What is a DDoS attack? How to protect against DDoS attacks?

• May 22, 2023June 8, 2023

DDoS attack is one of the most serious cybersecurity problems today. These attacks, carried out by sending heavy traffic to websites or networks, disrupt the normal functioning of the target and make it impossible for users to benefit from the services. A DDoS attack is a method by which cyber attackers act for financial gain, political purposes, or just for fun. The targets of these attacks may include large corporate companies, banks, government institutions, news sites, e-commerce sites and even individual internet users. In this article, we will discuss what a DDoS attack is, its types, methods of execution, targets, protection methods, penalties and why it can harm businesses.

It is important for everyone to have information on this subject and to work with companies that are experts in cyber security in order to be protected from such attacks.

What is DDoS?

DDoS is the abbreviation of the English words “Distributed Denial of Service” and its Turkish equivalent is “Distributed Denial of Service Attack”. Such attacks disrupt the normal functioning of a website or network due to heavy traffic from many different sources, causing services to become unavailable. These attacks can make the web page impossible to access, crash applications or servers.

What are the Types of DDoS Attacks?

DDoS attacks can be carried out using many different methods, and each type can cause different effects on the target system. Therefore, knowing the types of DDoS attacks and how they are carried out can help protect target systems against such attacks.

TCP SYN Attack

It is one of the most common types of DDoS attacks and is basically carried out using the TCP/IP protocol. In this type of attack, attackers send many TCP connection requests to the target network or server. Some of these requests disrupt the normal functioning of the target, leaving open connections waiting for the target to respond.

Without waiting for responses from the target system, attackers leave the network and the target system terminates open connections. Such attacks consume the resources of the target systems, reducing the availability of the server and preventing the services from working efficiently.

A TCP SYN attack is often used to prevent target systems such as internet service providers (ISPs), web servers, and other networked devices from establishing connections. This type of attack is one of the most common types of DDoS attacks and can cause serious impacts.

UDP Attack

It is one of the most common types of DDoS attacks and is carried out over the User Datagram Protocol (UDP). In this type of attack, attackers send a large number of UDP packets to the target network or server. These packets disrupt the normal functioning of the target and consume the target's resources.

Since the UDP protocol has vulnerabilities, this type of attack can be carried out quite easily for attackers. UDP attacks can be configured so that attackers can attack from many different computers or devices, overwhelming target systems to the point of destruction.

UDP attacks are often used to exhaust resources and reduce the availability of target systems such as internet service providers (ISPs), DNS servers, gaming servers, and other networked devices. This type of attack is one of the most effective and destructive types of DDoS attacks.

ICMP Attack

It is carried out using the Internet Control Message Protocol (ICMP) protocol. In this type of attack, attackers send a large number of ICMP packets to the target network or server. These packets disrupt the normal functioning of the target and consume the target's resources.

The ICMP protocol is a protocol used to monitor the operation of target systems and report errors. However, attackers who exploit the flaws of this protocol disrupt the normal functioning of the target by sending large numbers of ICMP packets from other devices on the network.

ICMP attacks are often used to reduce the availability and exhaust the resources of target systems such as internet service providers (ISPs), servers, and other networked devices. This type of attack is one of the most effective and destructive types of DDoS attacks and can cause serious impacts on target systems.

HTTP Attack

It is carried out via Hypertext Transfer Protocol (HTTP). In this type of attack, attackers send a large number of HTTP requests to the target web server. These requests disrupt the normal functioning of the target and deplete the target's resources.

HTTP attacks are often carried out with the aim of causing websites to crash or become inaccessible. In this type of attack, attackers can send hundreds of thousands or even millions of requests to the web server. This causes the target web server to run out of resources and render services unusable.

HTTP attacks are often used to reduce the accessibility of e-commerce sites, news sites, banks and other websites. This type of attack is one of the most common and effective types of DDoS attacks and can cause serious impacts on web servers.

Slowloris Attack

Slowloris attack is a type of DDoS attack and is carried out against web servers. In this type of attack, attackers open many connections to the target web server, keeping those connections open but not sending any requests. This causes the target web server to run out of resources and render services unusable.

