What is a DDoS attack and how do you prevent it?

A DDoS attack is a type of cyberattack that aims to disrupt the normal operation of a device or service. It is not new, but it can still cause serious damage to many kinds of services. Thousands of DoS attacks happen every day, and the number keeps growing. When a DDoS attack succeeds, legitimate users cannot reach the service. To understand DoS attacks better and how to prevent them, please MONA Media read on.

What is a DoS attack?

A DoS (Denial of Service) attack is a type of cyberattack that overloads a computer system or network so it can no longer serve legitimate user requests. DoS attacks use various techniques, such as sending malformed packets, exploiting software vulnerabilities or using a botnet to amplify the attack. DoS attacks often target the the web server of well-known organizations such as banks, commercial companies, media outlets, government bodies and businesses. 

DoS attacks come in many forms, each exploiting specific weaknesses. A common one is the volumetric attack, which floods the system or server with a huge amount of traffic to overload its bandwidth. Another is the protocol attack, which exploits weaknesses in network protocols to send malformed packets and disrupt the system.

What is a DDoS attack?

A distributed denial-of-service (DDoS) attack is a serious cyber threat in which the attacker deliberately overloads an online resource with a huge amount of traffic. As a result, the web service cannot run normally and may go down completely. This not only disrupts users trying to visit the site, it can also slow down or disable the web server, causing major losses for businesses.

A DDoS attack can last from a few hours to several days, depending on its severity. For businesses and organizations that depend heavily on online platforms, such an attack can have serious consequences. Attackers often pick strategic moments for a DDoS, such as big shopping events like Black Friday, making sites unreachable and causing significant financial damage.

In some cases, attackers can also take advantage of security vulnerabilities during a DDoS attack to break into database and access sensitive information.

What is the difference between a DoS attack and a DDoS attack?

Denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks both aim to disrupt online services, but they differ in how they are carried out. A DoS attack launches from a single machine, usually from one IP address, so it is relatively easy to detect and stop. Once you identify and shut down that machine, the attack can be stopped.

A DDoS attack, by contrast, uses many distributed machines, usually from many different IP addresses. That makes it much harder to stop, because the malicious traffic is spread across many sources and it becomes difficult to tell attack traffic from normal traffic. This is why DDoS attacks are harder to detect and handle: by the time they are noticed, they have already caused significant damage.

What causes a DDoS attack?

Distributed denial-of-service (DDoS) attacks come from many different motives, and understanding them helps you predict and prevent attacks more effectively.

First, some attackers launch a DDoS simply out of curiosity or to prove their skills. These are often young hackers who want to test their abilities and cause minor harm, such as disrupting a school's web service or an online game. Such attacks are usually carried out with various tools. Defending against them is fairly straightforward if the system is professionally protected.

Second, DDoS attacks can be carried out to defend or push an idea, such as a political, social or environmental cause. These attackers usually go after people with opposing views, hoping to cause damage or draw public attention.

Third, in business, some unscrupulous competitors may use DDoS to hurt a rival, especially at sensitive times such as the pre-Christmas shopping season or Black Friday. These attacks are often very large and call for complex defenses.

DDoS attacks are also launched for extortion. The attacker does not stop at attacking: they demand a ransom, usually in cryptocurrency, to call the attack off. These extortionists can be very persistent, and even after protection is in place they keep trying to exploit new weaknesses.

Finally, cyberterrorism is a rare but especially dangerous motive. These attacks may aim at espionage, destroying systems or waging cyber warfare. The attacker can also use DDoS as a diversion to hide more serious hacking, from stealing data to destroying the victim's system entirely.

The consequences of DoS and DDoS attacks

DoS (Denial of Service) and DDoS (Distributed Denial of Service) are two types of network attack that overload and disable online services. When an attack hits, the system or website cannot respond to legitimate user requests, which causes serious consequences such as:

• Service disruption: This is the most direct and serious consequence. A website, application or service under attack becomes unreachable, causing major disruption for users and for the business.
• Loss of important data: In some cases an attack can lead to the loss of important data, causing heavy financial damage and harming the business's reputation.
• Damage to reputation: When a website or service is hit by a DDoS attack, customers, partners and users lose trust in it.
• High costs: Cleaning up after an attack, strengthening security and restoring data all cost time and money.
• Impact on SEO: A website attacked by hackers can hurt the SEO strategy of a person or business. The site may drop in rankings, which reduces the number of users it reaches.
• Lost revenue: Businesses that earn revenue online are hit hard. Customers cannot reach the website to buy goods, book tickets or complete other transactions.

Types of denial-of-service (DDoS) attacks today

Although DDoS has some less complex attack modes than other forms of cyberattack, we still need to be careful, because they keep getting more sophisticated and more powerful. Below are some DDoS attack types seen today.

1. SYN Flood 

SYN Flood is an attack that takes advantage of weaknesses in the TCP connection process, relying on incomplete connections. When a user sends a TCP SYN request, the server never completes the handshake, so the connection does not work.

