Basics of DDoS Attacks

What is a DDoS Attack?

A Distributed Denial of Service (DDoS) attack is a type of cyber attack that aims to disrupt the normal functioning of a website, server, or network by overwhelming it with traffic from multiple sources. In a DDoS attack, a large number of devices, usually compromised by malware, are coordinated to send requests or data to the target system, causing it to become unresponsive or unavailable to legitimate users.

Types of DDoS Attacks:

1. Volumetric attacks: This type of DDoS attack aims to flood the target system with a high volume of traffic, consuming the system’s bandwidth and resources. Examples of volumetric attacks include UDP floods, ICMP floods, and DNS amplification attacks.
2. Protocol attacks: Protocol attacks exploit weaknesses in the protocols used to communicate between devices and servers. These attacks may include SYN floods, which attempt to overwhelm a server by sending a large number of SYN packets, or ICMP floods, which use a large number of ICMP packets to overload the target system.
3. Application layer attacks: Application layer attacks are focused on overwhelming a specific application or service running on the target system. These attacks are more sophisticated and harder to detect than other types of DDoS attacks, and can be particularly harmful to web servers, online gaming platforms, and other web applications. Examples of application layer attacks include HTTP floods, Slowloris attacks, and SQL injection attacks.

Tools used for DDoS Attacks:

Attackers often use botnets, a network of compromised devices, to carry out DDoS attacks. These botnets can be created using malware such as Mirai, which can infect IoT devices such as routers, cameras, and smart home devices. Other tools commonly used for DDoS attacks include:

1. LOIC (Low Orbit Ion Cannon): A popular tool used for launching DDoS attacks that floods a target with HTTP requests.
2. HOIC (High Orbit Ion Cannon): A more powerful version of LOIC that allows attackers to launch DDoS attacks with more bandwidth.
3. Xerxes: A tool that allows attackers to launch HTTP floods and TCP floods against a target system.
4. Slowloris: A tool that sends HTTP requests to a target system at a slow rate, causing it to become unresponsive.

Tools used to prevent and detect DDoS Attacks:

1. Firewalls: Firewalls can be used to block traffic from known sources of DDoS attacks.
2. Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS): IDS and IPS can be used to detect and block suspicious traffic patterns that may indicate a DDoS attack.
3. Content Delivery Networks (CDN): CDNs can be used to distribute traffic across multiple servers, reducing the impact of a DDoS attack on any one server.
4. Anti-DDoS Services: Many companies offer anti-DDoS services that can detect and block DDoS attacks in real-time. These services can also provide additional protection against application-layer attacks.

Azure DDoS Protection Plan:

Azure’s DDoS Protection Plan is a service that provides additional protection against DDoS attacks for Azure resources, including virtual networks, load balancers, and application gateways. The service is available in two tiers: Basic and Standard.

The Basic tier provides automatic mitigation for common DDoS attacks, including volumetric and protocol attacks. The Standard tier provides additional protection against application-layer attacks, as well as detailed telemetry and reporting for DDoS events.