What is DDOS Attack?
What is DDOS Attack? – Distributed Denial of Service (DDoS) Attack is an attempt to make an online service inaccessible to users by flooding servers, networks, or applications with excessive traffic. This attack is carried out using many devices that have been infected with malware, which then simultaneously send requests for access to the target simultaneously.
How DDOS Attack Works
1. Botnet recruitment
DDoS attacks usually start with the recruitment of botnets, namely computer networks that have been infected with malware and controlled by attackers. These computers are known as “zombies” and are controlled remotely without the owner’s knowledge.
2. Sending excessive traffic
After the botnet is formed, the attacker will send commands to zombie computers to send excessive traffic to the target. This traffic can be HTTP requests, data packets, or other types of traffic that can flood the target server.
3. Flood the target server
With very high traffic, the target server will be overwhelmed and ultimately unable to respond to legitimate requests from other users. This causes the service to be slow or completely inaccessible.
Types of DDOS Attack
1. Volumetric Attacks
Volumetric attacks aim to spend network bandwidth by sending large amounts of traffic. This type of attack includes UDP Flood and ICMP Flood.
2. Protocol Attacks
This attack exploits a weakness in the network protocol to overwhelm the target server. Examples of these attacks are Syn Flood and Ping of Death.
3. Application Layer Attacks
Attacks on the application layer target weaknesses in web applications or application servers. An example is HTTP FLOOD, where excessive HTTP requests are sent to web applications to make them inaccessible.
Impact of DDOS Attack
1. Downtime and Financial Loss
DDoS attacks can cause the service to be inaccessible for hours or even days. This can result in significant financial losses, especially for businesses that rely on online services. For example, if an online store experiences downtime for an hour, they can lose up to millions of rupiah in revenue.
2. Reputation tarnished
The inability to keep the service online can damage the company’s reputation. Customers who are unable to access the service may move to competitors, which means long-term losses for the business.
3. Repair and Recovery Cost
After the DDoS attack, the company will have to incur additional costs to restore the system, repair damage, and increase security to prevent similar attacks in the future. This cost can reach thousands to tens of thousands of dollars (about hundreds of millions to billions of rupiah).
How to Overcome and Prevent DDoS Attack
1. Increase network capacity
One way to overcome DDOS is to increase the network capacity so that it can handle high traffic spikes. This includes increasing bandwidth and using the CDN (Content Delivery Network) service.
2. Using WAF (Web Application Firewall)
WAF can help filter malicious traffic before reaching the target server. That way, the attack can be prevented before causing more damage.
3. Monitoring and Early Detection
Monitoring network traffic in real-time can help detect signs of DDoS attacks early. With early detection, IT teams can take quick action to reduce the impact of attacks.
4. Implementation of Rate Limiting Techniques
Rate Limiting limits the number of requests one IP can make in a certain period of time. This can help reduce the effects of DDoS attacks by blocking the number of requests from a single source.
5. Using Anti-DDoS Service
Many cloud service providers offer anti-DDoS solutions that can help protect the infrastructure from attacks. This service usually includes attack mitigation and additional protection that can help keep the service online.
Steps to Overcome DDoS with CloudFlare
1. Register and configure CloudFlare account
The first step to using CloudFlare is to sign up to get an account on the official CloudFlare website. After registering, you will be asked to configure your domain by adding a domain to your CloudFlare account.
2. Redirect DNS to CloudFlare
After adding the domain, you need to redirect your domain DNS to CloudFlare. This is done by changing your domain nameserver to the nameserver provided by CloudFlare. This step is important because all the traffic that enters your site will pass CloudFlare first.
3. Activate DDoS protection
CloudFlare provides automatic DDoS protection for all users, but you can also enable additional protection according to your needs. Here are some steps to enable DDoS protection in CloudFlare:
a. Mode “Im Under Attack”
If you experience a DDoS attack, you can activate the “IM Under Attack” mode. This mode will display an interstitial page for visitors for five seconds while CloudFlare checks whether they are legitimate users or bots. To enable this mode, open the CloudFlare dashboard, select the domain you want to protect, and activate the “IM Under Attack” mode in the “Overview” tab.
b. Setting Rules in Firewall
CloudFlare has a firewall feature that allows you to create custom rules to block malicious traffic. You can set rules to block certain IP addresses, specific countries, or certain types of traffic. To set the rules in the firewall, open the CloudFlare dashboard, select your domain, and navigate to the “Firewall” tab. Here you can add rules as per your needs.
4. Using Rate Limiting
Rate Limiting is a feature that allows you to limit the number of requests one IP can make in a certain period of time. This is very useful for preventing DDoS attacks that use a large number of requests from one or more IPs. To enable Rate Limiting, open the CloudFlare dashboard, select your domain, and navigate to the “Rate Limiting” tab. Here you can create a limiting rate rule according to your needs.
5. Monitor and analyze traffic
CloudFlare provides a monitoring tool that allows you to view and analyze traffic that goes into your site. With this tool, you can identify suspicious traffic patterns and take appropriate action to prevent DDoS attacks. To monitor traffic, open the CloudFlare dashboard and navigate to the “Analytics” tab.
Advantages of Using CloudFlare to Overcome DDoS
1. Protection 24/7
CloudFlare provides DDoS protection all the time without the need for manual intervention. This means your site will be protected from DDoS attacks whenever an attack occurs.
2. Scalability
CloudFlare can handle DDoS attacks on a large scale, thanks to its extensive global infrastructure. This ensures that your site stays online despite facing very large attacks.
3. Ease of use
CloudFlare is easy to use and does not require in-depth technical knowledge to configure it. This allows website owners of various skill levels to protect their sites from DDoS attacks.
4. Full Features
In addition to DDoS protection, CloudFlare also provides various additional features such as web application firewalls, SSL/TLS, caching, and performance optimization that can help improve the security and performance of your site as a whole.
example of a famous ddos attack case
1. Attack on DYN (October 2016)
In October 2016, Dyn, a major DNS service provider, experienced a massive DDoS attack that rendered many popular websites such as Twitter, Reddit, and Spotify inaccessible. This attack uses the Mirai botnet, which consists of an infected IoT device.
2. Attack on GitHub (February 2018)
In February 2018, Github experienced one of the biggest DDoS attacks ever recorded. The attack reached its peak at 1.35 Tbps and lasted for approximately 20 minutes. GitHub managed to mitigate the attack with the help of an anti-DDoS service provider.
3. Attack on AWS (June 2020)
In June 2020, AWS experienced a DDoS attack that peaked at 2.3 Tbps. This was the biggest DDOS attack ever recorded at the time. AWS managed to mitigate the attack without experiencing significant downtime.
FAQ about DDOS Attack
What is DDOS Attack?
DDOS Attack is an attack that aims to make online services inaccessible by flooding servers or networks with excessive traffic.
How does DDOS Attack work?
DDoS Attack works by using multiple devices that have been infected with malware to send excessive traffic to the target simultaneously, making the service inaccessible.
What is the impact of DDOS Attack?
The impact of DDoS Attack includes service downtime, financial loss, tarnished reputation, and high repair and recovery costs.
How to prevent DDOS Attack?
How to prevent DDOS Attack includes increasing network capacity, using WAF, monitoring and early detection, implementing rate limiting, and using anti-DDoS services.
Is there an example of a famous DDOS Attack case?
Some examples of cases of well-known DDOS attacks include attacks on DYN in October 2016, attacks on GitHub in February 2018, and attacks on AWS in June 2020.
By understanding what DDOS Attack is, how it works, and how to prevent it, we can be better prepared to face this threat and protect our online services from adverse attacks.
