What is a Denial-of-Service (DoS) Attack?
A denial-of-service (DoS) attack is an intentional cyberattack carried out on networks, websites, and online resources to restrict access to its legitimate users. This is usually done by overloading the target network or site with fake system requests, preventing legitimate users from accessing it, sometimes crashing or damaging a system outright. DoS attacks may last anywhere from a few hours to many months.
A common type of DoS attack that is prevalent on the web is called the distributed-denial-of-service (DDoS) attack that relies on infected computers or devices from around the world in a coordinated effort to block access.
KEY TAKEAWAYS
1. A denial-of-service (DoS) is a form of cyberattack that prevents a rightful user from accessing a computer system, platform, or website.
2. In a DoS attack, rapid and continuous online requests are sent to a target server in order to overload the server’s bandwidth.
3. Distributed-denial-of-service (DDoS) attacks leverage a wide web of computers or devices infected with malware that launch a coordinated barrage of meaningless online requests, blocking legitimate access.
How Denial-of-Service Attacks Work
DoS attacks are on the rise because as businesses and consumers use more digital platforms in communicating and transacting with each other; these cyberattacks target digital intellectual property and infrastructures. Cyberattacks are typically launched to steal personally identifiable information (PII), causing considerable damages to the businesses’ financial pockets and reputation. Data breaches can target a specific company or a host of companies at the same time. A company with high-security protocols in place may be attacked through a member of its supply chain with inadequate security measures. When multiple companies have been selected for an attack, the perpetrators can use a DoS approach.
In a DoS attack, the cyberattackers typically use one internet connection and one device to send rapid and continuous requests to a target server to overload the server’s bandwidth. DoS attackers exploit a software vulnerability in the system and proceed to exhaust the RAM or CPU of the server. The damage in loss of service done by a DoS attack can be fixed in a short time by implementing a firewall with allowing and deny rules. Since a DoS attack only has one IP address, the IP address can be easily fished out and denied further access using a firewall. However, there is a type of DoS attack that is not so easy to detect – a distributed-denial of-service (DDoS) attack.
Distributed-Denial-of-Service (DDoS) Attack
A distributed-denial-of-service (DDoS) attack uses multiple infected devices and connections spread around the world as a botnet. A botnet is a network of personal devices which have been compromised by cybercriminals without the knowledge of the owners of the devices. The hackers infect the computers with malicious software to gain control of the system to send spam and fake requests to other devices and servers. A target server that falls victim to a DDoS attack will experience an overload due to the hundreds or thousands of phony traffic that comes in. Because the server is attacked from multiple sources, detecting all the addresses from these sources may prove difficult. Also separating legitimate traffic from the fake traffic may also be impossible to do, hence, another reason why it is hard for a server to withstand a DDoS attack.
Unlike most cyberattacks that are initiated to steal sensitive information, initial DDoS attacks are launched to make websites inaccessible to their users. However, some DDoS attacks are used as a façade for other malicious acts. When servers have been successfully knocked down, the culprits may go behind the scenes to dismantle the websites’ firewalls or weaken their security codes for future attack plans.
A DDoS attack can also be used as a digital supply chain attack. If the cyberattackers cannot penetrate the security systems of their multiple target websites, they can find a weak link that is connected to all the targets and attack the link instead. When the link is compromised, the primary targets would automatically be indirectly affected as well.
DDoS Attack Example
In October 2016, a DDoS attack was carried out on a domain name service (DNS) provider, Dyn. Think of a DNS as the internet’s directory that routes your request or traffic to the intended webpage. A company like Dyn hosts and manages the domain name of select companies in this directory on its server. When Dyn’s server is compromised, this also affects the websites of the companies that it hosts. The 2016 attack on Dyn, flooded its servers with an overwhelming amount of internet traffic, thereby creating a massive web outage and shutting down over 80 websites including major sites like Twitter, Amazon, Spotify, Airbnb, PayPal, and Netflix.
Some of the traffic was detected from a botnet created with malicious software known as Miraithat seemed to have affected over 500, 000 devices connected to the internet. Unlike other botnets that capture private computers, this particular botnet gained control over the easily accessible Internet of Things (IoT) devices such as DVRs, printers, and cameras. These weakly secured devices were then used to make a DDoS attack by sending an insurmountable number of requests to Dyn’s server.
Cyber vandals keep coming up with new ways to commit cybercrime either for fun or profit. It is imperative that every device that has access to the internet have security protocols in place to restrict access.