What Is a DDoS Attack? How Denial-of-Service Attacks Work

By
Harris
-
55

Key Points

  • A distributed denial-of-service (DDoS) attack floods a website, server or network with traffic from many sources at once so legitimate users cannot get in.
  • Attackers usually rely on botnets, groups of hijacked internet-connected devices, and CISA warns that poorly secured smart devices with default passwords are easy recruits.
  • A March 2024 CISA, FBI and MS-ISAC guide sorts DDoS attacks into three types: volumetric, protocol and application layer attacks.
  • Common warning signs include unusually slow network performance, a website that suddenly goes offline and a spike in traffic from unusual sources.
  • CISA and the FBI urge victims to report DDoS incidents to a local FBI field office or to CISA at report@cisa.gov or (888) 282-0870.

What is a DDoS attack? A distributed denial-of-service attack is a deliberate attempt to knock a website, online service or network offline by burying it in more traffic or requests than it can handle. The traffic comes from many machines at the same time, often thousands of hijacked computers and smart devices, so the target cannot simply block one address.

This explainer covers how these attacks work, the main types, the warning signs, how organizations defend themselves and how to keep your own devices out of an attack. It draws on guidance from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI and the National Institute of Standards and Technology (NIST).

What is a denial-of-service attack?

CISA defines a denial-of-service (DoS) attack as one that occurs when legitimate users are unable to access information systems, devices or other network resources because of the actions of a malicious cyber threat actor. The services knocked out can include email, websites, online banking and anything else that depends on the affected computer or network.

Unlike ransomware or a data breach, the main goal is not to steal or lock up information. The goal is to make something unavailable. CISA explains that the attacker usually achieves this by flooding the targeted host or network with traffic until it cannot respond or simply crashes.

Even a network that is not the intended target can feel the effects. According to CISA, if your internet service provider (ISP) or cloud provider is attacked, your own network can lose service as well.

DoS vs. DDoS: what is the difference?

The difference is the number of sources. NIST’s glossary describes a distributed denial of service as a denial of service technique that uses numerous hosts to perform the attack. The joint CISA, FBI and MS-ISAC guide spells out the contrast:

DoS attack DDoS attack
Sources A single source, typically one computer or a small number of computers Multiple sources, often a botnet of compromised computers
Traffic volume Lower, generated by the attacker’s own machines Significantly higher, because every machine floods the target at once
Tracing and blocking Fewer sources to trace and block Harder to trace and block, especially when IP addresses are spoofed
Goal Make the target unavailable to its intended users Same goal, at a larger scale

CISA notes that spreading the attack across many machines both multiplies its power and makes attribution harder, since the true source is hidden behind the devices doing the work.

How botnets power DDoS attacks

Most large DDoS attacks run on botnets. CISA describes a botnet as a group of hijacked internet-connected devices that an attacker controls through command and control software after exploiting security weaknesses. The owners of those devices are victims too, and they often have no idea their equipment is involved.

The Internet of Things has made the problem worse. CISA says DDoS attacks have grown in magnitude as more devices come online, because many smart devices use default passwords and weak security. The FBI’s Internet Crime Complaint Center (IC3) reported that in September 2016, attackers used the Mirai botnet to infect routers, cameras and digital video recorders for DDoS attacks, getting in through openly accessible devices that still used common default usernames and passwords.

Botnets can also be rented. CISA warns that compromised devices are made available to “attack-for-hire” services, which let unskilled users launch DDoS attacks they could never build on their own.

The three main types of DDoS attacks

The CISA, FBI and MS-ISAC DDoS guide, updated in March 2024, groups DoS and DDoS techniques into three types:

  • Volumetric (volume-based) attacks try to consume all available bandwidth or system resources with a massive volume of traffic, so the target cannot handle legitimate requests.
  • Protocol-based attacks exploit weaknesses in network protocols or services. They typically target Layers 3 and 4 of the Open Systems Interconnection (OSI) model, the network and transport layers.
  • Application layer attacks go after weaknesses in a specific application or service, such as a website, and target Layer 7 of the OSI model. Instead of overwhelming the whole network, they eat up the application’s processing power or cause it to malfunction.

The guide stresses that these categories are not mutually exclusive, and attackers can combine techniques.

