What is a DDoS attack?

DDoS attack stands for Distributed Denial-of-Service attack and represents a cyber-attack that aims to disrupt normal traffic and make the target (website, server, network) unavailable for regular users. There are few different types, but in general, a DDoS attack is an attempt to overwhelm the target (a computer, few connected computers or a whole DNS network) with high traffic from multiple sources.

The cybercriminals can generate this strong wave of traffic by:

• Using a network of pre-infected devices (computers, mobiles, IoT devices, etc.)  called a botnet
• Amplify attack that uses other servers to resend the traffic to a target after significantly increasing the size of the packets
• Occupy the existing connection and not allow new ones
• Exploit the vulnerabilities of a protocol, such as the UDP or another. 

There are many DDoS threats, this is why you want to a DDoS defense too. DDoS attack protection could keep your business safe and notify you of problems.

How does it work?

There are different types of DDoS attacks (volume-based attacks, protocol-based attacks, and application-layer attacks), but in general, they all have the same stages:

1. Pre-production of the attack. At this moment, the cybercriminals will create a network of botnets (infected devices) that later they will use for attacks. For example, hackers can bypass the security of IoT devices, or they can send phishing emails to users, and when the users open the emails, they can get infected with malicious code. 
2. Launching of the attack. Now it is time to use the botnet. Time for choosing a victim and sending the traffic towards the targeted server. There are different reasons for the attacks, but the goal is to saturate the target with traffic and take it out of service. 
3. The success of the attack. After a while, if the target does not have DDoS attack protection, or it is not strong enough, eventually it won’t be able to function correctly. There is a limit to how many active connections a server can have, even if it is very powerful. It will start to deny service and stop working. Normal users will not be able to use the server until the traffic drops again and the server can begin responding to normal queries. 
4. Final result. The bad actors could have achieved different goals, and now they get their reward. It could be money or just satisfaction with the success of the attack.

Signs of DDoS attacks 

DDoS attacks are extremely harmful and could lead to large reputational and financial losses. That is why it is crucial to be mindful and observe for any early signs of an appearing attack. There are specific characteristics of each DDoS attack type, but in general, what you can expect during an attack is: 

• Strange traffic, coming from one IP address or various but similar IP addresses (same range of addresses). 
• Traffic coming from devices with a similar profile (the type of devices, OS, etc.) and same patterns. 
• Out-of-ordinary traffic spikes like a huge spike, in the middle of the night without any sense or repeatable traffic, with a particular interval. 
• Traffic only to a single page, and no further exploration of your website.  

DDoS vs. DoS 

Let’s first briefly define a Denial of Service (DoS) attack. In this type of online attack, a source is maliciously infected in order to send big amounts of traffic to a target. The purpose is to saturate the system, to make it crash by exhausting its technical resources (CPU, RAM, etc.), or by exploiting a specific vulnerability and injecting a proper, harmful input. Then the service for users will be denied.

Now, let’s jump to the differences between DDoS vs. DoS attacks:

• Sources for attacking. In DoS attacks, the perpetrator only needs one Internet-connected device (source) to flood its victim with lots of forged requests or exploit a specific vulnerability within its software. DDoS attacks are executed from multiple sources, thousands, even millions of devices connected to the Internet.
• Way of execution. Generally, DoS weapons are apps like Low Orbit Ion Cannon or homemade codes. DDoS perpetrators use botnet armies, massive groups of malware-infected devices like PCs, routers, mobiles, Internet of Things (IoT) connected to the Internet. The traffic a DDoS attack can produce is heavy, much bigger than a DoS attack can.
• Damage scope. Both attacks can be very aggressive. But still, modern technology makes it easier to defend and even track the malicious source of a DoS attack, increasing the chances of identifying it and defeating it. It becomes a one-to-one fight (DoS). During a DDoS attack, you are fighting against multiple devices, possibly located in different countries or continents. You would have to track and stop all of them simultaneously. This is more like a war, and it definitely will demand so much more time and resources for the victim to defend and try stopping the attack. Thus, the damage scope of a DDoS is wider than the DoS one.

DDoS attacks Protection

There is a solution that can stop most of the DDoS attacks, even a strong attack involving heavy traffic, called DDoS Protection. It is an additional service to a regular managed DNS plan. 

To successfully mitigate a DDoS attack, you need to have the following 3 elements:

1. Active monitoring. You need a Monitoring solution system that checks for signs of attacks like increased traffic, suspicious traffic from particular IP addresses, and strange patterns of requests. 
2. Reactive service. One thing is to see the danger. Another is to take action. Good DDoS protection service must have auto triggers that will take action. This may include load balancing, traffic filtering, and an alarm system. 
3. Traffic load balancing. When we talk about heavy traffic, you need to direct the traffic to more servers. That way, you will balance the hit on one and disperse it to more. The more DNS servers your plan includes, the better possibility you have to resist the DDoS attack. 

You need to have an intelligent DDoS attack protection service that can distinguish between heavy traffic because of your excellent promotion or real danger. You don’t want to block your real users at any moment.

Discover Web monitoring from CloUDNS

What is the motivation of DDoS attackers?

Cybercriminals can have multiple reasons to use a DDoS attack, and the most common are:

• Extortion. The attacks can send waves of traffic towards the target and disturb the functionality of its services, causing technical problems, downtime, and miss of sales, demanding money for stopping the DDoS attack.
• DDoS-for-hire to attack the competition. On the Dark Web, people can hire hackers for DDoS attacks. Some people pay for such an attack to be directed towards their competitors. It is especially popular during important sales moments like Christmas, Black Friday, Cyber Monday, or Easter promotions. If the competitor is down, it won’t receive visitors on its site, and they will go to another place. The one who paid the attack hopes a part of these visitors directs to its site.
• Cyberwarfare. The governments of some countries use DDoS attacks to target the opposition’s news sites, their communication, or other crucial services. The goal is to control the narrative and not allow free speech in their country. These attacks could be especially strong because countries have a lot of money for sponsoring them.
• Gamers’ conflicts. You could be surprised, but the gaming industry has already reached almost 200 billion dollars in revenues per year, so the stakes are high. Rival gamers use DDoS attacks to bother their competitors and try to lower their scores. Sometimes, they use DDoS to stop a competition game they are losing and demand a re-match.
• Hacktivism. Hackers also have an opinion. They might have a problem with the government, with a particular organization or event. Modern activism has many new ways to protest and express a point that includes cyberattacks.

