What is a Distributed Denial of Service (DDoS) Attack?
In Brief
A distributed denial‑of‑service attack uses multiple sources to exhaust a service's capacity or that of a dependency. Some attacks use compromised devices in a botnet; others use reflection or amplification. Distribution can make source blocking harder, but the response also depends on the attack type and where capacity is exhausted. Mitigation may need hosting, network and edge support as well as application controls.
It has been a little while since we've had a headline‑making DDoS attack, and given the huge uptick of these attacks throughout the first quarter of last year, it seems like we might be overdue for some breaking news.
But what actually is a Distributed Denial of Service attack? How do they get carried out, and how do they bring down the servers of some of the biggest companies in the world? In this article, we will take a look at the core concepts behind this remarkably popular hacking technique, some of the ways to protect against it, and we'll finish up with a quick peek into some of the biggest DDoS attacks in history.
DDoS: When Traffic Attacks!
A Distributed Denial of Service attack is essentially a barrage of traffic, coming from multiple coordinated locations. This overwhelming amount of traffic prevents users from accessing the service that's being targeted and can bring down the server (or servers) that the target is hosted on for varying lengths of time. You see similar (albeit less maliciously) if you have ever tried to buy Glastonbury tickets, or the latest PlayStation.
The distributed part means the traffic comes from multiple sources. Blocking a known source can help with some attacks, but a single‑source attack is not automatically easy to stop: addresses may be spoofed, and a saturated upstream connection can prevent legitimate traffic reaching a filter on your server. Reflection and amplification can also turn relatively small requests into much larger responses aimed at the victim.
But We're Talking About Thousands of Machines. How Do Hackers Get That Many?
There is no fixed number of machines needed to overwhelm a large service. Traffic volume, amplification, expensive application requests and the capacity of the target all matter. Some attacks do use large groups of compromised devices, whose owners have no idea that they are participating.
This means that potentially thousands, or even hundreds of thousands, of servers, computers, laptops, and mobiles from around the globe are essentially sleeper cells, waiting for the switch to be flicked to start sending traffic as part of some as‑yet‑unknown DDoS. This might even include the machine you're reading this on right now. When these machines are coordinated and working as a group, they are called a botnet.
Why Would Somebody Do This?
There are all kinds of reasons that a person or a group would want to carry out a DDoS attack, whether it's personal, impersonal, ideological, or even militaristic. It's not always hacking groups trying to ransom web services to get paid in crypto ‑ governments carry out DDoS attacks too. In fact, during the Hong Kong protests of mid‑2019, Telegram (a messaging app used by civilians, but also by the protestors to communicate and coordinate) was taken offline by a massive DDoS attack.
The team over at Telegram took to Twitter afterwards to explain what a DDoS attack is, and to claim that it was a "state actor‑sized" attack coming from mostly Chinese IP addresses. This wasn't even the first time that Telegram had dealt with a massive DDoS ‑ the last time was during a 2015 crackdown on human rights protests ‑again ‑ by the Chinese government.
It's not always governments though. It is oftentimes smaller groups, working together to extort money, either because they have been paid for the attack, or to hold services to ransom. A lot of DDoS attacks target victims specifically in the Financial Services industry.
There is a specific type of DDoS called a Yo‑Yo attack, that focuses on services that employ autoscaling. Rather than the aim being to take the service offline, these attacks focus on sending waves of traffic, causing the services to provision more resources, driving the bill up for the owner, before the DDoS pulls back and leaves the service draining the owner's bank account. This happens over and over, and will cause some disruption to the application users, but typically is focused more on hurting the owner rather than disabling the service.
Is It Possible to Defend Against These?
The reason DDoS attacks are so popular is because they are such a great (and relatively easy) exploit of how the internet works. In a lot of instances, it is literally just traffic, but coordinated and pointed en‑masses to cause damage. This means it can be very hard to defend against these attacks, because it is easy to catch legitimate traffic in any traps you set for the botnet that's currently pointing at your servers.
There are mitigations, though. Monitoring can help identify unusual traffic patterns, and rate limits or filtering can reduce some attacks. If the flood saturates the network before it reaches your server, local filtering is too late: the hosting provider or an upstream mitigation service needs to handle it. Any filtering policy also has to avoid excluding legitimate users.
The useful question is how much traffic the service and its dependencies can withstand, and where unwanted traffic can be handled before that capacity is exhausted. Mitigation can succeed, but it needs preparation and a plan for the parts of the system you do not control directly.
2016: Mirai, Dyn, and the Enormous Scale of DDoS
In October 2016, Dyn (a major DNS provider) was the target of a series of enormous DDoS attacks. Thankfully resolved within just a single day, this attack was nonetheless big enough to take a surprising number of big‑name websites offline in some regions, including Airbnb, Amazon, PayPal, and Reddit.
The 2017 USENIX study of Mirai used a set of 107,500 IP addresses supplied by Dyn for the 21 October 2016 attack. It separately estimated that Mirai as a whole peaked at around 600,000 infected hosts during the study. Those are different measurements, and an IP‑address count is not an exact count of physical devices. Neither supports calling the Dyn botnet tens of millions strong. Mirai notably infected connected devices such as cameras and routers, not just conventional computers.
Mirai is a family of malware that spread by finding vulnerable internet‑connected devices, including those still using default credentials. Once infected, those devices could be directed to send attack traffic. That is why changing default passwords and maintaining device software matter beyond the individual owner.
A later example shows why the traffic mechanism matters as much as the device count. In its Q1 2020 threat report, AWS described a reflection attack with a peak volume of 2.3 terabits per second. It is a dated example of a large traffic flood, not a current record or a measure of how many infected devices took part.