The Slowloris attack can be quite effective in cases where the web server's connection management mechanism is inadequate. By opening hundreds of thousands or even millions of connections, attackers can slow down or crash the web server.

Slowloris attacks are often used to reduce the accessibility of e-commerce sites, news sites, banks and other websites. This type of attack is one of the effective types of DDoS attacks and can cause serious effects on web servers.

DNS Amplification Attack

It is performed using the Domain Name System (DNS) protocol. In this type of attack, attackers send multiple DNS requests to the target network or server. These requests disrupt the normal functioning of target systems and consume their resources.

DNS Amplification attack relies on attackers sending very large DNS requests to target systems using the UDP protocol. These requests prevent normal operation of target systems and consume network resources. In addition, attackers can hide their true sources by sending their requests from fake IP addresses.

DNS Amplification attacks are often used to reduce the availability and exhaust the resources of target systems such as internet service providers (ISPs), DNS servers, and other networked devices. This type of attack is one of the most effective and destructive types of DDoS attacks and can cause serious impacts on target systems.

How are DDoS attacks carried out?

DDoS attacks are most often carried out by a network of bots called a botnet. These bots come together and coordinate to carry out the attack, often infecting many different computers via viruses, trojans, or other malware. In this way, attackers send intense traffic using thousands or even millions of bots and disrupt the normal functioning of the target.

The target of DDoS attacks can often be large corporate companies, banks, government agencies, news sites, e-commerce sites and even individual internet users. Attackers may act for different purposes, such as financial gain, political purposes, or simply attacking for fun. The targeted institutions may experience loss of reputation, loss of customers and financial losses as a result of the attack.

Who is the target of DDoS attacks?

The target of DDoS attacks can often be large corporate companies, banks, government agencies, news sites, e-commerce sites and even individual internet users. Attackers may act for different purposes, such as financial gain, political purposes, or simply attacking for fun. The targeted institutions may experience loss of reputation, loss of customers and financial losses as a result of the attack.

Methods to Protect from DDoS Attacks

High-Capacity Network Infrastructure: High-capacity network infrastructure is important to manage the high traffic volumes that may occur on the network. Therefore, high-capacity network infrastructure can be used as a preventive measure against DDoS attacks.

DDoS Prevention Devices: DDoS prevention devices are a security technology used to detect and block DDoS attacks. These devices perform traffic analysis to detect attacks and prevent problems that may occur in the network by taking the necessary precautions.

CDN (Content Delivery Network) Services: CDN services are used to manage high traffic volumes that may occur on the network. These services reduce network traffic by storing content on different servers and serving users from the closest server.

DNS Security Solutions: DNS security solutions are another method used to take precautions against DDoS attacks. These solutions are designed to protect DNS servers and provide defense against DNS amplification attacks from attackers.

Update and Patch Management: Update and patch management is important for the security of the system and applications. Therefore, by regularly updating and patch management, you can become more protected against attacks.

Emergency Plans: Contingency plans are important for responding to DDoS attacks. These plans provide a roadmap on what to do in the event of an attack and the necessary measures, thus minimizing the problems that may occur in the network.

These methods are some measures that can be used to protect against DDoS attacks. However, they may not be effective in all cases. Therefore, it is recommended that you create a customized DDoS prevention plan with support from cybersecurity experts.

AI and ML Based DDoS Prevention Solutions

DDoS (Distributed Denial of Service) attacks can cripple networks, systems, or websites, causing services to become inaccessible. A number of devices and solutions exist to prevent DDoS attacks. Additionally, in recent years, artificial intelligence (AI) and machine learning (ML) technologies have helped develop a number of new strategies and solutions that further enable protection against DDoS attacks.

AI and ML-based DDoS prevention strategies and devices typically have the following features:

Detecting Anomalies: Artificial intelligence and machine learning algorithms learn what normal network traffic looks like and then detect deviations (anomalies) from this pattern. Because a DDoS attack is usually characterized by a sudden and significant increase in traffic, AI can detect such changes quickly.

Identifying Specific Attacks: Each DDoS attack can be unique, and the symptoms of a particular attack may differ from past attacks. AI and ML learn to predict future attacks based on historical data.

