Knowledge Base

With the increasing prevalence of the internet today, cyber security threats have also increased. One of the most common and devastating of these threats is Distributed Denial of Service (DDoS) attacks. In this article, we will examine in detail what DDoS attacks are, how they work, their different types, their effects, and ways to protect against these attacks. In addition, we will concretize the subject with real-life examples and case studies, and address curiosities with a frequently asked questions section.

1. Basic Concepts of DDoS Attacks

1.1. What is DDoS?

A DDoS (Distributed Denial of Service) attack is an attempt to make a server, service, or network resource unavailable by overwhelming it with much more traffic than it can normally handle. These attacks are carried out by coordinating multiple computer systems (usually a Botnet network). The main purpose is to overload the target system, preventing legitimate users from accessing it. A DDoS attack can target a website, an online game, an API, or any internet-connected service.

1.2. Difference Between Denial of Service (DoS) and DDoS

A Denial of Service (DoS) attack is an attack from a single source. That is, a single computer or network connection attempts to overload the target system. A DDoS attack, on the other hand, as the name suggests, is carried out in a distributed manner, that is, from multiple sources (botnet). This makes DDoS attacks much more powerful and difficult to detect than DoS attacks.

1.3. The Concept of Botnet and Its Role in DDoS Attacks

A Botnet is a network of computers that have been infected with malicious software and are controlled remotely by an attacker. These computers are often used in DDoS attacks without the users' knowledge. Botnets can consist of thousands or even millions of computers, which significantly increases the power of DDoS attacks. The size of the Botnet network directly affects the potential impact of the attack.

2. Types of DDoS Attacks

2.1. Volumetric Attacks

Volumetric attacks aim to overwhelm the target system with a large amount of traffic. These types of attacks usually block legitimate users from accessing by consuming network bandwidth. The most common types of volumetric attacks are:

• UDP Flood: Network bandwidth is consumed by sending a large number of UDP packets to the target system.
• ICMP Flood (Ping Flood): System resources are consumed by sending a large number of ICMP (Ping) packets to the target system.
• SYN Flood: TCP connections are attempted to be established by sending a large number of SYN (synchronization) requests to the target server. While the server tries to respond to these requests, its resources are exhausted, and it becomes unable to serve legitimate users.

2.2. Protocol Attacks

Protocol attacks target vulnerabilities in network protocols. These types of attacks often cause denial of service by consuming server resources. The most common types of protocol attacks are:

• SYN Flood (Repeat): A more advanced version of the SYN Flood attack mentioned in volumetric attacks.
• ACK Flood: System resources are consumed by sending a large number of ACK (acknowledgment) packets to the target system.
• Ping of Death: The system is crashed by sending a very large ICMP packet to the target system. (Most systems are protected against this type of attack today.)
• NTP Amplification: By exploiting the weaknesses of NTP (Network Time Protocol) servers, requests are sent to NTP servers by impersonating the attacker's IP address. NTP servers send large responses to these requests, and these responses are directed to the target system. In this way, the size of the requests sent by the attacker increases exponentially, and the target system is overloaded.
• DNS Amplification: Similar to the NTP Amplification attack, it is carried out by exploiting the weaknesses of DNS (Domain Name System) servers.

2.3. Application Layer Attacks (Layer 7 Attacks)

Application layer attacks target the vulnerabilities of web applications. These types of attacks are usually carried out via HTTP requests and cause denial of service by consuming server resources. The most common types of application layer attacks are:

• HTTP Flood: Server resources are consumed by sending a large number of HTTP requests to the target server.
• Slowloris: Server connections are kept open by sending HTTP requests to the target server slowly, preventing legitimate users from establishing connections.
• POST Flood: Server resources are consumed by sending large POST requests to the target server.

3. Effects of DDoS Attacks

3.1. Financial Losses

DDoS attacks can cause significant financial losses for target companies. These losses can stem from various factors, such as revenue losses due to service outages, reputational damage, customer loss, and the costs of recovering from the attack. These losses can be much greater, especially for e-commerce sites and online service providers.

3.2. Loss of Reputation

DDoS attacks can seriously damage the reputation of the targeted company. Customers may lose trust in the company due to service interruptions and may turn to competing companies. In addition, media coverage of the attack can also negatively affect the company's reputation.

3.3. Customer Loss

Service interruptions and loss of reputation can lead to customer loss. Customers may not want to trust a company that experiences constant service interruptions and may prefer competing companies. This situation can be much more pronounced, especially in highly competitive industries.

3.4. Operational Challenges

DDoS attacks can negatively affect the operational processes of targeted companies. The failure of systems during an attack can prevent employees from doing their jobs and disrupt business processes. In addition, recovery efforts from the attack can bring an additional operational burden.

4. Ways to Protect Against DDoS Attacks

4.1. Strengthening Network Infrastructure

Strengthening the network infrastructure is one of the most basic measures that can be taken against DDoS attacks. In this context, the following steps can be taken:

• High Bandwidth: Having a high bandwidth network connection makes it more resistant to volumetric attacks.
• Redundant Infrastructure: Redundant servers and network connections ensure the continuity of service in the event of a server or connection failure.
• Content Delivery Network (CDN): CDNs reduce server load and distribute the impact of attacks by storing content on servers in different geographic locations. CDN providers such as Cloudflare also offer DDoS protection.

4.2. Firewalls and Intrusion Detection Systems

Firewalls and intrusion detection systems (IDS) monitor network traffic to detect and block suspicious activities. These systems can help reduce the impact of an attack by detecting DDoS attacks at an early stage. In addition, advanced firewalls can also provide protection against application layer attacks.

