DDoS Attack Explained

Hello everyone, in this video we're going to  talk about DDoS and what it is. DDoS stands for distributed denial of service. And what this  is, it's basically a cyber attack on a specific server or network with the intended purpose  of disrupting that network or server's normal operation.

And a DDoS attack does this by flooding  the targeted network or server with a constant flood of traffic, such as fraudulent requests,  which overwhelms the system, causing a disruption or denial of service to legitimate traffic. So for  example here we have a web server and let's just say that this web server could belong to a company  that sells their products over the internet. And over here we have a couple of customers with their  computers that are browsing the company's website, looking at the company's products or services. 

Now let's just say that someone just wanted to do an attack on this company's web server. And let's  just say that they're going to attack the server for whatever reason. For example maybe they don't  like the company or they don't like the owners of the company or whatever.

So what happens is the  attacker is going to use their computer and their program to attack this server and flood it with  fraudulent data traffic to try and disrupt its service. Now this is not a DDoS attack, this is  just called a DoS attack which stands for denial of service. Because a DoS attack is an attack  that's just coming from one source.

Now normally a network or server is able to handle an attack from  a single source because it's easier to pinpoint. The server can just simply close the connection  where the attack is coming from. So that's not really a problem.

However, the problem is that  what if an attack comes from multiple sources simultaneously? And that is what a DDoS is. A DDoS  is an attack from multiple sources all at once.

So this computer here, who is the ringleader, can  communicate with other computers around the world and coordinate an attack on this server. So now  instead of an attack coming from a single source, the server now has to deal with an attack from  multiple sources and when this happens, it will overwhelm the server. It will eat up the server's  system resources, such as the CPU and memory, and it will also eat up network bandwidth.

So  as a result, these legitimate computers over here are going to be denied service because the  server is too preoccupied in dealing with a DDoS attack. So the web pages that these computers  want to access or either not going to load or they are going to be very slow in loading and  they'll get that familiar spinning wheel of lag on their screens. So the question is how does the  attacker get other computers to get involved in a DDoS attack?

And the simple answer is by using  malicious software. The attacker will develop a malware program and distribute it over the  internet and put it on things like websites and email attachments. So if a vulnerable computer  goes to these infected websites or opens these infected email attachments, the malware will be  installed on their computer without the owner even knowing that their computer has been infected. 

So now their computer has been recruited in an army of other infected computers to perform  a DDoS attack. And this army of infected computers is what's called a botnet. Now this  botnet is not just limited to a few computers, this botnet could be hundreds or even thousands of  computers that are scattered all over the world.

So now this botnet can be controlled like an army,  waiting to receive instructions from the attacker, who is now like a centralized command and  control center for the botnet. And then the attacker can send out commands to all these  computers and to tell them to attack at a certain date and time. And then once that  set time is reached, the attack begins.

Now a DDoS attack can last for hours  or even days. It just depends on the attackers intent. So another question is, why  do people do DDoS attacks?

DDoS attacks can happen for several different reasons. For  example it could be for financial reasons and the attacker is DDoSing a competitor  in the marketplace. It could also be for maybe political reasons.

Maybe they don't  like the targeted organization's beliefs.