DDoS Attack.

What is a DDoS attack?

A DDoS attack is a distributed denial-of-service attack. CISA says it occurs when multiple machines operate together to attack one target. NIST describes it as a denial of service technique that uses numerous hosts to perform the attack.

A plain denial-of-service (DoS) attack is the base idea. CISA says a DoS attack occurs when legitimate users cannot reach information systems, devices or other network resources because of the actions of a malicious cyber threat actor.

How does a DDoS attack work?

CISA says a DoS attack floods the targeted host or network with traffic until the target cannot respond or simply crashes. In a DDoS attack, the traffic comes from many machines at once, not from one.

CISA says attackers often use botnets for this. A botnet is a group of compromised internet-connected devices that work together. CISA says a distributed attack increases the attack power and makes the true source harder to identify. It also notes that some botnets are rented out through attack-for-hire services, and that Internet of Things devices are often exposed because of default passwords and weak security.

MITRE lists this behavior as Network Denial of Service. It says adversaries use it to disrupt the availability of a service by exhausting bandwidth. MITRE says targets include websites, email, DNS and web applications, and that methods include IP spoofing and botnets, which make the traffic harder to trace and make filtering by source address less effective. IP spoofing means faking the source address of network traffic.

What are common types of flooding?

CISA gives two examples of DoS methods.

• Smurf attacks, where spoofed broadcast packets are sent to many hosts so that they flood the target with responses.
• SYN floods, where incomplete connection requests are sent to use up all available ports, which blocks legitimate users.

How can you spot a DDoS attack?

CISA lists these possible signs: unusually slow network performance, such as when opening files or websites, a particular website being unavailable, or being unable to reach any website.

MITRE suggests defenders watch for executables or scripts that create large outbound network traffic toward remote hosts or amplification ports.

How can you reduce the risk?

CISA recommends these steps before an attack.

• Enrol in DoS protection services.
• Create disaster recovery plans.
• Install antivirus software and firewalls.
• Install a firewall and follow sound security practices on internet-connected devices.

MITRE says that when flood volume is larger than the capacity of the targeted network connection, it is typically necessary to intercept the traffic upstream, for example through internet service providers or third-party services such as content delivery networks. It also lists source address blocking, port filtering, protocol-level blocking, and disaster recovery and business continuity plans.

What should you do if you are attacked?

CISA says to contact your network administrator to confirm the attack and monitor traffic. It also says to contact your internet service provider to find out whether it is the target, and to watch other network assets for secondary attacks.

Is a DDoS attack the same as a DoS attack?

No. Both aim to stop legitimate users from reaching a system. A DoS attack can come from a single system. A DDoS attack uses many machines working together against one target.

Is a botnet the same as a DDoS attack?

No. A botnet is the group of compromised devices. A DDoS attack is what the group can be used to do. CISA says attackers often use botnets for DDoS attacks, so the two are linked but not the same thing.

During the August 2022 visit by Nancy Pelosi, Taiwan’s government reported DDoS attacks on public websites, as described in our Taiwan incident page.