icannwiki

DDoS Attack

Revision as of 12:33, 23 May 2017 by Dustin Loup (talk | contribs)

Distributed Denial of Service Attacks, or DDoS Attacks, effectively flood websites or servers with traffic from many different sources in order to "make the site unavailable."[1] DDoS is a type of Denial of Service Attack (DoS Attack) that uses multiple sources in order to blocks users from accessing the site. It is important to remember that not all service errors are the result of attack behaviors and can occur if a website is overwhelmed by non-malicious traffic as well.[2]

Public Perception edit

The public perception of DDoS attacks is negative. It is inconvenient to users who cannot reach their destination, and it can create major problems for the website's registrant, whether it is the website of an individual or an organization. DDoS attacks can become criminal when the attacker asks for money to stop the current attack or to prevent further attacks.[3] DDoS attacks can also be used by "hacktivists" for political gain, to interrupt free speech, or in protest of perceived injustice.[1][3]

Outcome edit

The outcome of a DDoS attack is that the attacked website is unavailable or runs very slowly. The damage done by these attacks can lead to minor inconveniences, losses in consumer confidence, or large revenue losses.

Historical Use edit

  • DDoS attacks have been used to take down or interrupt the traffic of large sites, making them inaccessible.[4][5] These planned attacks can be committed for political, social, and/or illegal purposes.[3] Unlike regular DoS attacks, DDoS attacks use multiple computers to attack their victims which often makes the attack harder to stop.[4] Botnets, or networks of computers controlled by hackers, are often used in DDoS attacks.[6]
  • Four types of DDoS attacks include:[1]
  1. TCP Connection Attacks: attempting "to use up all the available connections to infrastructure devices"[1]
  2. Volumetric Attacks: attempting to use large amounts of bandwidth
  3. Fragmentation Attacks: sending so many TCP or UDP fragments that the target cannot assemble them, which slows the system
  4. Application Attacks: trying to flood one aspect or application on a given site
  • A DDoS attack can be bought or traded as a service. For example, an attack that lasts a week can be purchased for $150,[1] while an attack that lasts 1 hour can be bought for $30-70.[7]
  • In addition to causing service errors, DDoS attacks can also be used to commit "other cybercrimes, including data breaches or financial fraud."[8]

ICANN Policy edit

  • ICANN does not have a policy that specifically addresses DDoS attacks; however, ICANN's blog has addressed the issue of how to respond to and report a DDoS attack.[3] If a site is under attack, the 2013 post suggests that the registrant contacts the hosting provider and internet service provider (ISP).[3] If the attack was proceeded by a threat or a sum of money was demanded to stop the attack, the registrant should contact law enforcement.[3]
  • ICANN's Security and Stability Advisory Committee (SSAC) also released an advisory in 2006 on DDoS attacks in relation to the DNS.[9]
  • ICANN's SSAC released another advisory in 2014 on DDoS attacks and how they may exploit certain security issues in the DNS.[10] For example, an attacker may use a victim's spoofed IP address to make multiple queries to an open recursive DNS server; the server will then respond by flooding the victim's computer with the unsolicited responses.[11] DDoS attacks that utilize "DNS reflection and amplification" can have "attack data bit rates reportedly exceeding 300 gigabits per second."[11] The advisory suggests that "ICANN should...facilitate an Internet-wide community effort to reduce the number of open resolvers and networks that allow network spoofing."[10] Additionally, rate limiting and blocking abusive queries may help reduce DDoS attacks.[11] The SSAC also recommends that DNS software and systems be updated regularly to reduce DDoS vulnerability.[11]

Legislation edit

  • Computer Fraud and Abuse Act (CFAA): this act, last amended in 2008,[12] prohibits the unauthorized use of another person's computer, among other things.[13][14] In relation to DDoS attacks, if the hacker used a botnet to perpetrate the attack, he or she could be charged under CFAA in addition to facing civil suits.[15] DDoS attackers can also face jail time.[16]
    • Read more about the CFAA.
  • Other nations, such as the UK and Sweden, also have anti-DDoS legislature.[16]

DNS Award edit

Awardees take a proactive approach to preventing DDoS attacks.

Additional Resources edit

Related Articles edit

References edit

  1. ↑ 1.0 1.1 1.2 1.3 1.4 What is a DDoS Attack?, Digital Attack Map
  2. ↑ Security Tip (ST04-015): Understanding Denial-of-Service Attacks (February 6, 2013), United States Department of Homeland Security
  3. ↑ 3.0 3.1 3.2 3.3 3.4 3.5 How to Report a DDoS Attack by Dave Piscitello (April 25, 2013), Internet Corporation for Assigned Names and Numbers (ICANN).
  4. ↑ 4.0 4.1 How to Prevent DoS Attacks by Aaron Weiss (July 2, 2012), eSecurity Planet
  5. ↑ Do More to Prevent DNS DDoS Attacks by Dave Piscitello (April 3, 2013), Internet Corporation for Assigned Names and Numbers (ICANN)
  6. ↑ What is DDoS denial of service? What everyone needs to know about DDoS, Prolexic
  7. ↑ Russian Underground 101 (PDF) by Max Goncharov, TrendMicro.com
  8. ↑ Best practices to mitigate DDoS attacks by Linda Musthaler (January 10, 2013), Network World
  9. ↑ SSAC Advisory SAC008: DNS Distributed Denial of Service (DDoS) Attacks (PDF), ICANN Security and Stability Advisory Committee (SSAC)
  10. ↑ 10.0 10.1 SSAC Advisory on DDoS Attacks Leveraging DNS Infrastructure (PDF), ICANN Security and Stability Advisory Committee (SSAC)
  11. ↑ 11.0 11.1 11.2 11.3 SSAC's Update Presentation at ICANN 49 (PDF and audio)
  12. ↑ Computer Fraud and Abuse Act at Wikipedia
  13. ↑ Computer Fraud and Abuse Act (CFAA) at Internet Law Treatise
  14. ↑ Computer Fraud and Abuse Act (CFAA) at Practical Law, Thomson Reuters
  15. ↑ Distributed Denial-of-Service (DDoS) Attack at Practical Law, Thomson Reuters
  16. ↑ 16.0 16.1 Are DDoS (distributed denial-of-service) attacks against the law? by Graham Cluley (December 9, 2010), Naked Security, Sophos

Security and Stability Advisory Committee. Advises the ICANN community and Board on matters relating to the security and integrity of the Internet's naming and address allocation systems (ICANN Bylaws).

Retrieved from "https://icannwiki.org/index.php?title=DDoS_Attack&oldid=541328"