Cyber threats have become increasingly sophisticated, with Distributed Denial of Service (DDoS) attacks being one of the most prevalent and damaging forms. An attack of this kind tries to flood a server, service, or network with so much traffic that it crashes or its underlying infrastructure goes down.
Comprehending the diverse types of DDoS attacks is vital for companies and individuals to safeguard their online presence. This article explores cybercriminals’ different methods to disrupt services, illustrated through case studies and real-world examples.
Volumetric: Overwhelming the Bandwidth
They are the most common type of DDoS attack. One notable example was at a significant financial institution in 2014, where hackers utilised a botnet to generate massive traffic, peaking at 400 Gbps. This surge caused considerable downtime, affecting customers and leading to substantial financial losses.
A specific form of volumetric is the DNS amplification. Hackers use this method to exploit open DNS resolvers to flood the target with amplified traffic. A significant case was the 2016 of a leading web hosting provider, which reached traffic volumes of 1.2 Tbps. This incident highlighted the catastrophic potential of volumetrics when left unchecked.
Protocol: Exploiting Network Protocols
This type of attack, also known as state-exhaustion attacks, targets weaknesses in network protocols. One infamous example is the SYN flood, in which a hacker sends a barrage of SYN requests to a target’s server, leaving it unable to process legitimate requests.
In 2013, a prominent example of a protocol occurred against a large American technology company. The hackers used a SYN flood to exhaust the server’s connection queue, causing significant service disruptions. This event emphasiszed the need for robust network infrastructure capable of withstanding protocol-based threats.
Application Layer: Targeting Web Applications
Application layers are highly sophisticated and target the top layer of the OSI model. A notable case was the 2015 attack on a popular social media platform. Hackers leveraged a botnet to send many HTTP requests, causing the platform to crash.
They are hazardous because they mimic legitimate user behaviour, making them difficult to detect. The 2015 incident underscored the importance of deploying advanced monitoring tools and behavioural analysis to identify and mitigate application layer attacks.
IoT-based: Exploiting Connected Devices
With the proliferation of the Internet of Things (IoT), cybercriminals have found new avenues to launch DDoS attacks. The Mirai botnet in 2016 is a prime example, where hackers compromised thousands of IoT devices, including cameras and routers, to launch a DDoS attack against a primary DNS provider.
This attack, which caused widespread disruption across numerous websites and services, highlighted the vulnerabilities inherent in IoT devices. It emphasised the need for manufacturers to implement more robust security measures and for users to update and secure their devices regularly.
Ransom DDoS: Extortion Through Disruption
Ransom DDoS (RDoS) combine the disruptive power of DDoS attacks with the financial motivation of ransomware. A notable example occurred in 2020 when a series of RDoS targeted financial institutions and e-commerce platforms, demanding substantial payments in cryptocurrency.
These can be particularly devastating as they disrupt services and burden the victims financially. The 2020 incidents served as a stark reminder of cybercriminals’ evolving tactics and the importance of proactive defence measures.
Understanding the types of DDoS attacks is crucial for developing effective defence strategies. Each type presents unique challenges, from volumetric and protocol attacks to sophisticated application layer and IoT-based threats. Case studies, such as the 2016 Mirai botnet and the 2015 social media platform attack, illustrate the real-world impact of these threats. By staying informed and implementing robust security measures, organizations can better protect themselves against the ever-evolving landscape of cyber threats.
