The internet is amazing.
It’s changed our lives in countless brilliant and futuristic ways.
But as with so much else, there are two sides to that coin -
as the rise of the internet has made it easier
to connect and communicate with others,
it’s also created new opportunities for individuals and groups
to attack those they disagree with.
These attacks come in different forms;
you’re probably familiar with hacking and identity-theft
but something you might not be as familiar with
is the concept of DDoS attacks.
DDoS stands for "Distributed Denial of Service”,
and it’s an increasingly common way of attacking and disabling a website
by flooding it with requests for information.
Sometimes, these attacks are carried out by ‘hacktivist’ style groups,
who see DDoSing as a way of protesting against governments and large companies.
But hacktivism is only part of the story -
in 2014, when Evernote, Feedly and TweetDeck were hit by an attack,
Feedly reported that they’d been sent two extortion letters.
Before that, in 2013, in something straight out of an Oceans 11 movie,
Bank of the West suffered a DDoS attack,
during which fraudsters moved over $900,000 out of customers’ accounts.
That isn’t hacktivism - that’s just plain old theft,
and just the same as all businesses are vulnerable to theft in the real world,
all online businesses are vulnerable to DDoS attacks.
So how do they work?
Well, imagine a bar, with one bartender serving customers.
There's only about 10 people drinking,
so when they order they get served pretty quickly.
Maybe, if they all go to buy a drink at the same time,
there'll be a slightly longer wait, but our bartender is a pro -
no one’s going to be thirsty for very long.
And because bars are used to doing
different amounts of business at different times,
this will hold true if we up the number of drinkers a bit - 20, 50, even 100 people -
there might need to be some extra staff drafted in,
but everyone’s going to get the drink they ordered in a timely fashion.
Now, this bar represents our website.
We're going to expect different rates of traffic - bar patrons - at different times.
Generally speaking we'll be equipped to handle that traffic.
But DDoS attacks are more than just ‘busy periods’ or a bit of extra traffic -
they use something called a botnet
to take advantage of malware
installed on the computers of unsuspecting internet users,
and in doing so they co-opt thousands, even millions,
of computers to attack in huge numbers - far more than a website would
normally be prepared to deal with.
With the advent of home automation, almost any device
which connects to the internet can be used in such an attack
- your Amazon Echo, your Sonos, your state-of-the-art-fridge -
if it has an IP address, it could be vulnerable.
And because the attack is using real devices,
it’s very hard to tell which information requests are legitimate,
and which are coming from, say, your smart doorbell.
Let's go back to our bar.
We have our usual 10 drinkers sitting quietly enjoying a pint.
Suddenly, the doors open, and robots
- that’s right, robots -
which look just like regular customers, begin pouring in and demanding drinks.
Soon there are 200 of them. Then 500.
Before you know it, one thousand robots have squeezed into the bar.
They’re all screaming "GIVE US BEER!” at the staff,
even though they have no intention of drinking it.
The bartenders, who can’t tell the difference between the robotic invaders
and the original 10 patrons, are trying their best to serve everyone,
but there are just too many.
There's already a crowd outside.
10,000, 20,000 - soon, the streets surrounding the bar are rammed with
50,000 crazed, beer-demanding robots.
The staff have given up and escaped through the back door,
and it's going to be a long time until our bar is back up and running.
This is a successful DDoS attack.
And what's more, it's on an accurate scale.
some attacks have been known to experience
over twenty thousand times more information requests
than they normally receive.
That’s a lot of robots.
A few years ago, an attack of this scale
would have been incredibly hard to orchestrate,
but these days it can be purchased cheaply
- really cheaply -
on the dark web, which means that anyone with $50 and an axe to grind
is a potential threat.
And while there are an increasing number of services
designed to prevent and limit the effectiveness of DDoS attacks
by authenticating and blocking information requests,
the reality is that those working to carry out these attacks
are likely working hard to find new approaches.
So the fight is far from over,
but by understanding what DDoS attacks are, why they happen,
and what defensive measures are available,
you can decrease the likelihood of you or your business
becoming a victim of one - and that’s a good place to start.