DDoS Attack: Everything You Need to Know to Protect Yourself

Inaccessible websites, flooded inboxes, saturated servers… DDoS attacks can paralyze your most essential activities in a click.

But what exactly do these four letters hide? What do these attacks really consist of? In this article, we’ll lift the veil on DDoS attacks to allow you to understand in detail how they work and how to protect yourself. Ready to uncover all the secrets of hackers 2.0? Let’s go!

What is a DDoS attack?

A DDoS attack stands for “Distributed Denial of Service“. The principle is simple: it is a cyber attack that aims to make a service, site or application inaccessible.

Specifically, attackers will massively send requests to the server, in order to completely overload its bandwidth or deplete its resources.

Result: the server is completely overwhelmed and can no longer respond to legitimate user requests. The site then becomes inaccessible or extremely slow.

But what exactly is the purpose of this type of attack? This is what we’ll see!

What is the purpose of a DDoS attack?

The main purpose of a distributed denial of service (DDoS) attack is to make a service or site unavailable. Yes, okay… But at this point, if you’re not an expert, you don’t really understand why anyone would want to do that…

Unfortunately, hackers know! And they’ll use these attacks to:

• Blackmail a company by threatening to make its site inaccessible
• Take activist actions in order to defend a cause
• Block a competitor’s site during a strategic period (sales day for example)
• etc.

So, as you can see, this type of attack can be much more disastrous than it seems. Therefore, it is important to understand them well in order to protect yourself from them. So let’s see right away how they work.

How does a DDoS attack work?

The operation of a DDoS attack is quite simple:

1. Attackers will first infect thousands or even millions of devices connected to the Internet (computers, smartphones, connected objects) using malware.
2. The infected devices then form a “botnet”, a network of zombie devices remotely controlled by hackers.
3. Using the botnet, the hackers will coordinate the massive sending of requests to the target, instantly saturating its bandwidth or resources.
4. The flood of requests will prevent users from accessing the targeted site or service normally. The target is knocked offline.

So it’s a well-oiled scheme. But beware, it can take several forms.

What are the different types of DDoS attacks?

There are three main categories of DDoS attacks:

• Volumetric attacks
• Saturation attacks
• Application layer attacks

1. Volumetric attacks

A DDoS attack that wants to take down a website will try to saturate its internet connection, like plugging a hose with your thumb.

To do this, hackers will massively send requests to the targeted site to consume all of its bandwidth.

• In particular, they can use vulnerabilities in the domain name system (DNS):
  • They’ll impersonate the IP address of the targeted site and send fake requests to DNS servers.
  • In response, the servers will redirect huge data packets to the targeted site, which will saturate it.
• Another technique used is to send very large quantities of small, unnecessary data packets, called UDP packets. Like thousands of small Amazon parcels delivered to your home without you having ordered them. These packets will saturate the connection.
• Finally, attackers can also exploit vulnerabilities in the system that allows computers to communicate with each other on the internet. They’ll send many small messages that will overwhelm the website.

Ultimately, all these attacks have the same goal: to consume all the bandwidth of the website’s internet connection, to make it inaccessible.

It’s like hundreds of people trying to go through the same small door at the same time. It would be completely blocked.

2. Saturation attacks

Here, the goal is to exhaust the server’s resources, such as memory or CPU, to block it. To do this, hackers will exploit vulnerabilities in how computers communicate over the internet.

They can for example proceed:

• By SYN flood: When a computer wants to connect to a web server, it sends a SYN (synchronize) request to initiate the connection. The server responds with a SYN-ACK (synchronize-acknowledge) and the computer sends an ACK to confirm. In a SYN flood attack, the attacker will send thousands of SYN requests per second, without ever sending the final ACK. This creates half-open connections that saturate the server’s resources.
• By ACK flood: This involves sending ACK packets to the server without an initial SYN request. This disrupts the server’s connection management system.
• By Slowloris: Here, the attacker opens thousands of incomplete HTTP connections to the server and keeps them open as long as possible by regularly sending small requests. This exhausts the server’s resources.

Ultimately, all these techniques exhaust the web server’s resources to make it inaccessible.

3. Application layer attacks

These attacks, also known as layer 7 DDos attack, directly target application and database servers. The goal is to monopolize application resources.

To do this, hackers have several techniques:

• They can saturate the web server by sending it millions of normal internet requests at the same time, as if thousands of people were ordering at the same time on an e-commerce site. The server would be overloaded.
• They can also send internet requests very slowly, which keeps the server busy all the time. To represent this problem, you have to imagine that it’s like someone placing their order very slowly, letter by letter, which blocks the server and prevents it from handling other customers.
• Finally, they can send erroneous requests directly to the database behind the site to mislead it.

The idea, in all cases, is to monopolize as many web server and database resources as possible to block everything.

As you can see, these attacks are therefore very vicious. It is therefore important to be able to recognize them when they occur.

How to recognize a DDoS attack?

Identifying a DDoS attack is not always obvious, as it can look like a normal spike in traffic. However, some signs should alert you:

• Your site is inaccessible or extremely slow to load. This is the main sign of server resource saturation.
• Abnormally high network traffic is observed by the site host. An unusual volume of incoming requests may indicate a DDoS attack.
• Slowdown or unavailability of other sites hosted on the same server. A DDoS attack targeting one site can impact “neighbor” sites on the same server.
• A sudden and massive increase in the error rate on the server. These errors are due to the server’s inability to handle the massive influx of requests.
• Partial unavailability of the site. Some users can access it while others cannot. This indicates localized saturation.
• Inability to access the site from certain geographic areas. The attack can saturate some network paths leading to the site.
• …

If this kind of problem persists while your connection is working normally otherwise, there is a good chance a cyber attack is behind it all.

