Amplification attacks are a type of DDoS attack in which hackers exploit DNS server vulnerabilities to transform small connection requests into huge payloads. Amplification attacks are also a form of reflection attacks, where hackers exploit DNS resolvers to overload a given network or server with amplified traffic. This causes the target infrastructure, including the server itself, to become inoperable.
Hackers make small DNS requests to public DNS servers and spoof the source address (to which the DNS servers will send the response) to the target’s IP address. Once hackers manage to spoof the source IP address from where the DNS request originated (and change it to the victim’s IP address), the DNS server in question sends the response back to the victim’s spoofed IP address instead of the device that sent the request.