Denial-of-Service Attacks

A denial-of-service (DoS) attack is an attempt to stop a service from working by flooding it with traffic. The attacker sends huge amounts of data or requests to a server, so its CPU is always busy dealing with the junk and its network bandwidth is completely full. The attacker is not usually trying to steal data; the aim is to deny access to anyone else.

Imagine a small online shop that prints custom phone cases. If thousands of requests hit its web server every second, real customers just watch a loading spinner and then get an error page. Their orders never go through, so the shop loses sales and looks unreliable, even though nothing was actually broken.

Distributed attacks

In a DDoS (distributed denial-of-service) attack, a botnet is used: many compromised computers are commanded to send requests simultaneously to one target. A botnet is many infected machines working together, not a single computer.

The owners of those computers usually have no idea. Their machines were infected with malware that quietly sits in the background and waits for instructions from the attacker, who controls the whole botnet remotely. A school laptop, a home PC and a smart TV could all be part of the same botnet.

Why DDoS is harder to stop

With a single-source DoS attack, a technician can often spot the one address sending all the traffic and block it. In a DDoS attack the requests arrive from hundreds or thousands of different addresses in different locations, so blocking one makes almost no difference. The technician cannot block every address, so the server stays overwhelmed and the attack is much more likely to succeed.