DDoS Protection

Infradata is a recognised leader and authority in DDoS protection solutions.

Any organisation that uses the Internet to conduct its core business runs the risk of loss of business, revenue and reputation if its systems are no longer available. DDoS attacks pose an ever-increasing threat to businesses that are reliant on the Internet for service availability. Some types of online business are more likely to suffer from such attacks than others. However, all will recognise that without some sort of DDoS protection service there is a risk that their business and its revenue will be compromised.

‘Distributed Denial of Service’, aka DDoS, attacks are attempts to make a computer or network device unavailable, or at least to disrupt its function or service. They are categorised as ‘distributed’ because the attacks aren’t generated by a single attack host, but distributed over several hosts, usually a so-called botnet.

Botnets consist of a large quantity of Internet-connected, often by malware-infected devices. A small piece of software on the infected computer will ‘call/phone home’ via reaching out to a central computer, operated by an attacker, often called a ‘command & control server’ (c&c server). It then keeps a list of all known infected computers and how to reach them. When an attack begins the c&c server will instruct these infected computers to send specific traffic to one or more hosts. Even if the individual machines have low performance and only limited bandwidth to the internet, the sheer volume of traffic and connections this aggregated number of machines can create - its attack force - can be immense.

There are three main categories of attack.

A state attack bombards the target with massive numbers of connection attempts and may try to keep them active. The target host and infrastructure cannot cope with such a large number of sessions, limits are reached, and it simply stops responding to requests, rendering it useless.

A volumetric attack sends extreme volumes of traffic in an attempt to completely saturate the target’s connections, effectively muscling out further legitimate traffic.

Sometimes other, often legitimate servers on the Internet are co-used for these types of attack. This is becoming an increasingly popular method of attack. In such cases special requests are sent to the target servers. It then uses specific functions to have the legitimate host send massive amounts of traffic back in response to what it believes is the requesting source, but it is in fact the attack destination. These are known as amplification or reflection attacks.

Application attacks identify weaknesses in applications and are used to either retrieve sensitive information, crash applications or abuse them for nefarious purposes such as gaining full access to the host on which the application resides or other hosts within the set-up.

For over ten years, attackers have been intelligently mixing multiple attack-types within one attack on a host, hosts or services. This is to keep the attack victim busy trying to defend against the most obvious attack methods while the real, less obvious attack, slips by and reaches its intended result. Introducing variations in specific attack streams over time is also becoming more common.

The entire attack and combination of methods used forms a so-called kill chain. These different attack types are also referred to as ‘attack vectors’, hence the newly popular term ‘multi-vector attacks’.

The reasons for DDoS attacks vary. Common motivations are political, corporate, criminal, social activism or even payback. The party wanting to attack a specific individual or organisation (the sponsor) is rarely the same as the party that actually conducts the DDoS attack. The sponsor typically pays an unrelated attacker to initiate and manage the attack.