Types of DDoS attacks

Over time, cyber criminals managed to create multiple technical approaches for taking out their victims through DDoS. Each of the techniques falls into one of the three general types of DDoS attacks, which are the following: 

Volume-Based or Volumetric Attacks

These are the most classic type of DDoS attacks. They use different methods for generating massive volumes of traffic to overwhelm the capacity of the victim’s resources. As a result, servers are overwhelmed with requests, networks are overwhelmed with traffic, and databases are overwhelmed with calls. Additionally, they saturate bandwidth and produce large traffic, which results in it being impossible for legitimate user traffic to flow into the targeted website.

Protocol Attacks

Protocol attacks, also known as state-exhaustion attacks, abuse protocols to overwhelm a particular resource, most commonly a server but occasionally firewalls or load balancers. They are designed in a way that allows them to consume the processing capacity of network infrastructure resources. Their target is usually Layer 3 and Layer 4 protocol communications and, more precisely, their weaknesses. These attacks are often measured in packets per second.

Application-Layer Attacks

These DDoS attacks target weaknesses in applications in order to force the application itself to fail. In contrast to other attacks that mainly concentrate on disrupting infrastructure, these attacks are initiated on Layer 7 (the Application layer) by opening connections and starting processes and transaction requests that consume limited resources, such as disk space and available memory. Yet, it can even result in overloaded CPUs or exhausted memory, which impacts the server and other applications. Layer 7 attacks are well-known that are difficult to prevent since it can be challenging to distinguish malicious traffic from regular traffic. Application DDoS attacks are usually measured in requests per second.

In real-world cases, criminals can actually use a combination of these types of DDoS in order to increase the intensity of the attack.

Popular DDoS attacks used by hackers

Let’s talk a little bit more about the most popular types of DDoS attacks initiated by cybercriminals!

Smurf Attack

The Smurf attack is performed over the ping tool (ICMP echo request). The ping tool is used to check the reachability of connected devices.  When you send a ping request to the destination address, you should receive a confirmation. In this DDoS attack, the ping is sent to a device but from a masked IP. The return confirmation doesn’t go to the original source, but it is redirected to the target of the attack. All the infected devices will do the same, and they will send the traffic to the victim.

Teardrop Attack

A Teardrop attack works by sending modified, oversized data packets to the victim’s device to make them inaccessible. Frequently, perpetrators use a specific bug for destabilizing the fragmentation codes or the reassembly feature of the TCP/IP protocol. This opens the door for the teardrop attack to happen.
Reassembling the maliciously modified data packets won’t be possible. This will produce repeated attempts to complete the task. And the constant cycle of these repetitions will cause the overlapping of the packets. Finally, to increase the strain, big traffic loads will be sent to the target for a definitive crash.

Ping Of Death

The Ping Of Death (POD) attacks using a common and valid tool with malicious objectives – the Ping command. Altered or oversized data packets are sent to the target through the ping command.
Consider that a correct IPv4 data packet (IP header included) must be 65,535 bytes. This is the standard allowed by the Internet protocol (IP). Perpetrators violate it and make the target struggle while trying to reassemble altered packets repeatedly. Target’s resources like memory will be exhausted, causing different problems, crashing included.
POD became popular because attackers don’t need deep knowledge about its victim, only its IP address.

Slowloris

A highly dangerous attack executed a single computer vs. a server. A sophisticated technique that takes down a server without disrupting the rest of the network’s ports and services. Slowloris operates by sending many partial requests to the server. It keeps sending more and more HTTP headers continuously but without completing those requests. These forged requests keep many connections open to the server for a longer time than usual to overwhelm the maximum concurrent connection pool. As a result, the system will slow down, additional connections from legit users will be denied.

Zero-day DDoS attack

A Zero-day, also called a zero-minute attack, is one that takes advantage of new vulnerabilities. People are not yet aware of them. Usually, those vulnerabilities appear on new updates or patches, but they can also exist since the software is launched. The name of the attack refers to the fact it is happening before the vulnerability perpetrators used is publicly known.

This attack can have a positive purpose when software companies pay people in exchange for reporting vulnerabilities of new products before their official release. But it also points to the reality that attacks are far from disappearing.

Preparing a DDoS attack

To launch a DDoS attack, first, the criminals need to “recruit” enough connected devices that later will generate the traffic. To do so, they infect those machines with different malicious software (from emails, visiting unprotected sites and more) and create so-called botnets – hijacked devices ready to be used when it is time for the attack. There are even markets for botnets, where you can buy an attack on a website of your choice.

The Consequences of DDoS attack

Experiencing such a harmful threat is highly unpleasant and can have a huge negative impact. Some of the possible outcomes of a successful attack include:

• Operational Disruption: One of the immediate consequences of a successful DDoS attack is the disruption of normal operations. Websites become sluggish or entirely inaccessible, leading to frustrated users, decreased productivity, and financial losses. E-commerce platforms, financial institutions, and online services are especially vulnerable, as downtime translates directly into revenue loss and damage to customer trust.
• Financial Loss: DDoS attacks can cause severe financial harm. Businesses may face not only the direct costs of mitigating the attack and restoring services but also indirect costs associated with reputational damage and lost customers. The financial damage can lead to legal consequences, especially if sensitive client information is compromised during the attack.
• Reputational Damage: Trust is a delicate matter in the digital space, and a DDoS attack can destroy it instantly. When customers cannot access services or experience disruptions, they may lose confidence in the affected organization and its ability to protect their interests. Rebuilding a reputation can be a long and difficult process.

How long does a DDoS attack last?

The duration of a DDoS attack can vary significantly based on the resources available to the attackers and the defensive measures of the target. DDoS attacks can last from a few minutes to several weeks. On average, however, most DDoS attacks last for around 24 hours, though some intense attacks can go on for days or even weeks.

Short-duration attacks can be a part of a coordinated strategy where attackers test a target’s vulnerabilities with brief bursts, estimating the response and preparedness of the target’s systems. These “hit-and-run” style attacks can cause considerable disruption in a short time, particularly if they target time-sensitive operations like financial transactions or sales events.

Prolonged DDoS attacks typically aim to exhaust the target’s resources or force them to pay a ransom in exchange for stopping the attack. Long-term attacks can be devastating as they may prevent an organization from functioning entirely, leading to major operational and financial issues.

Preparedness and robust DDoS protection are essential to mitigate the effects of both short and prolonged attacks.

Which industries are being targeted and why?

