DoS and DDoS Attacks

In the domain of network security, we often focus on protecting confidentiality (keeping data secret) and integrity (ensuring data isn't tampered with). But there's a third pillar of the CIA triad that's equally critical yet often underestimated: availability. A system that cannot be accessed—even if its data remains perfectly secure and unaltered—is effectively useless.

Denial of Service (DoS) attacks target this fundamental principle. They don't steal your data or modify your files. Instead, they do something potentially more devastating for business operations: they make your systems unreachable. When a hospital's patient records system goes offline, when an e-commerce platform becomes inaccessible during peak shopping hours, when a bank's online services crash during market hours—the consequences extend far beyond mere inconvenience.

A Denial of Service (DoS) attack is a deliberate attempt to make a computer, network service, or resource unavailable to its intended users. At its core, every DoS attack exploits a fundamental asymmetry: the resources required to launch an attack are significantly less than the resources required to defend against it or to provide the service itself.

The Formal Definition:

A DoS attack can be formally characterized as any action that:

1. Consumes finite resources necessary for service operation
2. Exploits computational or protocol weaknesses to cause disproportionate processing
3. Disrupts connectivity between legitimate users and services
4. Degrades service quality below acceptable operational thresholds
5. Crashes or destabilizes target systems through malformed inputs or overload conditions

The key insight is that DoS attacks don't require "breaking in" to a system. They don't need passwords, exploit vulnerabilities for code execution, or require sophisticated hacking skills. They simply abuse the fundamental nature of networked services: a server must respond to requests, and processing those requests consumes resources.

The Anatomy of Resource Exhaustion:

Every computer system operates with finite resources. DoS attacks systematically target these bottlenecks:

CPU Cycles: Every packet received must be processed. Cryptographic operations, database queries, and application logic all consume CPU time. When CPU utilization reaches 100%, new requests cannot be processed.

Memory (RAM): Connection state tables, session data, and request buffers all consume memory. A server with 16GB of RAM maintaining 1MB per connection can handle only ~16,000 simultaneous connections before running out of memory.

Network Bandwidth: Even if a server has infinite CPU and memory, its network connection is finite. A 1 Gbps link can be saturated by flooding traffic, preventing legitimate packets from arriving.

Connection Tables: Operating systems and network devices maintain state tables for active connections. These tables have fixed sizes. When they're full, new connections are refused.

Application-Specific Resources: Database connection pools, file descriptor limits, thread pools, and application queues all have finite capacity.

Storage I/O: Disk throughput is limited. Attacks that force excessive logging or database writes can exhaust storage bandwidth.

Understanding the history of DoS attacks provides crucial context for why modern attacks are so sophisticated and why defense remains challenging. The evolution of these attacks mirrors the evolution of the Internet itself.

The Pre-Internet Era (1970s-1980s):

Before the modern Internet, denial of service was primarily a physical concept—cutting phone lines, jamming radio signals, or overwhelming switchboards with calls. Early computer networks experienced primitive DoS through resource hogging on shared mainframes, where a single user could monopolize CPU time and crash the system.

The Nascent Internet (Late 1980s-Early 1990s):

As ARPANET evolved into the Internet, the first network-based DoS attacks emerged. The Morris Worm of 1988, while technically a worm, caused widespread denial of service by replicating so aggressively that it consumed resources on infected machines. This accidentally demonstrated that network effects could amplify resource exhaustion.

The Ping of Death Era (1996-1997):

The Ping of Death attack exploited a vulnerability in how operating systems handled oversized ICMP packets. By sending a malformed ping packet larger than the maximum allowed size (65,535 bytes), attackers could crash vulnerable systems. This attack was notable because:

• A single packet could crash a system
• It required minimal bandwidth or resources
• It affected Windows, Unix, and network equipment alike

This era demonstrated that protocol implementation flaws could be exploited for DoS even without volumetric flooding.

The SYN Flood Revolution (1996):

The SYN flood attack represented a fundamental shift in DoS methodology. Instead of exploiting implementation bugs, it exploited the TCP protocol itself:

1. TCP requires a three-way handshake: SYN → SYN-ACK → ACK
2. When a server receives a SYN, it allocates memory for the pending connection
3. The server waits (typically 75 seconds) for the completing ACK
4. Attackers send SYNs but never complete the handshake
5. The server's connection table fills with half-open connections
6. Legitimate users cannot establish new connections

SYN floods were revolutionary because they exploited a protocol design decision, not a bug. The TCP specification itself created the vulnerability. This attack remains relevant today, though mitigations have evolved.

The Smurf Attack (1997-1998):

The Smurf attack introduced the concept of amplification—leveraging third-party infrastructure to multiply attack power:

1. Attacker sends ICMP echo request to a broadcast address
2. Source IP is spoofed to be the victim's address
3. Every host on the broadcast network sends a reply to the victim
4. If 100 hosts respond to each request, the attacker achieves 100x amplification

At its peak, Smurf attacks could amplify traffic by 1000x or more, enabling attackers with modest bandwidth to generate overwhelming floods.