4.3. DDoS Protection Services

DDoS protection services offer solutions specifically designed to detect and prevent DDoS attacks. These services are usually cloud-based and filter suspicious activities by analyzing network traffic. Many hosting companies and security companies offer DDoS protection services. For example, providers like Cloudflare protect websites and applications by offering both CDN and DDoS protection services.

4.4. Rate Limiting and Traffic Shaping

Rate limiting prevents server overload by limiting the number of requests from a source within a specific time frame. Traffic shaping, on the other hand, prioritizes network traffic, ensuring that important traffic is processed first. These techniques can help reduce the impact of DDoS attacks.

4.5. Blackholing and Sinkholing

Blackholing is a technique used to completely block attack traffic. In this technique, attack traffic is sent to a "black hole" that leads nowhere. Sinkholing, on the other hand, redirects attack traffic to a "fake server," preventing the attacker from reaching the real server.

5. DDoS Attack Prevention Steps

You can follow the steps below to protect against DDoS attacks:

1. Risk Assessment: First, conduct a risk assessment to determine which systems and services are vulnerable to DDoS attacks.
2. Create Security Policies: Create a security policy that defines the measures to be taken against DDoS attacks and the procedures to be followed.
3. Strengthen Network Infrastructure: Increase your network connection to high bandwidth and create redundant infrastructure.
4. Install Firewalls and IDS/IPS: Install firewalls and intrusion detection/prevention systems to monitor network traffic and block suspicious activities.
5. Use a DDoS Protection Service: Use a DDoS protection service specifically designed to detect and block DDoS attacks.
6. Implement Rate Limiting and Traffic Shaping: Implement rate limiting and traffic shaping techniques to prevent server overload.
7. Create an Incident Response Plan: Create an incident response plan that defines the steps to be taken in the event of a DDoS attack.
8. Regularly Update Systems: Regularly update software and operating systems to close security vulnerabilities in systems.
9. Train Employees: Train employees about DDoS attacks and other cybersecurity threats.
10. Conduct Attack Simulations: Conduct regular attack simulations to prepare for DDoS attacks.

6. Real-Life Examples of DDoS Attacks

6.1. GitHub DDoS Attack (2018)

In 2018, GitHub, a popular software development platform, suffered one of the largest DDoS attacks in history. The attack reached a traffic volume of 1.35 Tbps and was carried out by exploiting the weaknesses of memcached servers. GitHub successfully mitigated the attack thanks to Cloudflare's DDoS protection services.

6.2. Dyn DDoS Attack (2016)

In 2016, DNS service provider Dyn was hit by a major DDoS attack. The attack was carried out using the Mirai botnet and caused many popular websites such as Twitter, Spotify, and Reddit to become inaccessible. This attack highlighted the importance of the security of Internet of Things (IoT) devices.

6.3. BBC DDoS Attack (2015)

In 2015, the British Broadcasting Corporation (BBC) was hit by a major DDoS attack. The attack caused the BBC's website and other online services to become inaccessible. A hacker group called New World Hackers claimed responsibility for the attack.

7. Frequently Asked Questions (FAQ) About DDoS Attacks

• 7.1. What are the symptoms of a DDoS attack?

The symptoms of a DDoS attack may include:

• Website or service slowdown or inaccessibility
• An abnormal increase in network traffic
• Excessive use of server resources (CPU, memory)
• Connection errors
• 7.2. How is a DDoS attack detected?
• A DDoS attack can be detected by monitoring network traffic and detecting abnormal activity. Firewalls, intrusion detection systems, and DDoS protection services can help detect attacks.
• 7.3. How to recover from a DDoS attack?
• The following steps can be taken to recover from a DDoS attack:
• Enable DDoS protection service
• Apply rate limiting and traffic shaping
• Use blackholing or sinkholing techniques

Strengthen network infrastructure

• Implement the incident response plan
• 7.4. Is a DDoS attack legal?
• A DDoS attack is illegal in many countries and can have serious consequences. Attackers may face sanctions such as imprisonment and fines.
• 7.5. Are Stresser services legal?
• No, Stresser services are generally not legal. Although these services are designed to simulate DDoS attacks, they are often used for malicious purposes and pave the way for illegal activities. The use of such services is considered a crime in many countries.

8. DDoS Attack Overview with Tables

8.1. DDoS Attack Types Comparison

8.2. DDoS Protection Methods Comparison

9. Code Examples

9.1. Rate Limiting (Python Flask)

from flask import Flask, request, jsonify
from flask_limiter import Limiter
from flask_limiter.util import get_remote_address

app = Flask(__name__)

# Rate limiting configuration
limiter = Limiter(
    app,
    key_func=get_remote_address,
    default_limits=["200 per day", "50 per hour"]
)

@app.route("/api/data")
@limiter.limit("10 per minute")  # Limit of 10 requests per minute
def get_data():
    return jsonify({"message": "Data retrieved successfully!"})

if __name__ == "__main__":
    app.run(debug=True)
    

This code example demonstrates a simple rate limiting application using the Python Flask framework. The flask_limiter library is used to limit the number of requests from a specific IP address.

10. Conclusion and Summary

DDoS attacks are one of the biggest threats to the internet today. These attacks can cause financial losses, reputational damage, customer loss, and operational difficulties. To protect against DDoS attacks, it is important to strengthen network infrastructure, use firewalls and intrusion detection systems, utilize DDoS protection services, and implement techniques such as rate limiting. In addition, training employees and creating incident response plans also ensures preparedness against attacks. It should be remembered that DDoS attacks are a constantly evolving threat, so security measures must be continuously updated and improved.