Certain industries are more frequently targeted by DDoS attacks due to their high online activity, competitive nature, and dependence on continuous uptime. Here are some of the industries most affected and why they are popular targets:

• Financial Services and Banking: Financial institutions are high-value targets due to their critical role in managing and securing funds and customer data. Attackers may aim to disrupt operations, damage reputation, or extort these institutions for ransom. A successful attack on a bank can lead to significant financial loss, operational chaos, and damage to customer trust.
• E-commerce and Retail: Online retail is another major target, especially during peak shopping seasons like Black Friday and holidays. Attacks during these times can severely impact sales revenue, as website downtime directly translates to lost customers and sales.
• Government and Public Sector: Government websites, especially those related to public communication, law enforcement, and emergency services, are frequent targets. These attacks may be politically motivated, intending to disrupt public access to information. Governments are also targeted to disrupt official communication channels.
• Gaming and Entertainment: The gaming industry is particularly vulnerable, as users expect real-time access and responsiveness. Gamers often participate in competitive or time-sensitive events where even short downtimes can lead to significant frustration and financial loss for companies. DDoS attacks are frequently employed to disrupt gaming servers.
• Media and News Websites: News outlets and media websites are also prime targets. Hacktivists may use DDoS attacks to silence certain news outlets or delay the publication of specific content. Attacks on these sites can reduce public access to information, potentially affecting the narrative on important topics.

How to prevent a DDoS attack and stay safe?

The cyber-criminals can make a vast network of botnets, but it doesn’t mean you can’t be protected. ClouDNS provides you two options to stay away from DDoS troubles.

You can choose and subscribe for a DDoS protected DNS.

All plans provide unlimited Layer 3-7 DDoS Protection. Whichever you pick from them, you will be able to use 4 DDoS protected DNS servers, 50+ Anycast locations and unlimited DNS queries. For big companies, we recommend our DDoS Protection L subscription with 400 DNS zones that you can manage.

DDoS Protected Plans

Or you can use a Secondary DNS as a backup DNS, so you always have a backup copy of your DNS records.

It adds resilience, reduce the outage periods by answering requests even if the Master is down.

Conclusion

The more extensive your DNS network is, the better. The massive traffic from the attackers can be distributed between your servers in the different locations, and it will ease the load. Don’t forget that modern DDoS attacks target different communication layers, so you will need intelligent DDoS protection to respond fast and accurately. 

To be safe, always choose quality DNS service provider like ClouDNS.

The post DDoS attacks and how to protect ourselves appeared first on ClouDNS Blog.

What is an HTTP flood attack?

An HTTP flood attack is a form of Distributed Denial of Service (DDoS) attack specifically targeting web servers. In this malicious assault, the attacker overwhelms a web server with an enormous volume of HTTP requests, rendering it incapable of handling legitimate user requests. This tactic capitalizes on the stateless nature of the HTTP protocol, allowing for easy forging and amplification of requests. Such attacks can come from a single source or be distributed across multiple locations, making them harder to trace and block. The simplicity of executing these attacks makes them a popular tool among cybercriminals looking to disrupt online services.

How does it work?

Step 1: Request Amplification

HTTP flood attacks exploit the stateless nature of the HTTP protocol, enabling attackers to forge a vast number of seemingly legitimate requests. These requests are often designed to consume server resources disproportionately.

Step 2: Botnet Deployment

Perpetrators commonly utilize botnets, networks of compromised computers, to amplify the scale and impact of the attack. This distributed approach makes it challenging to trace and mitigate the source of the assault.

Step 3: Targeting Specific Vulnerabilities

HTTP flood attacks may exploit vulnerabilities in web server software, operating systems, or specific applications. By pinpointing weaknesses, attackers maximize the efficacy of their assault.

Types of HTTP flood attacks

In the realm of HTTP flood attacks, adversaries deploy a variety of tactics to overwhelm web servers, each with its own distinctive approach.

• GET Floods: GET Floods are a type of HTTP flood attack that targets the HTTP GET method used in web communication. Attackers send a massive number of GET requests to a web server, designed to look like legitimate user interactions, with the aim of overwhelming the server’s resources and capacity to respond. Imagine your website is a popular restaurant, and suddenly, an overwhelming number of customers flood in, each asking for the menu without any intention of placing an order. GET floods operate similarly, bombarding the server with a surge of requests for information, causing chaos and resource exhaustion.

• POST Floods:  POST Floods focus on the HTTP POST method, which is used for sending data to a server. In these attacks, cybercriminals flood the server with numerous POST requests, often containing seemingly valid data submissions. This flood of requests can strain the server’s CPU and memory resources, causing delayed responses or service disruptions. Picture customers storming in and placing orders at an unprecedented rate, without any regard for the kitchen’s capacity. POST floods emulate this scenario by inundating the server with an excessive number of data-submission requests, pushing the server to its limits and potentially causing it to stumble.

Impact of HTTP flood attack

Picture your website as a bustling city during rush hour and an HTTP flood attack as an unexpected surge in traffic causing digital gridlock. This online congestion not only disrupts normal operations but also leads to inevitable downtime and service interruptions as the server contends with an overwhelming influx of requests.

• Downtime and Service Disruption. Think of your website as a bustling city with countless residents seeking information. An HTTP flood attack is like an unexpected traffic jam, bringing the entire city to a standstill. Downtime and service disruption become inevitable as the server struggles to handle the overwhelming surge of requests.
  Suggested article: Understanding the HTTP status codes

• Financial Loss. Just as a shop loses revenue when forced to close unexpectedly, businesses hit by an HTTP flood attack experience financial setbacks. The loss isn’t just in terms of immediate revenue; it’s also about potential future earnings as user trust takes a hit.
• Reputational Damage. Consider the impact on a brand when its flagship store experiences a sudden closure. Similarly, successful HTTP flood attacks can tarnish a website’s reputation, eroding the hard-earned trust of users. Reputational damage extends beyond the immediate attack, affecting long-term relationships with customers.

5 Signs your website is under HTTP flood attack

Early detection of an HTTP flood attack is crucial for effective response. Here are technical indicators that may signal such an attack:

1. Increased HTTP Request Rates: If your web server logs show a sudden and sustained increase in HTTP GET or POST requests, especially from a range of unusual IP addresses, this could indicate an attack. Monitoring tools can be configured to alert administrators to spikes that exceed baseline levels.
2. Increased CPU and Memory Usage: HTTP flood attacks force the server to handle a massive number of requests, leading to unusual CPU and memory consumption. If your server resources are maxing out unexpectedly, this might be a sign of a flood attack.
3. Slow or Non-Responsive Website: A significant HTTP flood attack can slow down your website or make it entirely unresponsive, as the server struggles to handle the load. If your site becomes inaccessible or experiences frequent timeouts, it may be under attack.
4. Log Files Full of Repetitive Requests: When reviewing server logs, you may notice a large volume of similar requests, often with the same IP range, user agent, or request URL. This repetitive pattern is a hallmark of HTTP flood attacks, as attackers often send requests in bursts.
5. Increased Bounce Rate Without Clear Cause: When legitimate users experience a slow or non-responsive website due to an attack, they are more likely to leave. If you see a sudden increase in bounce rate without an obvious reason, an HTTP flood attack may be the culprit.