Automatic Response: AI can automatically respond when it detects signs of a DDoS attack. This could mean limiting traffic, blocking certain IP addresses, or engaging other defense mechanisms.

Adaptive Learning: AI and ML algorithms constantly learn and adjust to adapt to new threats and changing network conditions. This strengthens defense against constantly evolving DDoS attack strategies.

Predictive Analysis: AI and ML algorithms may have the ability to predict future attacks based on historical data and current trends. This can be used to create proactive defense strategies.

Artificial Intelligence (AI) and Machine Learning (ML) based DDoS (Distributed Denial of Service) solutions have been developed by many cybersecurity firms. Such solutions use AI and ML technologies to detect, respond to, and protect against attacks faster and more accurately. Here are some solutions in this area:

Cloudflare: Cloudflare provides a service that protects websites and applications from DDoS attacks. Using AI and ML technologies, Cloudflare automatically detects and blocks attacks.

Arbor Networks: Arbor Networks offers “Arbor Threat Analytics,” an AI and ML-based DDoS protection solution. This solution uses advanced threat detection and analysis technologies to quickly detect and respond to attacks.

Akamai: Akamai provides a wide range of DDoS protection services using AI and ML technologies. Akamai's solutions detect attacks in real time and respond automatically.

NETSCOUT: NETSCOUT offers a range of DDoS protection solutions using AI and ML technologies. These solutions use advanced threat detection and analysis technologies to detect, analyze and respond to attacks.

Radware: Radware offers a range of solutions that protect against DDoS attacks using AI and ML technologies. Radware's solutions quickly detect attacks and respond automatically.

How to prevent DDoS attacks on websites?

DDoS attacks aim to send excessive amounts of traffic to a website or online service, overloading it and rendering it unusable. A number of strategies and techniques can be applied to prevent such attacks. As a cybersecurity expert, I can make the following recommendations:

1. Diversifying Network Infrastructure: You can diversify your network by using multiple internet service providers (ISPs) and/or hosting your services in multiple data centers. This prevents a single DDoS attack from affecting all your services at once.

2. Having High Capacity Network Resources: Make sure your website or service has sufficient network capacity to handle demands. This can mitigate the impact of a DDoS attack.

3. Using Anti-DDoS Services and Tools: There are many anti-DDoS services and tools on the market. These services and tools automatically detect DDoS attacks and take action to mitigate the attack.

4. Using Artificial Intelligence and Machine Learning Technologies: Artificial intelligence and machine learning technologies may have the ability to automatically detect and mitigate a DDoS attack. These technologies constantly learn and evolve to differentiate between normal network traffic and DDoS attack traffic.

5. Turning Off Open Routers and DNS Servers: Open routers and DNS servers are common targets of DDoS attacks. Leaving these services open unnecessarily allows attackers to exploit your network and escalate a DDoS attack.

6. Preparing Emergency Plans: Prepare an emergency plan that determines what to do in the event of a DDoS attack. This plan determine what steps to take.To prevent DDoS attacks, many companies offer cloud-based services. Here are a few important companies in this field:

• Cloudflare: Cloudflare protects against DDoS attacks by adding a proxy service in front of your site. Traffic is first routed to Cloudflare's servers, where malicious traffic is filtered out. Cloudflare provides advanced DDoS protection and automatically detects and blocks attacks.
• Akamai: Akamai's DDoS protection service manages website and application traffic and automatically detects and blocks DDoS attacks. Akamai's solutions detect attacks in real time and respond automatically.

• Amazon Web Services (AWS): AWS offers its own DDoS protection service called Shield. AWS Shield protects applications running on AWS against DDoS attacks.

• Imperva Incapsula: Imperva Incapsula protects against DDoS attacks and offers its services to all types of web applications. Incapsula automatically detects attacks and takes precautions against them.

Google Cloud Armor: Google Cloud Armor provides DDoS and application-level protection for applications running on Google Cloud.

