DDOS Attacks: Are You Vulnerable?

One of the most devastating online hazards is becoming more common and powerful, striking many prominent websites and crippling them for days at a time. Learn what Distributed Denial Of Service (DDOS) attacks are; who is launching them; and what defenses are available. Read on…

DDOS Attacks On Steroids

Every time you “visit” a website, you’re really sending a request to a Web server asking it to send a page to your browser. Each such request imposes a small workload on the server; a large number of simultaneous requests can overload a server so that no more Web pages can be served for a while. This is why a website sometimes “slows down” or stops responding during peak traffic times.
A DDOS attack is an organized effort to overload a Web server for a long period of time, making it impossible for legitimate users to access the site.
It takes a large number of simultaneous requests to bring a Web server to a halt, so the generation of the bogus requests is distributed among many attacking computers; hence the term “distributed denial of service.”
DDOS Attack
In the past, organizing a network of computers to launch a DDOS attack took a good deal of effort and coordination. But today, very large networks of “enslaved” computers are already in place, ready to do the bidding of any nefarious actor who can pay a fee to the controller of these “botnets.” Computers get enslaved – turned into mindless robots or “bots” – by malicious software downloaded and installed via viruses, rogue websites, and other channels. (See my related article What is a Botnet?)
The controllers of botnets have created software toolkits that make launching a DDOS attack via one of their botnets as easy as pie. They rent these toolkits and the use of their botnets to anyone who can afford the price, which can be as little as $60 to $100 a day.

Why Do They Do It?

Increasingly, extortion is the motive for launching a DDOS attack. The target company may receive a demand for a sum of money; “pay up or your website is going down.” It’s an Internet variation of the old Mafia “protection” racket: “Nice business you have there; be a shame if anything happened to it.”
Some of the victims of such blackmail include Meetup.com, AWeber, Mailchimp, SEOMoz, Bit.ly, StatCounter, and NameCheap. All of them have in common a reliance on high availability and responsiveness; their users, and their profits, suffer severely when their websites are unavailable or slowed down. The most recent attacks were reported to be in the 75-100 Gb/sec range — a massive amount of data being spewed.
Some DDOS attacks are motivated by politics, philosophy or hatred. The hacker group Anonymous has attacked the websites of the FBI, CIA, Visa, MasterCard, Paypal, Sony Music and Scientology.
Other victims are the enemies of bad actors; their sites are disrupted as acts of war rather than extortion. Spamhaus.org, one of the key players in global anti-spam efforts, fell victim to “the biggest cyberattack in Internet history” in May, 2013. A DDOS attack blasted Spamhaus with over 300 GB of bogus page requests per second, annihilating the previous record of 100 Gbps. A single page request is usually less than 1000 bytes in size; it’s mind-boggling to calculate how many requests were hammering Spamhaus every second.
And who launched this attack? According to the UK government, it was a teenaged hacker; a kid who did such things for fun and profit. He came under suspicion after “large sums of money” were discovered flowing through his bank account.

Defending Against DDOS Attacks

Defending against a DDOS attack requires swift, intelligent action. The bogus page requests must be identified and rejected before they reach the Web server, so that only legitimate requests impose a workload on the server. A number of security firms offer services that can defend the gateway to a Web server in this manner: Verisign, Cloudflare, Prolexic, Incapsula, and BlackLotus are just a few.
Some web hosting companies offer optional DDOS protection for an extra charge. Liquid Web, for example, charges $500/month for DDOS protection up to 2 Gb/sec, with tiers up to $3000/month for 15Gb/sec. The cost for high-end enterprise-level DDOS mitigation services range as high as $5,000 to $10,000 per month.
Unless you’re a high-profile target, and a website outage would cost you thousands of dollars, it’s probably not advisable to purchase proactive DDOS protection services, as the cost would be prohibitive. If your site is attacked, contact your web hosting provider first, and ask for advice. Under no circumstances should you pay any “ransom” demanded by a cyber attacker. There’s no guarantee that payment will end the attack, or that they won’t come back and ask for ever-increasing sums of money.
Your thoughts on this topic are welcome. Post your comment or question below…


More Posts about Security:

  • Is BYOD a Good Idea for Small Biz?

  • Is Your WordPress Site Vulnerable?

  • Are You Ready For Chipped Credit Cards?

  • DDOS Attacks: Are You Vulnerable?

Comments

  1. Seems almost like extortion either way! Either you pay the hacker, or you pay the DDOS mitigation service. Does anyone else see it like that?

  2. Is there any way to trace the source of these attacks?

Join the Conversation! Leave Your Comment...

*


Free Small Business Tech Support -- The Rankin File
Subscribe to The Rankin File: Free Newsletter
Copyright © 2005 - Bob Rankin - All Rights Reserved
Privacy Policy -- See my profile on Google.