What is DDoS Attack?
DDoS Attack (Distributed Denial of Service) is a type of attack which originates from multiple computers or devices. The Aim of DDoS Attack is when multiple systems overflow the bandwidth or resources of a targeted system, usually one or more web servers. Such as DDOS Attack is often the result of multiple compromised systems (for example, a botnet) deluging the targeted system with traffic.
Different types of DDoS Attack which helps us to mitigate :
1) Volume Based Attack: Includes UDP floods, ICMP floods, and other spoofed-packet floods.
2) Protocol Attack: Includes SYN floods, fragmented packet attacks, Ping of Death, Smurf DDOS Attack and many more.
3) Application Layer Attack: Includes low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD [OpenBSD is a free and open-source Unix-like computer operating system descended from Berkeley Software Distribution (BSD)] vulnerabilities and many more.
Motivations Behind DDoS Attack :
- Business feuds
- Online Gaming
Prevention Method :
- A DDoS attack is launched simultaneously from multiple different hosts and can affect the availability of even the largest enterprises’ internet services and resources.
- They are a daily occurrence for many organizations; according to Cloud Flare Networks; 226,500,000 attacks blocked between August 2015 and November 2016 — 500,000 attacks per day — and not one was successful.
- 95% total monthly bandwidth savings and $250,000 cost savings on servers, bandwidth, personnel, and other security measures.
- Securing internet-facing devices and services is as much about helping to secure the internet as an individual network as it is about reducing the number of devices that can be recruited to participate in a DDoS attack.
- The main protocols hackers are abusing to generate DDoS traffic are NTP, DNS, SSDP, Chargen, SNMP, and DVMRP; any services using them should be carefully configured and run on hardened, dedicated servers to prevent DDOS Attack.
Common Defenses against DDoS attack
- Decrease Per IP connection rate.
- Use IDS, Web-application firewalls.
- Tweak Connection per IP threshold.
DDoS attacks are measured in two dimensions: the number of malicious packets per second (PPS) and the attack bandwidth in bits per second (bps).
The Simple things to Secure the Network from DDoS Attack :
- Change the default password – The virus searched for default settings of the IP devices to take control, it’s better to change the default password to prevent a DDOS Attack.
- Update the software – As the battle between cybercriminals and security experts continues, the need to stay up-to-the-minute with the latest updates and security patches becomes more important. Pay attention to the latest updates and make it part of the routine to stay on top.
- Preclude remote management – Disable the remote management protocol, such as telnet or HTTP, that provide control from another location. The recommended remote management secure protocols are via SSH or HTTPS.
DDoS Attack Mitigation :
- Transparent mitigation – Hackers generally consider those users who lose their access during an DDOS Attack. Since your users do not need to know and do not care that you are under attack, any mitigation technology must continue to let people into your site without delay and without being sent through holding areas, splash screens or receiving outdated cached content. Once the hacker knows that they are going unnoticed, they are improbable to return.
- Bots can’t talk, humans can – Everyone is talking about the rise of chatbots or web robots, but are forgetting that humans are pretty good too.Hackers conduct DDoS attacks to cause a nuisance by disobliging websites and users. This will provide you with further insight into how well, or lack thereof your anti-D Dos system is performing.
- Make sure you whack all the bots – If we are logging many websites at the same time and so many windows are opened at once, it can slow down the sites.So make sure your screening is airtight, blocking all application layer bot requests.
In reality, there are two parts to DDOS Attack protection: the first is detecting a site is under attack and the second is applying an effective defense. Detection rarely not taken into account, due to its guileful nature. Certainly, your solution is capable of accurately detecting the attack but remains inactive when the site is not under attack. Needless defensive measures are just as bad as no defense measures at all for DDOS Attack.
Source : GBHackers