The attacker uses up all of the server's available resources, so the server has too little capacity left to handle traffic and becomes overloaded. By constantly sending SYN connection requests, the attacker can overwhelm the target servers, leaving clients unable to get through or getting very slow responses.

2. UDP Flood

UDP Flood is a type of DDoS (Distributed Denial of Service) attack that targets servers by sending a huge number of UDP (User Datagram Protocol) packets from many different sources to the target system or server.

The aim of this attack is to saturate bandwidth, use up system resources and leave the server unable to answer legitimate user requests, which leads to a crash of the server or service.

3. HTTP Flood

In this form, hackers exploit HTTP GET or POST requests that look almost legitimate. HTTP Flood attacks use large botnets and thousands of computers that have been taken over through malware. It uses less bandwidth than other attack types, but the servers are forced to use their resources to the maximum.

4. Ping of Death

Ping of Death (PoD), also called an oversized ICMP attack, is a type of network attack aimed at computer systems. In this attack, the attacker sends ICMP (Internet Control Message Protocol) packets that are too large or badly formed to the target server. The server struggles to process these packets, which can lead to a system crash or unstable operation.

5. Smurf Attack 

Smurf is an attack that abuses an IP address and the ICMP protocol through a malicious program called Smurf. The attacker spoofs the source IP address as the target, then pings many ICMP requests to broadcast addresses on many networks. The target IP address receives a flood of extremely large ICMP replies, which slows the network down or leaves it unable to serve anything else.

6. Fraggle Attack 

A Fraggle attack is a type of denial of service (DDoS) attack similar to a Smurf attack: both aim to overload the victim's system by sending a large volume of spoofed network traffic. However, a Fraggle attack differs from a Smurf attack in a few ways.

7. Slowloris

Slowloris is a sophisticated denial of service (DoS) attack aimed at web servers. Unlike traditional DDoS attacks that focus on saturating bandwidth, Slowloris exploits a weakness in how the server handles HTTP connections.

The attacker opens a large number of HTTP connections to the target server. Instead of sending a complete HTTP request, the attacker sends only part of it (the HTTP header) and keeps these connections open for a long time by never sending the rest. The target server is forced to hold these connections open, which uses up system resources and reduces its ability to serve other legitimate requests. When the number of open connections passes the server's limit, the server cannot accept any new connection, and the result is denial of service.

8. NTP Amplification

NTP Amplification is a packet-based attack in which the attacker exploits a running NTP (Network Time Protocol) server, so that the target network or server is overloaded by a large volume of amplified UDP packets.

9. HTTP GET 

The HTTP GET attack is a fairly common type of denial of service (DDoS, Distributed Denial of Service) attack. Here the attacker sends a large number of HTTP GET requests to a web server. The main goal is to overload the server so it cannot handle valid requests from other users, which results in denial of service.

10. Advanced persistent Dos (APDos)

Advanced Persistent DoS (APDoS) is a sophisticated and dangerous form of cyberattack that aims to overload and paralyze computer systems or networks over a long period. Unlike ordinary DDoS attacks, APDoS is usually carried out by organized hacker groups, who combine many attack methods and keep going for a very long time.

APDoS is not simply about sending a large volume of traffic at one target. It combines different attack types such as HTTP Flood, SYN Flood and UDP Flood in order to exploit different weaknesses in the system. APDoS usually targets critical assets such as infrastructure, banks and governments, causing serious economic and social consequences.

Signs of a DDoS attack

Any network user can notice the signs of a DDoS attack through a few common symptoms. The most common signs include:

• Network performance is noticeably slow for ordinary tasks such as downloading or uploading files, logging in to accounts, opening web pages, or streaming audio and video.
• Online resources cannot be reached, such as websites or online accounts like bank accounts, investment portfolios, education materials or health records.
• Several devices on the same network drop out or lose their connection.
• It is not only the main website that suffers: other services such as business email and databases are affected too.
• Many users reach the same page or the same function at the same time.

How to prevent DDoS attacks

A DDoS denial of service attack can happen at any time and can hit even the biggest websites, so completely preventing DDoS is simply not possible. There are still ways to reduce the chance of becoming a victim, or of being used as a tool in a DDoS attack, or of being attacked by hackers, as follows:

Use a premium hosting service

Using a reputable Hosting or Cloud VPS service is an effective way to protect against DDoS attacks. You should choose a Web Hosting provider with a good reputation, one that supplies suitable resources and a well-configured, highly secure website setup, and can support you promptly when a DDoS attack happens. Large hosting and VPS providers usually run advanced security technologies such as a web application firewall (WAF), intrusion detection and prevention systems (IDS/IPS) and dedicated DDoS protection. These technologies detect and block attacks effectively, so you can worry less about protecting your website.

MONA Media provides domains, hosting, Business email and other high-quality services. With more than + 10 years of experience and infrastructure solutions delivered to more than +300.000 clients, MONA offers modern, easy-to-use infrastructure with a strong security system. Our Cloud Hosting runs on fast NVMe drives, with excellent data processing and DDoS protection, so client websites run stably and fast. To find out more, CONTACT 1900 636 648 MONA and our specialist team will give you free advice.