The Mafiaboy Incident (2000):

In February 2000, a 15-year-old Canadian using the handle "Mafiaboy" launched DDoS attacks against Yahoo!, Amazon, Dell, eBay, and CNN—some of the largest websites at the time. Yahoo! was offline for over an hour; the estimated damage exceeded $1 billion. This attack demonstrated:

• Even major Internet infrastructure was vulnerable
• Teenagers with scripts could cause massive damage
• The Internet had developed critical dependencies
• DDoS had become a national security concern

The Modern Era (2010s-Present):

Contemporary DoS attacks have evolved in several key dimensions:

Scale: Attacks now regularly exceed 1 Tbps (terabit per second), requiring enterprise-grade mitigation infrastructure.

Sophistication: Multi-vector attacks combine volumetric flooding with protocol exploitation and application-layer attacks simultaneously.

Accessibility: DDoS-as-a-Service platforms enable anyone to launch attacks for as little as $10/hour.

IoT Weaponization: Millions of poorly secured IoT devices (cameras, routers, DVRs) are conscripted into botnets like Mirai.

Application Awareness: Modern attacks target application-specific weaknesses (expensive database queries, API endpoints) rather than just network layers.

This evolution means that defending against DoS requires deep understanding of attacks at every layer of the network stack.

DoS attacks can be categorized along multiple dimensions. Understanding this taxonomy is essential for both recognizing attacks and implementing appropriate defenses.

Classification by Attack Vector:

DoS attacks target different layers of the network stack, each requiring different defensive approaches:

Classification by Resource Consumption Method:

Another useful taxonomy distinguishes attacks by how they consume resources:

Classification by Attack Sophistication:

Simple Floods: Brute-force bandwidth consumption using readily available tools. Effective but easily identified and filtered.

Protocol-Aware Attacks: Exploit specific protocol behaviors (TCP, HTTP, DNS). Require more knowledge but achieve better efficiency.

Application-Specific Attacks: Target known expensive operations in specific applications. Require reconnaissance but minimal bandwidth.

Adaptive Attacks: Modify behavior in response to defensive measures. May switch vectors, adjust timing, or target discovered weaknesses.

Classification by Attack Source:

Single-Source DoS: Attack originates from one machine. Easier to block but limited in power. Often used for testing or targeting smaller systems.

Multi-Source DoS (DDoS): Attack distributed across many machines (botnet). Much harder to block because traffic appears to come from many legitimate-looking sources.

Reflected/Amplified DoS: Uses third-party servers to reflect/amplify traffic. Attacker sends small requests that generate large responses directed at the victim.

Understanding DoS attacks at the protocol level reveals why they're so effective and why defense is fundamentally challenging. Let's examine the most important attack types in technical depth.

The SYN Flood Deep Dive:

The SYN flood exploits the TCP three-way handshake, one of the most fundamental protocols on the Internet. Here's the precise mechanics:

Why SYN Floods Are Difficult To Stop:

The fundamental challenge is distinguishing malicious SYNs from legitimate connection attempts. Consider:

1. Legitimate users also send SYNs — You cannot simply block all SYNs without blocking all new connections.

2. Spoofed source IPs — The attacker typically spoofs random source IP addresses, so you can't simply block the "attacker's IP."

3. Protocol compliance — Each individual SYN packet follows TCP specifications perfectly; there's nothing "malformed" to detect.

4. State asymmetry — The server must allocate resources upon receiving a SYN, but the attacker allocates nothing.

The Slowloris Attack:

Slowloris represents a different philosophy: instead of flooding with traffic, it exploits connection persistence to exhaust server resources with minimal bandwidth.

The UDP Flood:

UDP floods exploit the stateless nature of UDP. Unlike TCP, UDP has no handshake—any packet sent is processed immediately:

1. Attacker sends UDP packets to random ports on the target
2. Target checks if any application is listening on that port
3. If no application is listening, target generates ICMP "port unreachable" message
4. For each incoming UDP packet, target consumes CPU for processing and generates outbound traffic

The asymmetry: the attacker sends one packet; the target processes the packet AND generates a response. Additionally, UDP floods often target services like DNS that perform complex processing for each request.

ICMP Flood (Ping Flood):

The simplest volumetric attack sends massive quantities of ICMP echo request (ping) packets:

1. Each ICMP echo request requires the target to generate an echo reply
2. Processing and responding consumes CPU cycles
3. With sufficient volume, the target's network link becomes saturated
4. Legitimate traffic cannot reach or leave the target

While simple, ICMP floods remain effective against targets with limited bandwidth or those that haven't disabled ICMP responses.