Preventive measures against HTTP flood attack

Detecting an HTTP flood attack is akin to being the vigilant lifeguard at a crowded beach.

Monitoring service

Just as a lifeguard watches the ocean for irregularities, detecting HTTP flood attacks involves monitoring for abnormal spikes in web traffic. An unexpected surge signals trouble, prompting a swift response to ensure the safety of the online “beach.” With HTTP/HTTPS Monitoring service you will be able to keep track of the performance and availability of websites, web applications, and web services.

Web Application Firewalls (WAFs)

Think of WAFs as the vigilant eye of the lifeguard tower, surveying the digital sea. These firewalls analyze incoming traffic, identifying and blocking any suspicious activity, acting as a proactive defense against potential threats.

DDoS Mitigation Services

There are services specifically designed to protect against DDoS attacks, including HTTP Floods. DDoD Protection services work by diverting traffic through their networks first, filtering out the bad traffic, and only sending the good traffic to your server.

Implement Content Delivery Networks (CDNs)

CDNs distribute your content across multiple, geographically diverse servers, so it’s closer to your users. This not only speeds up content delivery but also means that traffic is spread out and not directed at a single server, making it harder for an HTTP Flood to have an impact. In addition, at ClouDNS you can build your own CDN with our GeoDNS service. With it you can be one layer protected against these malicious attacks. 

How to create your own CDN using DNS

Creating Redundancies

Have a backup plan, or in technical terms, create redundancies. If one server or network component fails under the load, others can take over. This is like having backup generators ready in case the main power supply goes out.

Conclusion

Though HTTP flood attacks present a real and present danger to web servers, the good news is that they are not insurmountable. By staying vigilant, employing a layered security approach, and embracing both reactive and proactive defense strategies, businesses can effectively dampen the impact of these attacks. Ensuring your website’s resilience in the digital ecosystem is key, allowing you to maintain seamless operations and safeguard your digital assets against such disruptive forces.

The post HTTP flood attack – What is it and How to prevent it? appeared first on ClouDNS Blog.

SYN flood attack: Origin and Basics

In the 1990s, a man named Wietse Venema explained a certain attack method in-depth. On its surface, the concept seems innocuous enough. In a network protocol, namely TCP, a three-way handshake commences communication. Imagine this as a modern chivalry ritual between your computer and the server you want to engage with.

1. You send a SYN (synchronize) packet: “Hi, can we chat?“
2. Server sends back SYN-ACK (acknowledgment): “Sure, let’s talk.“
3. You finish with an ACK: “Cool, let’s get started.“

What SYN flood attack is?

Broadly speaking, a SYN flood attack, also referred to as a TCP/IP-based attack, is a type of Denial of Service (DDoS) attack on a system. It might be compared to an irritating prankster continuously dialing a business phone to keep the line busy and prevent legitimate callers from reaching the establishment. The attacker here sends a flood of SYN requests from either a single or multiple spoofed IP addresses to a server with the malicious intent to halt the server’s functionality to process new incoming service requests. As the server gets trapped in a vicious cycle of responding to these inexistent or half-open connections, it can lead to crashing or becoming unavailable to legitimate users.

How does it work? 

The mechanics of a SYN flood operate in a methodical sequence of steps that exploit the TCP handshake protocol. Let’s break it down for clarity:

Step 1: Identifying the Target

The attacker first picks out the target server. Usually, they’re gunning for a specific service, like a website or an application hosted on that server.

Step 2: Initiating SYN Requests

Here, the attacker commences the mischief by generating a multitude of SYN packets. Each of these SYN packets asks the server, in essence, for permission to establish a connection.

Step 3: Half-Open Connections

Upon receiving a SYN request, the server reciprocates with a SYN-ACK packet and moves the corresponding request to a backlog queue. This places the connection in a “half-open” state, awaiting the client’s final ACK for completion.

Step 4: Server Response

At this juncture, the attacker ghosts the server, never sending the final ACK to complete the handshake. Consequently, the server’s backlog queue starts brimming with incomplete handshakes.

Step 5: Resource Exhaustion

With each half-open connection, the server allocates a chunk of its resources. As these incomplete connections accrue, the server begins to hit its limit on resources.

Step 6: Denial of Service

At this point, the server becomes unable to accept any new connections. Legitimate users trying to connect encounter timeouts or failures, achieving the attacker’s endgame of denying service.

Types of SYN Flood Attacks

SYN flood attacks can take on multiple forms, each with its own level of complexity and associated risks:

1. Direct Attack: In this type of attack, the attacker does not hide their IP address, meaning that all traffic comes from a single source. This makes it relatively easier for network administrators to identify and block the attack by filtering the IP address. However, direct attacks can still overwhelm a server, especially if they come from high-capacity sources.
2. Spoofed Attack: Here, the attacker sends SYN requests using spoofed IP addresses, making it difficult to track the origin of the traffic. The server tries to send SYN-ACK packets to non-existent or unreachable IPs, leaving the connections open and slowly exhausting server resources​. Spoofing adds an extra layer of complexity, making it harder to mitigate, as simply blocking the traffic source won’t solve the problem.
3. Distributed Attack (DDoS): In a distributed SYN flood attack, the attacker uses a botnet – a network of compromised devices – to send SYN requests from various IP addresses. This creates massive amounts of traffic from multiple sources, overwhelming the server and making it extremely difficult to pinpoint and block the attack. This method was infamously used by the Mirai botnet, which leveraged IoT devices to launch one of the largest DDoS attacks in history​.

Ways to mitigate the SYN flood attack

Ah, but there’s hope! Multiple strategies can serve as lifelines in mitigating the fallout from a SYN flood.

SYN cookies

Implementing SYN cookies proves useful in minimizing risk. When deployed, the server doesn’t allocate resources right away for a new SYN request. Rather, it converts the connection into a unique cryptographic cookie. Only when the handshake gets completed does the server expend resources, reducing vulnerability to attacks.

Rate limiting

Another solid tactic involves imposing rate limiting on incoming SYN packets. By setting a strict threshold for the number of allowable new connections per unit of time, the server can effectively nip malicious flood attempts in the bud.

