DDOS stands for "Distributed Denial of Service"
A DDOS attack is carried out by a network of machines, hence the notion of distributed attacks
These machines have been corrupted beforehand by cybercriminals through the spread of malware.
This network of infected machines is also called botnet.
The cybercriminal will execute a DDOS attack by ordering the botnet to saturate the service with many requests until it becomes unavailable, It is the concept of denial of service.
DDOS can be on a specified service, it can also be a network link, an infrastructure, a website, an application, etc...
It is noted that with the rise of the IoT or Internet of Things DDOS attacks gain in intensity since cybercriminals enroll unsecured IoT equipment in botnets.
Denial of service will prevent real users of the service from using it.
Another variant is DDOS attacks based on reflection and amplification, In this case, the cybercriminals will use machines accessible on the internet and therefore not corrupted.
These machines called "reflectors" are just intended to respond to requests from any source.
The cybercriminal will send requests to these reflectors using the victim's IP address as the source IP, the cybercriminal makes then an identity theft or rather an IP address.
The reflectors then think that it is the victim who made the request and they will therefore send their responses to the victim.
The reflectors will then create unsolicited traffic by the victim who then suffers a back attack.
Where this type of attack is dangerous is that there is an amplification effect. Indeed some protocols generate responses much larger than the request size.
We can for example cite the DNS protocols for Domain Name System or NTP for Network Time Protocol.
The amplification effect allows to saturate the victim's network bandwidth even faster, which results in denial of service.
The motives behind DDOS attacks can be very varied.
In the gaming environment where DDOS attacks are very numerous the goal is to slow down or even saturate the bandwidth of the other player, all this to prevent it from playing and in general the motive behind it is just either for fun or to piss off the other player.
Another case is the DDOS attacks which are carried out by the activists, we can take for example the case of the Anonymous group which DDOS attack campaigns against government or terrorist sites and there the motive behind it is rather convictions in particular the defense of individual freedoms.
Finally for companies, DDOS attacks are often the harbinger of a larger attack indeed cybercriminals often use DDOS attacks to test the defense and reaction capacity of companies.
DDOS attacks also allow cybercriminals to create a diversion to implement new malware at the same time or to extract data.
Here is a video explaining more in depth these fundamentals:
Give me your opinion in the comments
Comments