Cyber Security
Internet and Its Uses
A distributed denial of service (DDoS) attack floods a server with so many requests that it cannot respond to legitimate users, making the service slow or completely unavailable.
The attack is distributed because the flood of requests comes from many computers at once, often a network of machines that have been infected with malware (a botnet) and are controlled remotely without their owners' knowledge. The server is overwhelmed by the sheer volume of traffic and either slows to a crawl or stops responding entirely. A DDoS attack does not usually steal data; its aim is to disrupt access to a service.
Common exam question
Describing or drawing the stages of a DDoS attack
Question: Draw and annotate a diagram of a DDoS attack, or complete statements about one from a word list, and sometimes state the attacker's aims (2–6 marks).
Asked in 2 of the 17 papers. Both versions follow the same chain: malware is downloaded onto many computers, turning each into a bot (or zombie); together they form a botnet; a third party starts the attack; the bots all flood a web server with requests at once; it fails under the load; and genuine requests can no longer get through. A drawing earns a mark for each stage it shows, up to six, so label every arrow.
The word-list version marks one term per gap, in order. Keep bot (one infected computer) apart from botnet (the network), and the web server (the hardware) apart from the website stored on it. Credited aims (2 marks) include revenge, harming a company's reputation, entertainment, a ransom to stop the attack, and testing a system's resilience.