DDoS Protection

Incorporating DDoS protection is an advanced, indispensable strategy. These specialized solutions not only defend against SYN flood attacks but also guard against a broader range of DDoS threats. DDoS protection services usually feature large traffic scrubbing networks that can sift through immense volumes of data, allowing legitimate traffic through while blocking malicious requests.

Anycast DNS

Anycast DNS serves as another invaluable layer of defense. By distributing incoming traffic across multiple data centers (PoPs), it minimizes the load on any single server. This distribution can effectively dilute a SYN flood attack, rendering it far less potent. Anycast DNS is especially beneficial when used in conjunction with DDoS protection services, providing an additional layer of robust, scalable defense.

Robust Load balancers
High-capacity load balancers can significantly improve your system’s capacity to manage an enormous volume of connection requests. In turn, this can enhance your network’s ability to resist SYN flood attacks.

Monitoring services
Real-time Monitoring services track and scrutinize network patterns, activities, and performance, enabling the early detection of potential threats or attacks. These services can monitor server health, network performance, and traffic patterns, thereby identifying and alerting about possible anomalies that might indicate a SYN flood attack.

Firewall rules

Tweaking firewall configurations can also be invaluable. For instance, you can set rules to block incoming requests from a specific IP address if it exceeds a set number of SYN requests within a short timeframe.

Suggested article: Router vs firewall

Consequences of non-protection

• Service disruption: SYN flood attacks can result in service disruption or downtime, as the targeted server becomes overwhelmed and unable to handle legitimate requests.
• Financial loss: Downtime can lead to financial losses for businesses, especially e-commerce websites, online services, and organizations heavily reliant on internet connectivity.
• Reputation damage: Frequent DDoS attacks, including SYN floods, can tarnish a company’s reputation, eroding trust and customer confidence.
• Security overhaul costs: Post-attack, merely patching vulnerabilities won’t suffice. A complete revamp of security protocols becomes vital, often draining both time and financial resources.

Conclusion

In a world increasingly reliant on digital technology, understanding and defending against threats like SYN flood attacks is crucial. While they are a potent threat, solutions such as SYN cookies and robust load balancers offer effective means of mitigation. In essence, maintaining cybersecurity is not just a good idea, but a necessity in today’s digital landscape.

The post Understanding SYN flood attack appeared first on ClouDNS Blog.

What is a flood attack?

A flood attack, often a form of Distributed Denial of Service (DDoS) attack, aims to overwhelm a system with superfluous requests, thus preventing legitimate requests from being fulfilled. The primary objective is to make the target service unavailable, either by consuming all its resources or crashing it altogether. Flood attacks exploit the limitations of a network’s bandwidth, memory, and processing power. By sending an excessive number of requests, they can exhaust these resources rapidly, causing severe disruptions. Attackers often use botnets, a network of compromised devices, to generate the enormous volume of traffic required for such attacks, making it harder to trace and block the sources.

How does it work?

A flood attack works by sending a massive volume of traffic to a targeted server, service, or network. This traffic often appears to be from legitimate users, which makes it challenging to distinguish and filter out. The target system gets overwhelmed by this surge in requests, which eventually leads to its degradation or shutdown. Flood attacks can be executed through various protocols and methods, such as TCP, UDP, ICMP, and HTTP, each exploiting different aspects of the network’s communication process. Advanced flood attacks may use randomization techniques to avoid detection and mitigation efforts, making them more sophisticated and harder to counter.

Why is flood attack dangerous?

• Disruption of service: The most immediate impact is the service disruption. Websites may become unavailable, networks may slow down, and businesses may experience downtime.
• Financial impacts: With downtime comes lost revenue. Especially for businesses that rely heavily on online services, a few minutes of inaccessibility can translate to significant financial losses.
• Damage to reputation: Continuous attacks can tarnish a company’s reputation, causing loss of customer trust and loyalty.
• Resource consumption: An immense amount of resources, both human and technological, need to be diverted to handle the aftermath of such attacks.
• Diversion: Sometimes, attackers use flood attacks as a smokescreen, diverting attention from a more covert breach or intrusion.

How to mitigate it?

• Monitoring: Continuous monitoring of network traffic can help in early detection of unusual traffic spikes, which may indicate a flood attack. Tools like intrusion detection systems (IDS) can be invaluable.
• DDoS Protection: DDoS protection services can help mitigate the effects of a flood attack. These services often use a combination of traffic filtering, rate limiting, and other tactics to ensure only legitimate traffic reaches the target. 
• Secondary DNS: If the primary DNS server becomes overwhelmed due to a flood attack, the secondary DNS server can continue to resolve domain names, ensuring that services remain accessible to legitimate users.
• Firewalls and Routers: Properly configured firewalls and routers can help filter out malicious traffic.
  Router vs firewall
• TTL Analysis: Investigate the TTL values on incoming packets. Abnormal TTLs can indicate potential malicious traffic.
• IP Blocklisting: Identify and block IPs that show malicious activity. This prevents them from accessing your systems further.
  Whitelisting vs Blacklisting

Types of flood attack

DNS Flood Attack

A DNS flood attack specifically targets the Domain Name System (DNS) servers. The DNS is the internet’s phonebook, translating human-friendly URLs (like “example.com“) into IP addresses that computers use to identify each other on the network (like “1.2.3.4”). In a DNS flood attack, attackers send a high volume of DNS lookup requests, usually using fake IP addresses. This causes the DNS servers to try and resolve each request, leading to an overwhelming number of processes. This congestion ensures that genuine requests from real users either get significantly delayed or ignored altogether. If an attacker successfully disrupts a DNS server, it can make a whole swath of websites or online services inaccessible.

SYN Flood Attack

To understand a SYN flood attack, one must first grasp the “three-way handshake” process used to establish a TCP connection. The sequence is SYN, SYN-ACK, and ACK. In a SYN flood attack, the attacker sends a rapid succession of SYN requests but either does not respond to the SYN-ACK replies or sends them from spoofed IP addresses. The target system will keep these connections open, waiting for the final ACK that never comes. This can consume all available slots for new connections, effectively shutting out legitimate users.

HTTP Flood Attack

HTTP flood attacks take advantage of the HTTP protocol that web services operate on. In this attack, a massive number of HTTP requests are sent to an application. Unlike other flood attacks, the traffic sent looks legitimate. The requests can be either valid URL routes or a mixture with invalid ones, making them harder to detect. Because the requests look so much like typical user traffic, they’re particularly difficult to filter out. This method can exhaust server resources and cause legitimate requests to time out or receive delayed responses.