These services ensure that your website or online service remains constantly available. These companies typically analyze traffic and filter out malicious traffic, ensuring that only legitimate requests reach your site. Most of these services automatically detect attacks and respond as quickly as possible, ensuring your site is back online as quickly as possible.

Penalties imposed after a DDoS attack

DDoS attacks are illegal in many countries and attackers can face serious penalties. Attackers may face penalties that vary depending on the type of attack, the extent of the attack, the identity of the target, and the laws of the country. Below are some examples of penalties that may be imposed as a result of a DDoS attack:

Fines: As a result of DDoS attacks, attackers may face fines. These penalties vary depending on the extent of the attack and the identity of the target. For example, in the United Kingdom, people involved in DDoS attacks can face prison sentences of up to 10 years and fines.

Prison Sentences: DDoS attacks are a crime in many countries and attackers can face prison sentences. The length of time that attackers go to prison may vary depending on the extent of the attack, the identity of the target, and the laws of the country.

Prohibiting Internet Access: Internet access for attackers involved in DDoS attacks may be banned in some countries. This penalty may be imposed to prevent attackers from planning future attacks over the internet.

IT Crimes and Penalties in Turkey

Cyber Crimes Regulated in the TCK

These articles constitute the part of the Turkish Penal Code that regulates cyber crimes.

TCK No. 5237 (Turkish Penal Code), It regulates all cyber crimes under the title of "Crimes Committed in the Field of Informatics" between articles 243 and 245.

The cyber crimes regulated in the TCK numbered 5237 are as follows:

• The crime of entering the information system (TCK art.243),

ARTICLE 243. – (1) Any person who illegally enters the whole or part of an information system and remains there is sentenced to imprisonment of up to one year or a judicial fine.

(2) In case the acts defined in the above paragraph are committed about systems that can be utilized for a price, the penalty to be imposed is reduced by half.

(3) If the data contained in the system is destroyed or changed due to this act, he is sentenced to imprisonment from six months to two years.

• Crime of Blocking, Destroying, Making Inaccessible, Destroying or Changing Data (TCK art.244),

ARTICLE 244. – (1) A person who hinders or disrupts the operation of an information system is punished with imprisonment from one year to five years.

(2) A person who corrupts, destroys, changes or renders inaccessible data in an information system, places data on the system, or sends existing data to another place, is sentenced to imprisonment from six months to three years.

(3) If these acts are committed on the information system of a bank or credit institution or a public institution or institution, the penalty to be imposed is increased by half.

(4) In the event that the person gaining an unfair advantage for himself or someone else by committing the acts defined in the above paragraphs does not constitute another crime, he is sentenced to imprisonment from two years to six years and a judicial fine up to five thousand days.

• The crime of misuse of a bank or credit card (TCK art.245),

ARTICLE 245. – (1) If a person who seizes or holds a bank or credit card belonging to another person, for any reason, uses it or makes someone else use it without the consent of the cardholder or the person to whom the card is to be given, he shall be sentenced to imprisonment from three years to six years. and is punished with a judicial fine.

(2) A person who benefits himself or someone else by using a bank or credit card that has been fraudulently created or forged, shall be sentenced to imprisonment from four years to seven years, unless the act constitutes another crime requiring a heavier penalty.

Known DDoS attacks in Turkey and the World

In TurkeyDDoS Attack on TTNet: The DDoS attack on TTNet in 2014 caused the internet service provider to be unable to serve its customers. After the attack, TTNet had to use alternative methods to serve its customers.

in americaDDoS Attack:A comprehensive DDoS (Distributed Denial of Service) attack took place against major internet companies such as Twitter and Spotify.

The attack in question caused many users to be unable to access these popular platforms. The purpose behind the attack was to overload the services of these companies and make them temporarily unusable.

In DDoS attacks, attackers often use computer networks called a botnet. These networks form a unified force to increase the intensity of the attack. This botnet used in the attack controls a large number of devices, sending continuous requests to the targeted service and causing servers to overload.

The news emphasizes that DDoS attacks can affect major internet companies and services and negatively affect users. It is stated that attacks should be prevented with cyber security measures and infrastructure strengthening.