Monitor your traffic

Anticipate an attack by regularly watching your website's traffic so you know which days look unusual. A sudden surge in visits is a sign that a DDoS attack may be about to start.

Blackhole routing

When a DDoS attack hits, a common defense is blackhole routing, where all network traffic, legitimate and malicious alike, is sent to a null route, the “black hole”, and dropped from the network. When an internet product faces a DDoS attack, the internet service provider (ISP) may decide to send all of the website's traffic into the black hole as a first line of defense.

However, if it is not done properly and without specific limiting criteria, this method can cut off all traffic, including legitimate traffic, and randomly drop important network connections. That is risky when attackers use spoofed IP addresses or other attack vectors to exploit this weakness. For organizations with no other effective countermeasure, blackhole routing remains a popular choice, but it must be applied carefully so it does not hurt network operations.

Use a web application firewall

A web application firewall (WAF) is a network security tool that plays an important role in protecting web applications from many kinds of attack, including DDoS. Still, many people wonder how well a WAF holds up against large-scale DDoS attacks.

A WAF can stop attacks aimed at specific weaknesses in a web application, such as SQL injection, XSS, and attacks that exploit configuration errors. By blocking malicious requests at the application layer, a WAF reduces the amount of traffic that reaches the server, eases the pressure on the system and stops attacks from spreading.

Keep spare bandwidth in reserve

DDoS attacks mainly work by overwhelming a system with heavy traffic, so having bandwidth in reserve is a useful safeguard against sudden spikes. However, this method can be very expensive, because most of the extra bandwidth usually goes unused.

Spare bandwidth is also becoming less effective against DDoS attacks, because attacks today are bigger and more sophisticated. No amount of bandwidth can withstand attacks above 1 Tbps without additional DDoS mitigation. Even so, keeping spare bandwidth can soften the impact of an attack and buy extra time to take the actions needed to counter the threat.

Rate limiting

Limiting how much traffic can reach the website will slow down a hacker's attack, but this method will not be very effective if the hacker uses more complex DDoS techniques.

Anycast Network Diffusion

Anycast Network Diffusion is a smart networking solution designed to spread incoming traffic across many servers around the world. It greatly reduces the impact of DDoS attacks by distributing the attack traffic and preventing any single server from being overloaded.

How to deal effectively with a DDoS attack

When your servers are under a DDoS attack, you need to act quickly and decisively to limit the damage. Here are some effective ways to respond:

Contact your internet service provider (ISP) 

In any case involving the network, such as a website that cannot be reached, the first person to ask for help is your internet service provider. They have network engineers and highly skilled programmers, so they can analyze the problem, find the target of the attack, and guide you through suitable, effective ways to deal with it.

Contact your hosting provider

A hosting provider supplies and runs the servers, so you can contact them with any server-related problem. Once they know a server is under attack, they will create a “black hole” to absorb the traffic until the attack stops by itself. At that point both legitimate and illegitimate requests are pushed aside, and this also keeps other customers' servers from being affected. After a while they reroute all the traffic, filter it, and let legitimate requests work normally again.

Contact a technical specialist

If your website or application is attacked on an extremely large and dangerous scale and the methods above cannot solve it, you can ask specialists who analyze and handle DDoS attacks for help. These specialists usually have extremely powerful servers to redirect traffic and remove the illegitimate traffic.

Use an anti-DDoS service

This is also an effective option when you are under DDoS attack. Many providers offer Anti-DDoS services today, and Mona Media is one of the best known. 

The 10+ years of experience providing anti-DDoS solutions for VPS and servers in Vietnam, Mona Media delivers highly effective DDoS protection at a reasonable cost. That makes your system more stable and adds to your business's sales and reputation.

SSL certificate registration

Get SSL certificate and set up the secure connection protocol HTTPS for your website to strengthen data security and guard against hackers and spreading viruses

Frequently asked questions about DDoS

Which websites are the easiest DDoS targets?

A DDoS attack is a serious threat to any website, but some types of website are targeted more often: e-commerce websites, websites of government agencies and state bodies, and the websites of financial companies and online banks.

Can a firewall stop a denial of service (DDoS) attack?

A firewall is an important network security tool, but it still has limits against large-scale DDoS attacks. DDoS attacks generate a huge volume of traffic that exceeds what most firewalls can handle. Even the most advanced firewalls have limits on bandwidth and processing speed, so a firewall alone cannot stop a large-scale DDoS attack.

How long does a denial of service (DDoS) attack last?

The length of a DDoS attack can vary a lot, from a few minutes to a few days or even weeks. It depends on many factors, including the scale of the attack, the attacker's goals, and the protective measures the user has in place,…

In short, a server or website coming under a DDoS denial of service attack is hard to avoid, and no single measure deals with these attacks completely. Even so, with the information above you should now have a fair understanding of DDoS, what a DDoS attack is, and the methods you can use to prevent and handle it.