ICMP (Ping) Flood Attack

ICMP, or Internet Control Message Protocol, is a network protocol used by network devices to send error messages. The “ping” tool uses ICMP to test the availability of network hosts. In a Ping flood attack, attackers inundate the target with ICMP Echo Request (or ‘ping’) packets. The target then tries to respond to each of these requests with an Echo Reply. If the attack is voluminous enough, the target system’s bandwidth or processing capabilities may get overwhelmed, causing a denial of service.

Suggeted page: The function of ICMP Ping monitoring

UDP Flood

User Datagram Protocol (UDP) is a sessionless networking protocol. In a UDP flood attack, the attacker sends many UDP packets, often with spoofed sender information, to random ports on a victim’s system. The victim’s system will try to find the application associated with these packets but will not find any. As a result, the system will often reply with an ICMP ‘Destination Unreachable’ packet. This process can saturate the system’s resources and bandwidth, preventing it from processing legitimate requests.

Impact of Flood attacks on different industries

Flood attacks can have devastating effects across various industries, each facing unique challenges and potential damages:

E-commerce:

E-commerce platforms rely heavily on their websites for sales and customer interaction. A flood attack can cause significant downtime, leading to lost sales, decreased customer trust, and potential long-term damage to the brand’s reputation. Additionally, the costs associated with mitigating the attack and enhancing security measures can be substantial.

Suggest: Global Reach, Local Touch: The Role of GeoDNS in eCommerce Expansion

Finance:

In the finance sector, the availability and integrity of online services are critical. Flood attacks can disrupt online banking, trading platforms, and payment processing systems. This not only affects customer transactions but can also lead to compliance issues and regulatory scrutiny. The financial losses and impact on customer confidence can be severe.

Healthcare:

Healthcare providers use online systems for patient management, medical records, and telemedicine. A flood attack can interrupt these services, potentially putting patient health at risk. Delayed access to medical records and appointment scheduling can cause significant operational disruptions and affect the quality of care provided.

Gaming:

The gaming industry is a frequent target of flood attacks, especially during major events or game launches. These attacks can disrupt gameplay, causing frustration among users and leading to a loss of revenue for gaming companies. The competitive nature of online gaming also means that downtime can significantly impact player engagement and retention.

Conclusion

Flood attacks are among the oldest tools in a hacker’s arsenal, but they remain effective. As the digital landscape grows and evolves, so do the methods attackers employ. Regularly updating security infrastructure, staying informed about emerging threats, and employing a proactive defense strategy can go a long way in keeping systems secure and operational.

The post Flood Attack: Prevention and Protection appeared first on ClouDNS Blog.

What is a R.U.D.Y. attack?

R.U.D.Y., short for “R U Dead Yet,” is a slow-rate DoS attack that targets web servers and applications. Unlike traditional DoS attacks that overwhelm servers with rapid, high-volume requests, a R.U.D.Y. attack employs a stealthier approach. This attack targets the application layer (Layer 7) of the OSI model, specifically exploiting HTTP POST requests to cause disruption. It works by sending HTTP POST requests with an abnormally long content-length header value, transmitting the data in exceedingly slow chunks. This tactic keeps the server connection open for extended periods, eventually exhausting server resources and causing legitimate user requests to be delayed or denied.

How does it work?

To understand the mechanics of a R.U.D.Y. attack, let’s break it down step-by-step:

1. Initiation: The attacker identifies a target web server that accepts HTTP POST requests.
2. Connection Establishment: The attacker establishes a connection to the server.
3. Sending Headers: The attacker sends an HTTP POST request with an exaggerated content-length header, indicating that a large amount of data will follow. Here is an example:
   POST /submit HTTP/1.1
   Host: targetserver.com
   Content-Length: 100000
4. Slow Data Transmission: Instead of sending the data all at once, the attacker sends the data in very small chunks, with long intervals between each chunk. This slow data transfer ties up server resources. The attacker ensures that each chunk is sent within the timeout limit set by the server, preventing the connection from being dropped.
5. Resource Exhaustion: As more connections are opened and held, the server’s resources are gradually consumed, leading to performance degradation and potential denial of service to legitimate users.

Technical Details

• HTTP POST Request: This method is used to send data to the server, typically for form submissions. The R.U.D.Y. attack exploits this by sending data extremely slowly, maintaining the connection just below the server’s timeout threshold.
• Connection Timeout: Web servers have a timeout setting to drop idle connections. The R U Dead Yet attack aims to stay just within this timeout window, keeping the connection alive indefinitely.
• Application Layer Attack: As a Layer 7 attack, R.U.D.Y. specifically targets the application layer, making it more challenging to detect and mitigate compared to lower-layer attacks like SYN floods or ICMP attacks.

Why is the R U Dead Yet attack effective?

The effectiveness of the R.U.D.Y. attack lies in its simplicity and the difficulty of detection. Traditional DoS defenses, which focus on high traffic volumes and rapid request rates, may not recognize the slow and steady nature of a R.U.D.Y. attack. Additionally, since the attack mimics legitimate user behavior by sending properly formatted HTTP requests, it can bypass many security measures.

Suggested article: HTTP vs HTTPS – All you need to know!

The impact of a R.U.D.Y. attack

The impact of a R U Dead Yet attack can be severe, especially for web servers and applications that rely heavily on maintaining numerous concurrent connections. Some of the consequences include:

• Server Overload: As server resources are consumed by the slow connections, legitimate users experience delays or are unable to connect.
• Increased Latency: The server’s response times become significantly slower, degrading the user experience.
• Potential Downtime: In extreme cases, the server may become completely unresponsive, leading to downtime and potential revenue loss for businesses.
• Resource Depletion: The server’s CPU, memory, and network bandwidth can be exhausted, impacting overall performance and availability.

Defending against R.U.D.Y. attacks

Preventing and mitigating R.U.D.Y. attacks require a multi-faceted approach. Here are some strategies to consider:

1. DDoS Protection Services – Utilizing services that provide distributed denial-of-service (DDoS) protection can help absorb and mitigate the effects of such attacks. ClouDNS DDoS Protection service uses advanced filtering techniques to ensure that malicious traffic is effectively removed before reaching the target server, maintaining the integrity and performance of your online services.
2. Timeout Configuration: Configure server timeouts to limit the duration a connection can remain open without transmitting data. This can help close slow connections before they consume excessive resources.
3. Rate Limiting: Implement rate limiting to control the number of requests a single IP address can make in a given timeframe. This can help identify and block malicious users.
4. Behavioral Analysis: Use security tools that analyze traffic patterns and detect anomalies indicative of slow-rate attacks. Solutions like Web Application Firewalls (WAFs) can be configured to recognize and block suspicious activity.
5. Connection Throttling: Throttle connections based on the rate of data transmission. If data is being sent too slowly, the connection can be terminated.
6. Load Balancing: Distribute traffic across multiple servers to ensure no single server becomes a bottleneck. Load balancers can also help detect and mitigate attack patterns.
7. Regular Monitoring: Implement Monitoring service that will check server performance and traffic for signs of abnormal behavior. Early detection is crucial for mitigating the impact of an attack.