Application-layer DoS attacks represent the most sophisticated category, targeting specific application behaviors rather than network protocols. These attacks are particularly dangerous because they:

1. Resemble legitimate traffic — Each request looks like a normal user action
2. Require less bandwidth — A single carefully crafted request can consume significant server resources
3. Bypass network-layer defenses — Firewalls and rate limiters designed for packet-level attacks are ineffective
4. Require application-specific defenses — No generic solution exists; each application needs custom protection

HTTP Flood Attacks:

HTTP floods send large volumes of seemingly legitimate HTTP requests. The sophistication varies considerably:

Expensive Query Attacks:

Some requests are inherently more expensive than others. Attackers can target these specific operations:

Search Queries: Full-text search across millions of records with complex filters can take seconds of CPU time.

Report Generation: PDF generation, large data exports, or complex analytics calculations.

Authentication Operations: Bcrypt password hashing is intentionally slow (100ms+), making login pages attractive targets.

GraphQL Complexity: Deeply nested queries can cause exponential processing time.

Regex-Based Processing: Regular expressions with catastrophic backtracking can lock up processors for hours on a single input.

XML External Entity (XXE) Based DoS:

XML parsers that process external entities can be abused for DoS:

Billion Laughs Attack: A specially crafted XML document uses entity expansion to create exponentially growing data in memory:

The impact of a successful DoS attack extends far beyond technical inconvenience. Understanding the full scope of consequences is essential for appropriate risk assessment and investment in defenses.

Direct Financial Impact:

The immediate cost of downtime varies dramatically by industry and organization size:

Indirect Business Impacts:

Reputation Damage: Customers remember when your service was unavailable. Trust, once lost, is expensive to rebuild. Studies show that 80% of customers will switch to competitors after experiencing service disruptions.

SLA Violations: Service Level Agreements often specify uptime guarantees. Violations trigger credits, penalties, or contract terminations. A 4-hour outage could cost months of revenue in penalties.

Competitive Disadvantage: If your service is unavailable while a competitor's isn't, customers may switch permanently. User acquisition costs dwarf the cost of any single attack.

Employee Productivity: Internal services going down (email, collaboration tools, development infrastructure) halt work for entire organizations.

Legal and Regulatory Consequences:

Depending on the industry, DoS-related outages can trigger regulatory scrutiny:

Financial Services: SEC and FINRA have notification requirements for significant system outages. Repeated failures can invite enforcement actions.

Healthcare: HIPAA considers availability part of the security rule. Attacks that prevent access to patient data may constitute breaches.

Critical Infrastructure: Energy, utilities, and telecommunications face regulatory frameworks requiring resilience against cyber attacks.

Data Protection: GDPR and similar regulations may consider availability incidents reportable events if they affect data access rights.

Understanding who launches DoS attacks and why is crucial for threat modeling and defense prioritization. Different threat actors have different capabilities, goals, and attack patterns.

Threat Actor Categories:

Motivation Deep Dive:

Extortion (Ransom DDoS/RDoS):

Ransom DDoS has become a significant threat category. The typical pattern:

1. Attacker sends email demanding Bitcoin payment
2. Email threatens sustained DDoS if payment isn't made
3. Demonstration attack (15-30 minutes) proves capability
4. Demand escalates if initial deadline missed
5. Attacks may continue even after payment (no honor among thieves)

RDoS campaigns target organizations likely to pay quickly: online gambling during major events, e-commerce during peak seasons, financial services during trading hours.

Competitive Attacks:

In highly competitive industries, taking down a competitor's service—even briefly—can redirect customers:

• Gaming platforms attacked during new release launches
• E-commerce sites hit during Black Friday/Cyber Monday
• SaaS products attacked to trigger SLA violations
• Online services disrupted during investor demos or earnings calls

Hacktivism:

Politically or ideologically motivated attacks target organizations for perceived wrongdoing:

• Operation Payback (2010): Attacks on PayPal, Visa, Mastercard for blocking WikiLeaks payments
• Anonymous operations against various government and corporate targets
• Attacks on organizations involved in controversial industries

State-Sponsored Attacks:

Nation-state actors use DoS as a tool of hybrid warfare:

• 2007 Estonia attacks: Following political controversy over a Soviet war memorial
• 2008 Georgia attacks: Coordinated with military invasion
• Ongoing attacks on critical infrastructure across many countries

State-sponsored attacks typically feature unlimited resources, patience, and sophisticated multi-vector approaches.

We've established a comprehensive foundation for understanding Denial of Service attacks. Let's consolidate the essential concepts before moving to Distributed Denial of Service (DDoS) in the next page:

Foundation for DDoS:

The concepts we've covered here—resource exhaustion, asymmetric attacks, protocol exploitation, and application-layer vulnerabilities—all apply to Distributed DoS attacks. The key difference is scale: DDoS harnesses thousands or millions of attack sources simultaneously, dramatically amplifying every principle we've discussed.

In the next page, we'll explore how attackers organize these distributed attacks, the botnet infrastructure that powers them, and why defense becomes exponentially more difficult when attacks come from everywhere at once.