What is a DDoS attack?
Definition of DDoS (distributed denial of service)
A distributed denial of service (DDoS) attack tries to overload a system, network or website until nobody can reach it. It is one of the most common forms of cyberattack. Unlike a denial of service (DoS) attack, which comes from a single source, a DDoS attack uses many devices at the same time to send huge numbers of requests. These devices are often part of what is called a botnet: a group of devices compromised by malware and controlled by attackers.
A successful DDoS attack can take a business offline, cost it money and hurt its reputation for a long time. Attackers also use DDoS attacks to cover other attacks, such as data breaches or break-ins.
Why are DDoS attacks dangerous?
DDoS attacks are dangerous because they can cause both technical and financial damage, including:
- Service interruptions: Customers cannot access your services, leading to revenue losses.
- Costs of defense: Mitigating an attack and restoring normal operations can be expensive and time-consuming.
- Reputational damage: Customers and partners may lose trust in a business affected by an attack.
- Distraction tactics: In some cases, DDoS attacks are used to distract security teams while sensitive data is stolen or other vulnerabilities are exploited.
The 2016 attack on the DNS provider Dyn (more on it below) took services such as Netflix, Twitter (now X) and Spotify offline for hours.
How DDoS attacks work
How attackers build a botnet army
Attackers often use botnets to conduct DDoS attacks. These botnets consist of thousands or even millions of devices infected with malware. Devices in the Internet of Things (IoT), such as surveillance cameras, routers, and smart home devices, are particularly vulnerable because they are often operated with weak passwords or outdated software.
The infection usually occurs unnoticed through phishing emails, security vulnerabilities, or manipulated downloads. Once a device becomes part of a botnet, the attacker can use it to send massive amounts of data packets to a target system, overwhelming its resources.
Types of DDoS attacks
- Volume-based attacks: These attacks aim to overload a network’s bandwidth using methods such as UDP floods or ICMP floods to generate massive traffic.
- Protocol-based attacks: These exploit weaknesses in network protocols, such as SYN floods, which attempt to exhaust a server’s connection resources.
- Application-based attacks: These attacks, like HTTP floods, target specific applications or services by overwhelming them with legitimate but excessive requests.
Signs of an ongoing DDoS attack
The sooner you spot a DDoS attack, the sooner you can respond. Typical signs include:
- A sudden and unexpected surge in network traffic.
- Slow loading times or complete inaccessibility of websites and services.
- Frequent error messages such as “Service Unavailable.”
- Unusual traffic spikes on specific ports or IP addresses.
Protection measures against DDoS attacks
Preventing an attack
Most DDoS protection has to be in place before an attack starts:
- Firewalls and intrusion prevention systems (IPS): These systems filter malicious traffic and block suspicious IP addresses.
- Load balancers: Distributing requests across multiple servers reduces the load, ensuring individual servers are not overwhelmed.
- Content delivery networks (CDN): CDNs distribute traffic across globally located servers, protecting against overloads caused by DDoS attacks.
A CAPTCHA service such as TrustCaptcha helps indirectly. Its bot detection recognizes and blocks automated requests on forms and logins, which makes application-based attacks on those pages harder. It does not absorb network floods; that is the job of the measures above.
Detecting and responding to an attack
- Monitoring and analysis: Continuous monitoring of network traffic helps detect unusual activities early.
- Immediate actions: Once an attack is detected, suspicious IP addresses should be blocked, and traffic filters activated.
- Collaboration with providers: Companies should stay in contact with specialized DDoS protection services to mitigate attacks effectively.
Long-term protection strategies
These measures keep the protection effective over time:
- Regular network security audits: Vulnerabilities can be identified and resolved early.
- DDoS protection services: These services offer specialized solutions to fend off attacks and minimize their impact.
- Employee training: A well-trained team can respond better to attacks and effectively implement security measures.
Examples of notable DDoS attacks
HTTP/2 Rapid Reset (2023)
In 2023, attackers used a flaw in the HTTP/2 protocol, known as Rapid Reset, to open and cancel requests at an enormous rate. Google measured a peak of 398 million requests per second, many times more than any attack it had seen before. Web servers, cloud providers and protection services had to roll out patches across the industry.
Attack on GitHub (2018)
GitHub, one of the world’s largest platforms for software development, became the target of a massive DDoS attack in February 2018. With a peak load of 1.35 terabits per second, it was the largest documented attack at that time. GitHub fended off the attack with a quick response and its protection measures.
Attack on Dyn (2016)
Another noteworthy example is the attack on the DNS provider Dyn in 2016. This attack was carried out by the Mirai botnet, which used IoT devices to generate massive data streams. As a result, services like Twitter (now X), Netflix, and Amazon were unavailable for hours.
Conclusion
A DDoS attack does not need to break into anything. It only has to send more traffic than the target can handle. That is why the defense is mostly about capacity and filtering: firewalls, load balancers, CDNs and specialized protection services.
A CAPTCHA such as TrustCaptcha covers a narrower part: it identifies and blocks automated requests on forms and logins. It is not a complete DDoS defense, but it closes a gap that network filters leave open.
