What is a DDoS attack?

During election counts in various countries, official websites and other essential online services can be taken offline for hours. The cause may not be a technical fault, but an overload attack known as a DDoS attack. The same method has repeatedly been used against police forces, media organisations and banks in different parts of the world.

A DDoS attack involves a large number of connected devices sending traffic to a target at the same time, with the aim of overwhelming the system and making the service unavailable. The abbreviation stands for Distributed Denial of Service. DDoS attacks are among the cyber threats that national cybersecurity authorities regularly warn about in their threat assessments and situation reports.

How a server is brought down during an attack

An attacker seeking to take a website offline has two main options. The first is to exploit a vulnerability in the software, causing the server to crash. The second, and more common, method is to flood the server with so many requests that it cannot respond to legitimate visitors in time. The traffic may look like ordinary browsing, but the volume is on an entirely different scale. During an attack on Swedish media outlets in March 2016, network operators recorded a peak of 50 Gbit/s from multiple countries.

The server cannot filter out the malicious traffic quickly enough to distinguish it from legitimate requests. The result is similar to a department store being flooded with tens of thousands of people at once: genuine customers can no longer reach the tills. The website, login services and underlying systems become inaccessible, sometimes for hours and sometimes for several days.

Three types of attack

Traffic directed at a target can be divided into three main categories. Volumetric attacks saturate available bandwidth with junk data, for example by sending requests to open DNS servers that return responses much larger than the incoming packets. This technique is known as DNS amplification.

Protocol attacks exploit the way internet protocols are designed. A classic example is SYN flooding, in which an attacker initiates thousands of incomplete TCP connections that the server must keep track of. The server's connection table becomes full, preventing it from accepting further legitimate connections.

Application-layer attacks, often referred to as Layer 7 attacks, target the web application itself. These may involve repeated requests to a search page or a payment function that requires substantial processing power. The volume of traffic does not need to be high if each request places a heavy load on the server.

Botnets of compromised devices

A modern DDoS attack rarely originates from a single computer. The traffic comes from a botnet: a network of thousands or even millions of devices remotely controlled by an attacker. These devices include ordinary home computers, as well as connected cameras, routers and other Internet of Things (IoT) devices with weak passwords.

In 2016, the Mirai botnet made headlines by hijacking surveillance cameras and digital video recorders for an attack against Dyn, a DNS service provider. The attack disrupted access to large parts of the internet in the United States for several hours. Bots are often installed through malware that spreads automatically between poorly secured devices.

Because an attack originates from many different IP addresses, blocking a single source is not enough to stop it. Protection systems must filter out malicious traffic without blocking legitimate visitors.

Signs of an ongoing attack

Most DDoS attacks are first noticed when a service slows down or stops responding altogether. Common warning signs include:

• Unusually high traffic volumes from IP addresses or countries that have not previously generated significant traffic
• Slow response times on a website or login page despite otherwise normal system load
• An entire service becoming inaccessible while other systems on the network continue to function
• Logs filling up with requests directed at a specific page or function

Monitoring tools used by web hosting providers, firewalls and content delivery network (CDN) providers can detect these anomalies early and alert operations teams. Without such monitoring, an attack is often not noticed until customer support starts receiving calls about a website that will not load.

Protection and preparation

No single tool can stop every DDoS attack. The most common industry solutions rely on several layers of protection working together:

• A DDoS protection service provided by a web hosting company or a specialist provider, which filters traffic before it reaches the server
• Cloud-based load balancing that can scale up to handle and absorb traffic spikes
• Clear procedures specifying who alerts whom and where system logs are stored
• Practising for this type of scenario as part of a broader incident response plan

Large organisations, including telecommunications providers, banks and government agencies, often have protective measures in place. Smaller organisations may lack the necessary preparedness, making an attack at a critical moment disproportionately costly. An attack that takes down a campaign or election-night service at a crucial point can expose the extent to which an organisation depends on its online services.

Are DDoS attacks illegal?

Yes, DDoS attacks can be criminal offences in most countries. Deliberately disrupting the operation of an information system may constitute an offence under national law. Penalties vary from country to country and depend, among other things, on the scale and consequences of the attack and the perpetrator's intent. It may also be a criminal offence to commission a DDoS attack through so-called stresser or booter services, even if the person placing the order lacks the technical expertise to carry out the attack themselves. In several countries, authorities have investigated and prosecuted individuals who have purchased such attacks through online services.

DDoS attacks have evolved from isolated news events into a persistent part of the threat landscape facing organisations and critical infrastructure worldwide. National cybersecurity authorities and other specialist organisations regularly publish information about current threats and attacks. These sources provide a useful starting point for organisations seeking to strengthen their own preparedness.

For a broader perspective on how cybersecurity relates to different types of threats, read more on our topic page covering cybersecurity, IT security and information security.