Two classic examples

CISA describes two well-known techniques. In a SYN flood, the attacker repeatedly starts a connection with a server but never finishes the TCP “three-way handshake.” Each half-open request ties up a port, and as the attacker keeps sending them, the server runs out of open ports for real users. In a Smurf attack, the attacker sends broadcast packets to many hosts using a spoofed return address that belongs to the target. All of those hosts reply to the victim at once, flooding it with responses.

The joint guide also notes that reflection DDoS attacks typically originate from legitimate public servers.

What a DDoS attack does, and what it does not do

According to the CISA, FBI and MS-ISAC guide, both DoS and DDoS attacks can cause service outages, financial losses and reputational damage.

A DDoS attack by itself is about availability, not theft. But CISA cautions that many attackers use DoS or DDoS attacks to deflect attention from their real target and launch secondary attacks on other services in the same network. If your organization handles sensitive data, a DDoS attack is a moment to watch for intrusions such as ransomware and other malware, not a moment to relax other defenses.

Is a DDoS attack illegal?

In the United States, the federal computer crime statute, the Computer Fraud and Abuse Act at 18 U.S.C. 1030, makes it a crime to knowingly transmit a program, information, code or command and, as a result, intentionally cause damage without authorization to a protected computer. The law defines “damage” as any impairment to the integrity or availability of data, a program, a system or information, which is the kind of harm a denial-of-service attack is designed to cause. This article is not legal advice.

Warning signs of a DDoS attack

CISA points out that the symptoms can look like ordinary technical problems or routine maintenance. Signs that may point to an attack include:

  • Unusually slow network performance when opening files or loading websites
  • A particular website that suddenly becomes unavailable, or an inability to reach any website
  • A sudden, sustained jump in network traffic, CPU use, memory use or bandwidth
  • A large number of requests from specific IP addresses or aimed at one page or resource
  • Servers or applications that crash or stop responding without an obvious reason
  • Trouble reaching other network services such as DNS servers, or disruptions to voice and messaging tools

According to CISA, the best way to confirm an attack is network traffic monitoring and analysis, using a firewall or intrusion detection system.

How organizations defend against DDoS attacks

The joint guide says no organization can predict when a DDoS attack will come, so preparation matters. Its recommended steps before an attack include:

  • Run a risk assessment and establish a baseline of normal traffic so unusual spikes stand out.
  • Use network monitoring and intrusion detection, and configure firewalls with rate limits and filters.
  • Consider a DDoS mitigation service, which detects abnormal traffic and filters it out before it reaches the network.
  • Plan bandwidth capacity, use load balancing and build in redundancy and failover.
  • Patch systems, secure web applications and keep a tested incident response, communication and recovery plan.

During an attack, the guide advises activating the incident response plan, contacting the ISP or hosting provider, gathering evidence such as timestamps, IP addresses and logs, filtering malicious traffic and, where available, turning on mitigation services or a content delivery network to absorb and spread out the load. Afterward, organizations should assess the impact, restore services, analyze what happened and update their defenses.

What everyday users can do

Most people will never be the target of a DDoS attack, but their devices can end up as part of one. CISA and the FBI recommend a few basic habits:

  • Change default usernames and passwords on routers, cameras and other smart devices, and use strong, unique passwords. A password manager can make that easier.
  • Install updates and security patches for devices as soon as they are available.
  • Use antivirus software and a properly configured firewall, and consider putting smart devices on their own separate network.
  • Turn off devices when not in use, and check what data a device collects before you buy it.

If your home internet suddenly slows down or a site you depend on stops working, CISA suggests first checking with your network administrator or ISP to see whether the cause is maintenance, an outage or an attack on the provider itself.

How to report a DDoS attack

CISA and the FBI urge organizations to promptly report DDoS incidents to a local FBI field office or to CISA at report@cisa.gov or (888) 282-0870. State, local, tribal and territorial government entities can also report to the MS-ISAC. If you suspect one of your own smart devices has been compromised, the FBI says in its Internet of Things public service announcement that you can contact your local FBI office or file a complaint with IC3 at ic3.gov.

For ongoing coverage of major outages, cyberattacks and other top stories across the country, follow the LiveNewsWorld U.S. News Live center.

The bottom line

A DDoS attack is a brute-force way to take something offline: flood it from many directions at once until real users cannot get through. Organizations defend themselves with monitoring, filtering, extra capacity, mitigation services and a rehearsed response plan. Everyone else can help by locking down their own routers, cameras and smart gadgets, because every device left with a default password is a potential soldier in someone else’s botnet.

Sources