Discover What's DDoS & how it happens...
Tags: 100daysofcode, computerscience, systems, security
Published: 2021-12-29 19:59:40

Sneak Peek :

1. What's DDoS? (with analogy)
2. Intent of planning & Impact on business
3. BTS of DDoS attack plan & implementation
4. Types of DDoS attacks
5. How to identify & mitigate such attacks?

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/algg8qgacbykw5ajrczt.png) _(Img credits : avast)_

## What's DDoS? (with analogy)

> A Distributed Denial of Service (DDoS) attack is an attempt to make an online service unavailable or exhaust resources by overwhelming it with traffic from multiple sources

(i.e. introducing fake clients/users requesting access to service such that it exceeds limits/quotas of the serving capability of the website, resulting in Denial Of any service to the real clients;

you can think of it as not being able to work on ultra-important tasks you wanted to work on due to sudden pop-up of distractions & engagement in those not-so-critical activities PS: happens with me every time😜)

## Why is DDoS planned? What effects could it have on business?

The main intent of DDoS attacks is generally to bring down services, especially the critical ones (like Bank or Finance related, news or other targeted orgs & services) to block their operation. And as we know, 

Even a few seconds of in-operation/unavailability of widely used services (ones on grander scales) can amount for huge losses for the organization. Also, it affects the user experience or even transactional trust which in turn affects reputation of org negatively.

## Now the question is how could this happen?
| Behind the scenes of DDoS attack plan |

Attack plan progression might look like: 

- Building botnet (interconnected army of infected resources targeting to create fake traffic)

- Botnets Aim : Taking web resources like website/ particular services offline/down, in order to deny your customer's access

- Actual launching of attack via botnets through attacks on : 

1. Application Layer by **_HTTP request floods_**
2. Protocol by **_Syn floods_** (state exhaustion due to overconsumption of Firewall/LB, by no final handshake keeping resource busy)
3. Volumetric Congestions by consumption of bandwidth through **_DNS Amplifications_**
4. Multiplying traffic by Refection Strategies: **_DNS Reflection_** (Small request from attacker forging victim's IP, & requesting larger reply); **_Chargen Reflection_** (Steady streams of text)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aa1jtwajtyofuv76x1iv.PNG) _(Img credits: digitalattackmap)_

## Types

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dzs893uk63peorpsufw7.PNG) _(Inspiration: LTI Tech Bytes)_

## Identification of DDoS attacks

Unexpected surge in requests, through may/nt similar user profiles (originating from same IP, location, devicetype, etc), perhaps at odd hours could be a sign of DDoS.

## Mitigate DDoS attacks

The key helping factor could be : ability of differentiate between attack traffic and normal traffic, if that is accomplishable to certain extent then, blacklisting attackers & serving normal traffic could be a way. Naturally, it's easier to differentiate if all attacker IPs originate from same place or follow similar patterns, & difficult if they have diversified origins (multi-vectored).

When it is not possible to differentiate the normal from trouble causing ones, better to use strategies that limit serving to both kinds & help revive back to original state. Such techniques are:

- **Basic Steps** : (Detect => Diverge => Filter => Analyse) & manage by dynamically redirecting or shunting service or reconfigure
- **Blackhole routing** : Routing to a null route/ blackhole, and dropping from the network
- Rate limiting : Limiting the number of requests a server will accept over a certain time window 
- **Web application firewall** : Reverse proxy protecting the targeted server by filtering requests from internet
- **Security Solutions** : Products like Cloudfare's Anycast network diffusion which kinda spreads the impact across network making it manageable & diffusing the disruptive capabilities of the attack.

## References:

- https://www.cloudflare.com/en-in/learning/ddos/what-is-a-ddos-attack/
- https://www.digitalattackmap.com/understanding-ddos/