DoS Attacks and DDoS Attacks - Chicks in Business

What Causes DoD Attacks?

Humans are responsible for web-based DoS and “distributed DoS” (DDoS) attacks. Humans are responsible for both deliberate and unintended Denial of Service (DoS) assaults. The reasons vary but can be classified into five motivations:

Criminal Intent DoS . The human object is a criminal activity. These Denial of Service (DoS) attacks are the most typical, ranging from compensation of an individual to DoS a firm during a main event, to obstructing competitive players, to a ransom as a motivational force for payment to a “DDoS Extortion” to a distraction away from a different illegal penetration/data theft. It is important to recognize the human elements that lead to activities that are considered illegal in society for all of these different types of Distributed Denial of Service.

Protesting, Politics, and Principled Passion DoS. DoS attacks done for the purpose of making a political statement or expressing a strong belief are the second most frequent type of such assaults. An illustration of DoS Protesting is when people come together to subject whaling operations to a distributed denial of service. Students in China initiated denial-of-service attacks on the Japanese State Education board in response to the “new official history” in an act of protest. It is important to keep in mind that a Denial of Service protest can have a large effect on the Web. Back in the day, this just meant having an internet connection that was slower. A demonstration of denial of service can negatively affect hospitals, telephone services, and other important facilities today.

Nation-State Actors, State Controlled Influence Campaigns & Terrorist DoS. It is obvious that nation-state cyber criminals can conduct denial-of-service assaults, yet this seems to be forgotten frequently. The Internet is an international battlespace. Counties at war are likely to utilize the Internet as a component of their confrontation. Including strategies to tackle internet disputes between nations would be a crucial part of creating a system that is resilient to Denial of Service (DoS) attacks. However, most “state interests” DoS attacks are conducted indirectly, either through manipulation campaigns or by terrorist groups. An exemplary illustration of a state actor making use of “influencers” to disrupt Estonian interests is the assault in 2006.

Corporate Competition. Corporations do compete. Certain locations have an unmistakable comprehension to carry out operations in an open and unbiased manner. However, that is only valid for particular regions of the planet. Other groups could have other businesses “hire” DoS to cause shame to their competition in the center of an event. It is certainly possible to interpret the statement in terms of something like cyberpunk, Shadowrun, or Necromancer; however, it should not be disregarded as merely a Human Denial of Service Incentive.

Whoops – Unintentional Mistakes. The fifth factor is not in fact a factor that encourages someone, simply a result. Some of the most serious DoS events were not deliberately carried out but were unintended results. The Morris Worm serves as an example of where the aim was not to cause a Denial of Service to networks around the world. The Slammer worm was mistakenly released due to what seemed like a routine test, which ended up having disastrous effects. No matter how carefully we get ready for Denial of Service attacks, we must bear in mind that people can be prone to mistakes that may end up having detrimental consequences. Don’t get caught in a “failure of imagination.”

There are many reasons people launch DDoS Attacks. It is not apparent why some of these motives exist or is part of a bigger plan.

Types of DDoS Attacks

There are three fundamental forms of denial-of-service and distributed-denial-of-service attacks:

Volume (i.e. Network) based: This form of attack involves large numbers of requests being sent to the target system, and the system may perceive them to be valid requests (i.e. spoofed packets) or invalid requests (i.e. malformed packets). The goal of a volume-based attack is to overwhelm your network capacity. The requests can be across a range of ports on your system. One type of method hackers use is UDP amplification attacks, whereby they send a request for data to a third-party server spoofing your server’s IP address as the return address. The third-party server then sends massive amounts of data to your server in response. In this way, a hacker needs only to dispatch small requests himself, but your server will ultimately get lambasted with the “amplified” data from the third-party servers. There could be tens, hundreds, or thousands of systems involved in this form of attack.
Protocol-based: Protocol-based attacks are performed on load balancers or servers which exploit the way that systems communicate with each other. The packets can be designed to make the server wait for a non-existent response during the normal handshake protocol, e.g. an SYN flood for example.
Application-based: Hackers use known vulnerabilities in the web server software or application software to try to cause the web server to crash or hang. One common type of application-based attack is to send partial requests to a server to attempt to use up (i.e. make busy) the entire database connection pool of the server which in turn blocks legitimate requests.

Preventative Measures

The first action to take in getting ready for a possible attack is to create a remote site monitoring program that will alert you when your e-commerce shop is lagging or completely shuts down. On the simple and cheap end, I use a service called BinaryCanary for many of our clients, but if you self-host with Amazon Web Services you can also set up hardware performance alarms via their CloudWatch service, which tracks various network I/O metrics and can also signal performance degradation, indicating that your store may be under a DoS or DDoS attack.

Consider setting up an external logging service, as well. If your shop experiences any kind of assault, the web server logs may still be retrievable from another place.

Setting your DNS nameservers to a DDoS mitigation service like CloudFlare is beneficial. This could be advantageous in the future when it comes to making it tougher for cybercriminals to identify the real spots (for example, IP addresses) of your servers. This can be a great defensive barrier for small to medium businesses who may not usually be ready to fight off large-scale attacks. It can be placed in front of their actual equipment in order to shield them from the attack.