And this type of attack can hit even the biggest websites:

• In 2016, sites like Twitter, Paypal or Netflix were rendered inaccessible by this type of attack
• In 2018, the GitHub developer platform was victim of the largest DDoS attack ever recorded: 1.35 terabits of data per second!
• In 2022, Costa Rica saw its government sites paralyzed by cyberattacks from Russia

What to do when victim of a DDoS attack?

When you are the victim of a DDoS attack, you must act quickly and methodically:

1. Confirm the attack and gather evidence
2. Alert your hosting provider and/or IT team
3. Activate existing DDoS protection
4. Implement emergency measures
5. Analyze the attack

1. Confirm the attack and gather evidence

First of all, make sure it is a DDoS attack. Gather screenshots and network data to identify the source and type of attack.

To do this, you can in particular:

• Use network monitoring tools to identify an abnormal spike in incoming traffic. You can also use sites like Pingdom to test the availability of your website
• Take screenshots showing the unavailability or slowness of your services
• Measure and record incoming and outgoing network bandwidth to detect anomalies
• Collect application logs indicating a spike in server errors or response times

2. Alert your hosting provider and IT team

Immediately inform your web host and IT department that an attack is underway. They must deploy emergency measures as soon as possible.

• Contact your hosting provider’s support by phone to report the DDoS attack and the evidence gathered. Request traffic filtering to be set up
• Warn your IT manager and network team by email and phone. Provide them with your data reports
• If you use an external anti-DDoS service, also notify their incident response team
• Internally, inform your employees that they are likely to encounter difficulties accessing services

3. Activate existing DDoS protections

If you have anti-DDoS protection, activate it to mitigate the attack. For example, you can:

• Activate your firewall features to block detected malicious traffic
• If you have a cloud-based anti-DDoS service, route traffic through it to filter before reaching your servers
• Implement anycast routing if you have this technology to distribute load across multiple servers.
• Enable IP rate limiting rules to block suspicious IPs
• Increase server capacity if possible to absorb some of the excess traffic

4. Implement emergency measures

If the attack exceeds your normal defenses, emergency measures must be taken quickly:

• Temporarily restrict access to your services to trusted IPs only.
• Completely block certain protocols exploited by the attack, even if it means temporarily reducing functionality.
• As a last resort, complete firewall only allowing vital traffic to pass while waiting for the attack to pass.
• Plan for a temporary increase in your bandwidth to absorb the excess traffic.
• Prepare crisis communication in case of prolonged unavailability of certain services.

5. Analyze the attack afterwards

Once the attack is over, it is essential to analyze what happened to prevent it from happening again:

• Retrieve all network, server, and application data to understand how the attack unfolded
• Identify points of failure that allowed the attack to overwhelm your defenses
• Estimate the total cost of the attack in financial, material, and reputation terms
• Write a detailed report on the attack and your findings to improve your future preparedness

Haven’t been victim of a DDoS attack yet? Want to protect yourself against this kind of incident? Then the following will interest you.

How to effectively protect against this type of attack?

To protect against DDoS attacks, it is advisable to implement a multi-layered security strategy:

1. Strengthen network security
2. Use anti-DDoS services
3. Regularly update your site
4. Make sure you have enough network resources

1. Strengthen network and server security

The first line of defense is to strengthen the security of your network infrastructure and systems. To do this, it is recommended to:

• Use a powerful firewall that is properly configured to detect DDoS attacks and block malicious traffic
• Regularly update systems and applications to avoid exploitable vulnerabilities
• Strengthen application code security against SQL injections, XSS and other flaws

2. Use anti-DDoS services

Another essential measure is to rely on specialized anti-DDoS services:

• They filter traffic upstream to stop attacks before they reach your servers
• They can absorb very large volumes of traffic thanks to their massive distribution network
• They continuously analyze traffic to detect attack patterns

3. Update your website

Hackers often take advantage of security vulnerabilities in websites to launch their attacks.

You should therefore regularly update your website, blog or online store to fix flaws. Like when you install Windows updates on your computer.

4. Make sure you have enough network resources

It is also recommended to:

• Have excess bandwidth capacity to absorb sudden spikes in traffic
• Have a business continuity plan in case of a major attack

By applying these 4 tips, you’ll drastically reduce the risk that your website will be blocked and inaccessible due to a cyberattack.

DDoS Attacks: key takeaways

In summary, DDoS (Distributed Denial of Service) attacks are a growing threat to online businesses and services. They exploit protocol and server vulnerabilities to saturate networks with a massive influx of requests and can be detrimental in many ways. A multi-layered defense strategy is therefore essential to protect yourself effectively.

• Different types of DoS (denial of service) attacks exist: volumetric, saturation or application layer
• Knowing how to identify signs of an attack is crucial to respond quickly
• It is necessary to confirm the attack via network data before acting
• If you are the victim of this type of cyberattack, you must alert your hosting provider and activate your DDoS protections
• To avoid suffering a DDoS attack, you need to strengthen network security and use anti-DDoS protection