← All lessons
Threats · Beginner · 3 min
DDoS attacks
Knock a site offline by drowning it in traffic.
What it is
A Distributed Denial of Service attack floods a website or network with so much traffic from so many machines that real users can't get through. The traffic usually comes from botnets of hacked computers, routers and cameras. DDoS is used for extortion, activism (hacktivism), or as a distraction during another attack.
Real case · 2016
Mirai and Dyn
The Mirai botnet infected hundreds of thousands of cameras and routers that still used factory-default passwords, then hit DNS provider Dyn, making Twitter, Netflix, Reddit and others unreachable for parts of a day.
Source: Wikipedia: DDoS attacks on Dyn
How defenders stop it
- DDoS protection from a CDN or cloud provider
- Rate limiting and caching
- Change default passwords on every device
- A plan for who to call when it happens
Check yourself
1. How did Mirai build such a big botnet?
- A Windows zero-day
- IoT devices with default passwords
- Phishing emails
- Buying servers
Show answer
IoT devices with default passwords. It simply tried a short list of default usernames and passwords.
2. What does 'distributed' mean in DDoS?
- The traffic comes from many machines at once
- It uses a distributed database
- It attacks many websites at once
- It spreads like a worm
Show answer
The traffic comes from many machines at once. The flood comes from many machines, usually a botnet, which is why blocking one source doesn't stop it.
3. Which defence helps most against a large DDoS attack?
- Turning off HTTPS
- DDoS protection from a CDN or cloud provider
- A stronger admin password
- Antivirus on the web server
Show answer
DDoS protection from a CDN or cloud provider. Big providers absorb floods across their global networks before the traffic ever reaches you.
Answer them in the app to earn XP.
Next: AI & security →