How to Know You’re Under Attack

Despite you receive a warning that a DoS or DDoS attack might be in progress, you are unlikely to be able to work out its precise aim or origin. Nevertheless, there are some warning signs to be vigilant for.

The website becomes extremely slow or totally unresponsive, for long periods of time and may or may not show signs of intermittent relief throughout the day.
You contact your IT department, technical provider or Internet Service Provider (ISP) to restart your webserver (or you attempt to do so yourself) and after doing so the problem persists.
You additionally discover that your server logs are overrun with massive amounts of activity, from one or many more IP addresses, but you can sometimes identify sets of the same IP addresses appearing in the logs very frequently.

It is important to remember that certain situations which could be seen as a denial-of-service attack may actually be caused by a web server that is operating incorrectly or is experiencing storage or database issues due to the amount of activity it is receiving.

How to Mitigate the Attack

Cyber-attacks of the DDoS variety are usually complex and sometimes involve defects in the low-level operating systems or the application software of a web server. An example of this occurred recently with WordPress (WP) where the XML-RPC reflection vulnerability made it simple for malicious people to carry out a DDoS attack against a WordPress website or an eCommerce site powered by WP. It can be difficult to lessen the impact without having expert know-how. If you run a web server on your own premises, you may need to enlist the aid of an outside organization that has expertise in DDoS protection. Incapsula is one such provider.

Attempt to reduce the impact of an assault or try to ward off the attack.

Absorbing the Attack

This could mean creating new servers or supplying new computers and a device to manage traffic optimization. This could prove to be financially costly quite quickly if you are utilizing cloud hosting in the first place. Setting up an n-tier system on your own premises, introducing more physical web servers, arranging and optimizing the application platform, adding a load balancer, etc. are all necessary tools for coping with a large amount of web traffic. Trying to use this method to counteract a DDoS (which is commonly attempted, including by myself) often proves to require a lot of time and effort and rarely works, as the magnitude of the DDoS will far outstrip your capacity to shield yourself against it.

Blocking the Attack

Rather than simply sustaining the assault, this is a superior technique; however, in order to construct a successful relieving scheme, it is essential to use an outside service to examine the traffic. You may happen upon a few IP addresses that are creating the issue. The most desirable outcome would be for you to generate firewall rules to prevent the IP address and continue with your business. If you have your own store, it may be worth investing in caching software, more powerful firewalls, load balancers, and other network devices to increase protection against internal DDoS attacks.

You can protect yourself from DNS-level DDoS attacks by lowering your TTLs (time-to-live) and getting multiple DNS suppliers that will serve as backups. Occasionally, a DNS can be targeted not due to any fault of yours, but because of another individual on the same DNS service.

DoS Reports – Don’t be deceived by DoS Bravado.

Every four weeks, a vendor, operator, or new site will bring up the most massive, serious, and/or significant Denial of Service attack so far. It will be proclaimed that there are new forms of DDoS and that the repercussions of DoS won’t be getting any better; so it’s essential to take action now. Furthermore, there will be conversations about what the future of DoS will look like. A lot of this kind of behavior is misogynistic and driven by boasting about who has been hurt the worst. It doesn’t make sense to continue to advertise one’s capacity to cause devastating DDoS disruption. It implies that building an infrastructure for DDoS resistance that can keep the business running will become increasingly more expensive. However, these reports can be beneficial if you understand their restrictions.

Limitation #1 – Each DoS report is from the point of view of that organization.

No one has a comprehensive, worldwide perspective of DoS activity on the Internet. Every group that provides data regarding Denial of Service has its own perspective, which is founded on the limited extent of their DoS findings. The vendor’s scope of DoS detection is determined by the number of customers that have their DoS Scrubbing boxes installed in their networks and are providing feedback to the vendor. If the vendor is a cloud provider, then they must monitor all deployments of their cloud resources and all DoS traffic that is sent to those locations. This implies that no single report from any individual supplier can give an entire outline of the current happenings regarding DoS on the web.

Limitation #2 – Each DoS report sees the attack type that targets its customers.

ISPs use scrubbing boxes to protect residential customers from gaming attacks. Cloud operators in different areas employ DDoS scrubbing to safeguard Software as a Service implementations and video services offered to their customers. Yet other suppliers have their Denial of Service (DoS) protection implemented in their financial services. All of these are different types of DoS attacks. It highlights the core point. A particular type of attack is often seen by one vendor, but never by another vendor whose customer base differs.

Recommendation – Combined all the surface area of DoS measurements from all the vendors.

Do not disregard any of the vendor accounts, but disregard the DoS boastfulness and use the information to get a better understanding of the situation. Each vendor’s report is valid from its measurement points. Challenge the sellers and find out about their “monitoring checkpoints.” For illustration, if you inquire about Akamai, they would provide an answer stating there are safeguards against DoS detected by the Prolexic Scrubbing Centers, the worldwide Web Application Firewall (WAF) provider, and the all-embracing Akamai Edge Platform. Assaults from gamers carried out towards residential clients would not be detectable from the outside using DoS (denial-of-service) measurement, however, network providers would be able to observe them. Putting all the pieces of the DoS risk assessment together results in an intriguing outlook of current DoS risks.