NetSec DoS and DDoS Attacks

A Denial of Service (DoS) attack floods a target with so much traffic or so many requests that it cannot respond to legitimate users. A Distributed Denial of Service (DDoS) attack does the same thing using thousands or millions of devices simultaneously, making the flood nearly impossible to block from a single source. These attacks target the Availability pillar of the CIA Triad — if the service is unreachable, it is effectively destroyed for the duration of the attack.

DoS vs DDoS

DoS (Single Source):
[ Attacker ] ────────────────────────────► [ Target Server ]
  sends millions of fake requests           overwhelmed, crashes

DDoS (Distributed, Many Sources):
[ Device 1  ] ──┐
[ Device 2  ] ──┤
[ Device 3  ] ──┼──────────────────────────► [ Target Server ]
[ Device 4  ] ──┤                             overwhelmed
[ Device 500] ──┘
  (all controlled by attacker via botnet)

Blocking the attacker's IP stops a DoS.
Blocking 50,000 IPs simultaneously is nearly impossible → DDoS is far harder to stop.

What Is a Botnet

A botnet is a network of infected devices controlled by an attacker. Each infected device (called a "bot" or "zombie") receives commands through a command-and-control (C2) server. The device owner has no idea their computer, router, smart TV, or security camera is participating in an attack on another organization.

BOTNET ARCHITECTURE:

[Attacker's C2 Server]
         │
         ├──► [Bot: infected home PC]
         ├──► [Bot: infected IoT camera]
         ├──► [Bot: infected smart router]
         ├──► [Bot: infected laptop in office]
         └──► [Bot: infected phone] (×50,000 more)

Attacker issues one command: "Attack target.com with 10Gbps of traffic."
All 50,000 bots execute simultaneously.

Types of DDoS Attacks

Volumetric Attacks

These attacks flood the target's internet connection with massive amounts of data — more than the connection can handle. The link becomes saturated and legitimate packets cannot get through. Measured in Gbps (gigabits per second). The largest recorded attacks exceed 3 Tbps.

Volumetric Attack Diagram:
Target's bandwidth capacity: 10 Gbps

DDoS traffic arriving: 500 Gbps
                       ─────────
Legitimate traffic:    0 Gbps (pipe is completely full)

Users trying to access:  "Connection timed out"

Protocol Attacks (SYN Flood)

TCP connections begin with a three-way handshake: SYN → SYN-ACK → ACK. The server allocates memory for each half-open connection while waiting for the final ACK. A SYN flood sends millions of SYN packets with fake source IPs. The server waits for ACKs that never arrive, eventually exhausting its memory and refusing real connections.

SYN FLOOD:
Attacker sends: SYN from 1.1.1.1 (fake)
Server replies: SYN-ACK to 1.1.1.1 (goes nowhere)
Server waits:   for ACK... waiting... waiting...
                (stores half-open state, using memory)

Repeat 1,000,000 times per second:
Server memory fills with half-open connections.
Real user sends SYN → "Sorry, no resources available" → connection refused.

Application Layer Attacks (Layer 7)

These attacks send requests that look completely legitimate but require enormous server resources to process. A single HTTP request to generate a complex database report might use 1,000 times more server resources than serving a static page. By sending thousands of such requests, attackers exhaust CPU and database capacity with relatively little traffic volume.

Layer 7 Attack Example:
Attacker sends: GET /search?q=* HTTP/1.1 (complex database query)
Server:         runs full database scan for every request
                1,000 requests/second × heavy processing = server overloaded

ISP sees:       Normal-looking HTTPS traffic (hard to filter)
Users see:      503 Service Unavailable

Amplification Attacks

The attacker sends a small request to a public server (DNS, NTP, Memcached) with the victim's IP address as the return address. The server sends a much larger response to the victim. The attacker amplifies a 1 Mbps attack into a 100 Mbps attack using other people's servers.

DNS AMPLIFICATION:
Attacker sends: 60-byte DNS query (forged source: victim's IP)
DNS Server responds: 4,000-byte answer → sent to VICTIM

Amplification factor: 4,000 / 60 = 66x
Attacker uses 1 Gbps → Victim receives 66 Gbps

DDoS Defense Layers

Defense Layer            | What It Does
-------------------------|---------------------------------------------------
ISP-level filtering      | Drops attack traffic before it reaches your link
Anycast diffusion        | Spreads traffic across global PoPs, diluting impact
Rate limiting            | Caps how many requests a single IP can send per second
SYN cookies              | Eliminates half-open state during SYN floods
Traffic scrubbing        | Specialized DDoS mitigation services filter and clean
CDN / WAF                | Absorbs application-layer attacks at edge nodes
Blackhole routing        | Routes attack traffic to a null destination (sacrifices target IP)
Geo-blocking             | Blocks entire countries sending attack traffic

DDoS Mitigation Services

Purpose-built DDoS mitigation services (Cloudflare, Akamai, AWS Shield) absorb massive attack volumes by routing traffic through their global scrubbing infrastructure. Clean traffic passes through to the origin server; attack traffic is discarded at the edge — often before the target organization even notices an attack is underway.

Attack traffic: 500 Gbps hits Cloudflare's global network
Cloudflare capacity: 100+ Tbps across 250+ cities
Cloudflare scrubs: drops attack packets, forwards clean traffic
Origin server receives: normal user requests, sees no attack

Availability attacks cause direct revenue loss for e-commerce businesses, reputational damage for any organization, and operational disruption for critical services like hospitals and utilities. DDoS protection is not optional for any internet-facing service — attackers can rent DDoS attacks for as little as a few dollars per hour through underground markets.