Conclusion

The R.U.D.Y. attack is a sophisticated and stealthy threat that highlights the need for robust and adaptive security measures in today’s digital landscape. By understanding the mechanics of this attack and implementing effective defenses, organizations can better protect their web servers and ensure the availability and performance of their online services. Stay vigilant, keep your defenses up-to-date, and be prepared to counter the evolving tactics of cyber adversaries.

The post R.U.D.Y. (R U Dead Yet) Attack Explained appeared first on ClouDNS Blog.

What is a DDoS amplification attack?

These attacks usually use the UDP protocol. It is a simple connectionless communication model with a minimum protocol mechanism. This means that one of the sides in the communication can send large amounts to the other without restrictions. Without any confirmation, it doesn’t matter if the second side receives the data. 

Due to the way the UDP protocol works, cyber-criminals use it to generate DDoS amplification attacks. The attacker sends a small UDP request with a spoofed IP address of the victim to public services.

The UDP protocol doesn’t require a connection verification between the parties. This is why the public services reply with the requested data to the IP address of the victim. As bigger is the data returned by exploited public service, bigger is the DDoS amplification factor.

In the past few years, hackers have exploited many public DNS resolvers and NTP servers to generate massive DDoS attacks against popular websites and services.

Understanding Memcached

Memcached is a widely-used, open-source caching system that enhances the performance of dynamic web applications by reducing database load. It achieves this by storing data in memory, allowing for rapid retrieval and minimizing the need for repeated database queries. By caching frequently accessed objects such as database query results and session data, Memcached helps applications run more efficiently and respond faster to user requests. Its straightforward design and robust performance have made it a staple in optimizing large-scale web applications. However, without proper configuration and security measures, Memcached can become vulnerable to exploitation, emphasizing the need for diligent management.

Memcached DDoS amplification attack explanation

A Memcached DDoS amplification attack is a malicious exploit where attackers leverage vulnerable Memcached servers to generate overwhelming traffic towards a target. By sending small requests to multiple servers, the attackers receive significantly larger responses, resulting in an amplification effect. This massive traffic surge can cripple the target’s network infrastructure, disrupting service. To mitigate such attacks, organizations should secure their Memcached servers, implement access controls, and utilize robust DDoS mitigation solutions to protect against this highly impactful cyber attack.

How does it work? Step-by step 

1. Identifying vulnerable servers: Attackers scan the internet to locate Memcached servers that are accessible and have User Datagram Protocol traffic enabled. UDP is preferred due to its connectionless nature, making it easier to spoof source IP addresses.

By default Memcached works with enabled UDP support on port 11211. To understand this attack we have reviewed the source code of the database on GitHub.For some reason in the communication settings of the defined a fixed payload of 1400 bytes for the UDP packets.

The basic UDP request sent to Memcached is with size 15 bytes, and the server responds with 1400 bytes. This makes the amplification factor more than 93x! That amplification factor means that with a single server with 1Gbps port and a significant amount of vulnerable servers, the attacker can generate DDoS attacks over 90 Gbps.

2. Spoofing the source IP address: Using various techniques, attackers disguise their own IP address and make it appear as if the attack traffic originates from the targeted victim’s IP address. This ensures that the amplified response traffic is directed towards the victim.

Suggested article: What is DNS Spoofing (DNS poisoning)?

3. Sending small forged requests: Attackers send lightweight and innocuous-looking requests to the vulnerable Memcached servers. These requests typically have a small size, often around 15 bytes, which minimizes the effort required to send them.

4. Amplification of response traffic: Exploiting the Memcached servers’ behavior, which responds to small requests with much larger responses, the attackers achieve an amplification factor that can reach staggering levels. This means that for each small request sent, the server responds with a significantly larger volume of data, often in the range of hundreds or thousands of times larger.

5. Overwhelming the target: The amplified response traffic, generated by the Memcached servers, floods the victim’s network infrastructure with an immense volume of data. This flood of traffic can quickly exhaust the victim’s network bandwidth, computing resources, and cause service disruptions or complete downtime.

How big can it be?

In the realm of cybersecurity, we have witnessed an unprecedented magnification factor, reaching an astonishing 51,200 times the original request size! Picture this: a mere 15-byte request has the potential to unleash a colossal 750 kB response. This mind-boggling amplification factor poses an immense security risk, particularly for web properties ill-equipped to handle the overwhelming deluge of attack traffic. With its significant amplification potential and susceptible servers, Memcached becomes a prime target for malicious actors intent on launching devastating DDoS attacks against a wide array of targets.

Furthermore, according to the GitHub’s February 28th DDoS Incident Report, the largest open source code web service was down due to a Distributed Denial of Service attack that caused intermittent unavailability of their service for a few minutes. The attack exploited a vulnerability in Мemcached, resulting in a volumetric attack that peaked at 1.35Tbps. GitHub successfully mitigated the attack by diverting traffic to Akamai and implementing access control measures, and they are working on improving their automated intervention and expanding their edge network to enhance resilience against future attacks.

How to protect from Memcached DDoS amplification attacks?

Our Anycast Network is protected from such attacks, and we already mitigated more than 20 attacks like this for the last five days.

Тo protect your website, online service, etc you can also implement DDoS protection software. ClouDNS DDoS Protected DNS service can help identify and filter out malicious traffic, thereby minimizing the impact of amplification attacks.

Other way to protect from Memcached DDoS amplification attacks is by regularly monitoring the traffic. We provide robust monitoring solutions which enable the timely detection of abnormal traffic patterns, facilitating early response and mitigation.

Furthermore, with enough network capacity, we can easily filter the attack of the Memcached server responds from UDP port 11211. We can say for sure that all our customers are protected and safe.

The average size of the DDoS attacks we filter was between 50Gbps and 80Gbps. First we expect that value to grow in the next two weeks. Then to drop significantly because the system administrators will take care of the vulnerable servers.

