What are Dos and Ddos attacks and why are they dangerous?

Dos attacks on servers and systems in order to disable them or slow down their work, which ultimately will not allow end users to use the system.
Ddos is an attack of the same type as described above, but in this case a large number of systems are used, which the attacker owns due to hacking and control of different sources.

Who and why uses this type of attacks?

These attacks can be caused for a number of different reasons, ranging from personal hostility to blackmail of companies. The attack is carried out on various web resources that can supply any services or even be a government site. Depending on the hosting, it is determined how quickly the equipment can be disabled and whether it is possible to do it in principle. This type of attack can be used by anyone from an ordinary schoolboy to competitor companies, some companies are so unscrupulous that they can use this type of attack to destroy the enemy's business. Often this type of attack is used for entertainment or to cause financial harm to companies, because every successful attack leads to financial losses.
Now we will look at what kind of attacks there are and how they differ.

Types of attacks

To carry out an attack of this kind, various methods are used and now we will list several basic types.

Bandwidth saturation – this type of attack is carried out due to bandwidth overflow using flood. Flood is an attack associated with a large number of meaningless requests directed to a computer network or network equipment in order to disable it. The flood is divided into several varieties, for example, HTTP and Ping flood is the most primitive type of flood that allows you to fill the bandwidth with Ping requests, but in order for this to bring at least some result, the attacker's bandwidth must be greater than the victim's bandwidth.
One of the most dangerous attacks is ICMP flood, which guarantees 100% denial of service of the system. It consists in the fact that a broadcast is used, which is enhanced with the help of an additional. Participant - reinforcing network. For example, a hacker sends a request through an amplifying network containing 100 nodes, this request will be increased 100 times and redirected to the victim's address.

Lack of resources – This type of attack allows an attacker to seize additional resources, the very purpose of the attack is this. The attack is carried out taking into account the fact that there is already a certain amount of system resources. To carry out this type of attack, you just need to overload the victim's processor.
Processor overload can be performed in various ways, for example, server overflow with log files or sending *heavy* packets.
Server overflow with log files is most often performed if the administrator is inexperienced and has not set a limit when configuring the system. In this case, an attacker can take advantage of this and will send large packets that will quickly fill up the disk.

Sending *heavy* packets – packets are sent to the server that, without saturating the bandwidth, spend all the processor time, which is why the server processor cannot process requests normally and users cannot access the resource.

Programming errors are an advanced level of Ddos attack, which consists in writing exploits that address errors in the code and lead to access to unused fragments of the program.

Disadvantages in the code - It consists in finding errors in the code and then in processing these situations by the system, and since the system does not know how to handle this kind of task, it may stop working.

Buffer overflow – In short, an application written by a programmer has a server that accepts no more than the N number of bytes, but the server protocol can accept more bytes several times. The hacker changes the application code in such a way that the number of available bytes that the protocol can receive will be sent to the server, but since the server is not programmed to accept such a large amount of data, it stops working.

How to detect a Ddos attack?

Most often, additional means to detect an attack are not required because it can be noticed without them. Network deceleration or inability to load the necessary site may indicate that an attack is being made on you, but sometimes it is very difficult to find out that an attack has been made. And in order to avoid such situations, there are several ways to detect Ddos attacks:

• Signature – qualitative traffic analysis
• Static – quantitative traffic analysis
• Hybrid – a combination of the two above

Protection against Ddos attacks

To protect yourself from Ddos attacks, you can use various methods, but it is important to understand that perfect protection does not exist at the moment.
Among these methods can be noted: good transit potential and server performance, traffic analysis, the use of reflection equipment, etc.

Transit potential - lies in the fact that it is necessary to make sure at the stage of application/service development that the hosting capacity is large. Since the purpose of the attacks is the disabling and unavailability of the service/application for end users, you should make sure in advance of a good bandwidth. This will make ddos attacks on your server less noticeable.

Server performance – Since many attacks are designed to absorb the resources of your server and take all the processor time, you need to make sure that you can quickly change the parameters of your server by adding RAM or the number of processors. This will help to avoid excessive load on the server in the event of a Ddos attack and will give more time to make a decision on how to get rid of it.

Traffic analysis - allows you to know in advance about the attack, which is being prepared by detecting a large amount of traffic flow to the server. In turn, having learned in advance about a large traffic flow, you can reconfigure the server so that only allowed traffic is received by analyzing individual packets.

Using equipment to repel - There are many different types of equipment to repel an attack, these types of equipment are deployed directly in front of servers and routers filtering incoming traffic.

Result

In this article, we have analyzed what Dos and Ddos attacks are, how they differ and why they are so dangerous. It does not matter if you have a large business or you have just opened it, in any case you are at risk of these attacks. To avoid them, you can use various methods, but the main thing is to understand that in order to better protect your service, you need to use a good and proven hosting. Mivocloud provides excellent opportunities for hosting your enterprise and also provides excellent protection against Ddos attacks. And for an additional fee, it also provides management of your server. You can use various hosting services, the most important thing is that your website is safe and not subject to attacks, since each attack represents a loss of funds or data.