(https://www.cnnturk.com/teknoloji/internet/twitter-spotify-gibi-devleri-vuran-ddos-saldirisi)

in europeDDoS Attacks on Banks' Systems: DDoS attacks on some banks in Europe in 2016 blocked access to banks' websites. The purpose behind the attacks was to prevent banks from accessing their customers' bank accounts.

in asiaDDoS Attacks on BitCoin Exchanges: DDoS attacks on some BitCoin exchanges in Asia in 2017 blocked access to the websites of the exchanges. The purpose behind the attacks was to block transactions on exchanges and reduce BitCoin prices.

DDoS attack on Garanti and TTnet:
Türk Telekom and Garanti Bank, two of Turkey's leading communication and banking institutions, were exposed to large-scale DDoS (Distributed Denial of Service) attacks, which clearly revealed the extent of this threat.

In particular, Türk Telekom's internet service is under intense pressure, which significantly affects customers' access to services. With a DDoS attack faced. The attack was a situation in which thousands of people were controlled at the same time. botnet It was carried out by. Such attacks caused targeted servers to become overloaded, rendering services temporarily unavailable. Türk Telekom quickly identified the incident and worked to minimize the potential damage and normalize its services.

Likewise, Garanti Bank was also subjected to a similar attack. The bank's digital services were significantly disrupted under the impact of the attack. Customers encountered problems such as not being able to perform online banking transactions.

These events emerged as important examples that underline the importance of cyber security. While even Turkey's largest organizations may remain vulnerable to such attacks, cyber security It shows how vital these measures are. Businesses and organizations should invest in both technological solutions and trained personnel to increase resilience against cyber attacks.

https://www.hurriyet.com.tr/teknoloji/turkiyeye-siber-saldiri-soku-turk-telekomdan-flas-aciklama-geldi-41360791

What are the damages that a DDoS Attack can cause in your business?

Business's Internet Access is Blocked: A DDoS attack can create heavy traffic on the network, preventing the business from accessing the internet. This can disrupt daily operations and block access to the business's website, making it difficult for customers to reach the website and may even result in losing customers.

Business's Digital Assets Are Damaged: DDoS attacks can also damage a business' digital assets. These attacks target servers or network hardware, causing the business's website to crash or data loss.

Business Reputation Damaged: A DDoS attack can also affect a business' reputation. These attacks prevent the business from communicating with its customers and can undermine customers' trust in the business.

Data Security Risk Increases: DDoS attacks can also put the data security of the business at risk. These attacks can cause the business website to crash, resulting in data loss or data theft.

Competitive Advantage Lost: After a DDoS attack, the business may become unable to meet the needs of its customers, creating a disadvantage against its competitors.

These damages are just a few of the possible consequences that a DDoS attack can have on a business. Therefore, it is recommended that businesses be vigilant against DDoS attacks and take preventive measures.

InfinitumIT Cyber Security Consultancy Service

Pentest service: Penetration Test, It is a security service that involves examining a business's network and systems from an attacker's perspective and identifying security vulnerabilities. This service is important for all kinds of institutions and organizations that care about their data. Penetration Testing aims to maximize the security of customers' data by helping to tighten systems.

CTH (Continuous Vulnerability Analysis Service) Service: It aims to continuously test the security of the systems and networks of the enterprises and to identify their vulnerabilities. This service measures whether systems and networks are up-to-date, vulnerabilities and risk levels, and provides businesses with the information and tools they need to respond in a timely manner.

Computer Forensics Service: Information Forensics service is a cyber security service that aims to use electronic data as evidence in legal cases. Infinitum IT provides exceptional computer forensic and information security services to law firms, corporations and government agencies using the most powerful techniques available.

Infinitum IT Consulting Service: As Infinitum IT, we offer our customers solutions to increase the performance, security and sustainability of their systems by using the right configurations and security measures through consultancy services such as Network & System Health Scan, Incident Response and Incident Response, SIEM & Log Management and Security Operations Center.

Technology Security: As Infinitum IT, we offer solutions to our customers to ensure the security of the technologies they host in their companies or institutions. Thanks to our IoT Security service, we ensure the security of your internet-connected computers, machines or in-house comfort equipment.