques, and need less bandwidth than other attacks to bring down the focused site or server. The attack is most efficient when it forces the server or application to allocate the maximum resources possible in response to every request.

Zero-day DDoS Attacks

The "Zero-day" definition encircles all unknown or new attacks exploiting vulnerabilities for which no patch has yet been released. The term is well-familiar amongst the members of the hacker community, where the practice of trading zero-day vulnerabilities has become a popular activity.

The motivation behind DDoS attacks

According to recent market research, DDoS attacks are quickly becoming the most prevalent type of cyber threat, increasing in the past year in both number and volume. The trend is toward shorter attack duration but more considerable packet-per-second attack volume.

Attackers are primarily motivated by:

• Ideology – So-called "hacktivists" use DDoS attacks to ideologically target websites they disagree with.

• Business feuds – Businesses can utilize DDoS attacks to tactically take down competitor websites, e.g., to keep them from partaking in a significant event, like Cyber Monday.

• Boredom – Cyber vandals or "script-kiddies" employ prewritten scripts to launch DDoS attacks. The culprits of these attacks are usually bored, would-be hackers looking for an adrenaline rush.

• Extortion – Perpetrators employ DDoS attacks or the threat of DDoS attacks to extort money from their targets.

• Cyber warfare – Government-authorized DDoS attacks can be used to both cripple opposition websites and an opponent country's infrastructure.Low Orbit Ion Cannon (LOIC): an "entry-level" DoS attack tool utilized for cyber vandalism