DDoS Protected DNS

Ways to secure a Memcached server

The system administrators of Memcached servers can protect them in one of the following ways:

• Update the configuration of the server to listen only on 127.0.0.1 (localhost). Do this if use the Memcached server only locally and there are no external connections to the server. You can do this with the option –listen 127.0.0.1
• Disable UDP support, if you are not using it. You can do this with the option -U 0
• Add firewall for UDP port 11211, if you need both external connections and UDP support, make sure the server is accessible only by the IPs you need
• Instead of exposing your Memcached server directly to the internet, you can use a caching proxy server
• Restrict access to the Memcached server using access control lists (ACLs) to allow only trusted IP addresses.

Conclusion

By exploiting vulnerable Memcached servers, attackers can unleash a massive flood of traffic, causing widespread disruptions. To defend against these attacks, organizations must secure their Memcached servers, implement strict access controls, and utilize effective DDoS mitigation solutions.

The post DDoS amplification attacks by Memcached appeared first on ClouDNS Blog.

What are the DDoS attacks

Cybercriminals are hijacking many random connected devices around the world. The already corrupted devices are called botnets, it is a network that is waiting for instructions from the person in control. The hacker can instruct them to generate traffic to a specific target. The massive number of those devices cripples the defense of the target and brings it down.

Spamhaus 2013

Back in 2013 this was the biggest attack of its time. The website of anti-spam company Spamhaus was down on 18.03.2013 due to a large layer 3 attack. Their servers couldn’t manage the load. The attack was around 75Gbps and back then this was unimaginable (currently there are some with more than 600Gbps). They manage to stop it by signing for Anycast service.

BBC DDoS Attack 2015

A few years ago, on October 21st, 2016, the DNS provider Dyn was struck by a massive DDoS attack. Their servers were down, and for some time, big websites that they were hosting like Amazon, Netflix, Twitter, Reddit and more were out. The culprit of the attack was a botnet called Mirai which was made mostly from IoT devices. The attack had a cascading effect on internet services globally, drawing attention to the vulnerabilities inherent in centralized DNS providers and spurring investment in DDoS mitigation technologies.

Dyn DDoS attack 2016

A few years ago, on October 21st, 2016, the DNS provider Dyn was struck by a massive DDoS attack. Their servers were down, and for some time, big websites that they were hosting like Amazon, Netflix, Twitter, Reddit and more were out. The guilty of the attack was a botnet called Mirai which was made mostly from IoT devices.

Kerbs on Security 2016

In September 2016 just before the Dyn accident, there was another involving the Mirai botnet. The attack was very strong at around 665 Gbps, but that to the Kerbs’s security, they manage to resist it.

The Mirai botnet responsible for the attack was especially alarming for its utilization of Internet of Things (IoT) devices like cameras and routers. This marked one of the first times a botnet had so effectively leveraged commonly used household devices to orchestrate a large-scale DDoS attack.

Blizzard DDoS attack 2017

If you are a gamer, you probably know Blizzard Entertainment, the brand behind Overwatch, World of Warcraft, StarCraft, and Diablo. This company has experienced many attacks over the last years. Most noticeable was in August 2017. Many gamers were unable to connect to their server and play. These attacks are damaging the image of the company and the satisfaction of their clients.

Memcached attacks of March 2018

March was a horrible month. We saw new attacks with a larger than ever before scale. There were two that set a record, the one that hit Arbor Networks with 1.7Tbps traffic and the other that hit GitHub with 1.35Tbps a few days earlier. They both exploited the UDP port 11211. The UDP doesn’t use verification and that is the reason this was possible.

DDoS amplification attacks by Memcached

The different attacks of 2019

In 2019 we didn’t see huge attacks with +1Tbps power, but it wasn’t safe either. 

Yes, there were some strong attacks of around 0.5 Tbps, but we paid attention more to the number of packets per second. In this kind of attack, the criminals do a little work, and the target does a lot of work. This is why they are called asynchronous. The attackers send small packets and receive big ones. The processing occupies the target’s resources. 

Clients of Imperva had a rough start of the year. First, a strong attack of 500 million packets a second in January. It was considered one of the largest PPS (Packets Per Second) attacks known.

Later, on the 30th of April 2019, another client of theirs got attacked with 580 million PPS.

In September 2019, there was another strong attack that was targeting Wikipedia. The popular site didn’t provide information about the magnitude of the attack, but it was down for several hours on different continents.

The AWS Attack 2020

Amazon Web Services (AWS) fell prey to a DDoS attack in February 2020, which peaked at 2.3 terabits per second. The attack was of the Connectionless Lightweight Directory Access Protocol (CLDAP) Reflection type, a common DDoS attack method that amplifies the traffic. Despite the intensity, Amazon successfully mitigated the attack, preventing any significant interruption to its services.

Cloudflare Attack 2020

In August 2020, Cloudflare, a leading DDoS mitigation service, experienced a significant DDoS attack itself. Peaking at 754 million packets per second, it became one of the largest PPS-focused DDoS attacks in history. Remarkably, Cloudflare was able to thwart the attack in seconds using automated systems. However, the incident underscored the evolving complexity of DDoS attacks, showing that even cybersecurity specialists are not immune.

2023 Trends

What can we expect this year? 

• Attacks with a smaller bandwidth, but intense with a high PPS number. The cybercriminals are changing their strategies.

• Increase in the duration of the attacks. Some, they can go for weeks. DDoS protection solutions should be able to withstand longer than before.  

• More sophisticated attacks. It is not just about the volume anymore. For example, the exploit can happen through a different port. 

• More botnets are emerging. There is already a new version of Mirai, new botnet Cayosin, and the IoT number of devices is increasing, and with this, the number of botnet devices.

According to Cisco’s projections, the global landscape for DDoS attacks is expected to witness a significant escalation, with the number of attacks doubling to approximately 15.4 million by 2023. This alarming surge underscores the growing threat of cyberattacks and emphasizes the imperative for organizations to fortify their cybersecurity measures to safeguard against this evolving menace. Since 2018, DDoS attacks have become increasingly prevalent, highlighting the pressing need for proactive defense strategies in the digital realm.

Source: Cisco Annual Internet Report, 2018–2023

How to protect from DDoS attacks?

You can use a DDoS protected DNS plan. Such a plan will include different DDoS protected servers and many Anycast locations. This will do a load balancing that will help you reduce the traffic and spread it to different servers. This way the intense wave of traffic can be reduced and your servers can withstand the DDoS attack.

Protect from DDoS attacks!

Conclusion

The DDoS attack won’t stop, nor will they be lighter. If your business demands your website to be up 100% of the time, you better be prepared with the right security measures.

The post Most significant DDoS attacks in the recent years (UPDATED 2023) appeared first on ClouDNS Blog.