DoS vs. DDoS (einfach erklärt)

Haha, I'm going to DDoS you! These or similar-sounding sentences are often heard by scriptkitties who think, just because they've done a tutorial on Java plugins for Minecraft, that they're the most blatant hackers. They often don't even know that they're not DDoSing at all, but actually DOSing. In this video, I'll explain to you what you understand under a DDoS and a DDoS attack, how you can recognize them and how they differ from each other. We'll also discuss suitable countermeasures. But first, let's explain what you understand under a DDoS attack. The abbreviation DDoS comes from English and stands for Denial of Service. In this case, an attacker attacks a specific target, for example a web server. He tries to overload the system so much that it can no longer fulfill its tasks. That means a certain service on the system, for example the login mask for your email account, can only be restricted or, in the worst case, no longer respond. The underlying attack idea is quite simple. The attacker floods the target with a very high, but not justified number of service requests or simply creates so much traffic that the system can no longer react sufficiently quickly. Or in other words, more requests are received when the victim is attacked than can be processed. How does this become noticeable? Well, if you can no longer use your online banking, for example, because the site is loading too slowly or a server error occurs. You can recognize this by status codes that start with a 5, for example 503 Service Unavailable. If you see this code when you log into a website, then the underlying server is very likely to be busy with a very high number of requests and therefore overloaded. That a website is not reachable does not necessarily have to be due to a DDoS attack. For example, Facebook was able to do this on its own at the beginning of October 2021. The problem here, however, was with wrongly configured routers, due to which Facebook's DNS server was no longer reachable. But that's a completely different story. There are a whole range of techniques that can be used to carry out a DDoS attack. SYNFLUT In a SYNFLUT attack, an attacker tries to send a large number of TCP connection requests to the target, but after sending his SYN package, he no longer responds to the SYNEC package from the target system and thus a semi-open connection is created. If you want to know how a SYNFLUT attack works in detail, then feel free to watch my video on this topic. You can find the link in the video description below. PING OF DEATH With a PING OF DEATH, the underlying weak point is the IP fragmentation. Due to a fragmentation offset of more than 8 bytes, an attacker can possibly trigger a buffer overflow on the target. More about this in my video on the PING OF DEATH. SMURF ATTACK In this attack, an attacker sends fake ICMP echo requests to a network, where the source address is set on the potential victim and the answers from many other devices in the network are sent to the victim to overload his resources. HTTP GET POST In this attack, an attacker repeatedly sends HTTP GET or POST requests to a web server to overload its resources or impair availability. MAIL BOMBING In mail bombing, an attacker sends a lot of e-mails with, for example, large file attachments to block the recipient's mail input, in this case the victim's. The mail server becomes slower and may even break down. However, this attack is often performed as a distributed denial-of-service attack. And with that we are already at the next topic, namely the question of what is meant by a DDoS attack. The first D in DDoS stands for distributed, and therefore a DDoS attack is a distributed denial-of-service attack. These pose a serious threat to the Internet. The basic difference between a conventional DDoS attack and a DDoS attack, i.e. a distributed DDoS attack, lies in the multitude of different systems that are used in a large-scale coordinated attack. This type of attack requires the attacker to have access to a larger number of computers that then work together in a coordinated attack. So with a DDoS attack, a computer attacks a target system. With a DDoS attack, several computers attack a target system. A widespread tool for these attacks are so-called botnets. Botnets consist of a large number of Internet-capable devices that have been infected and are under the control of an attacker without the owners of the devices knowing about it. In the age of Internet of Things, virtually any device that is connected to the Internet, from computers to smartphones to harmless coffee machines, can become part of such a botnet. You can find more about this in my video on botnets. A botnet attack always represents a DDoS attack, but not every DDoS attack must be carried out by a botnet. For example, the overloading of a service can also happen unintentionally, e.g. if too many students want to access the online page of the university at the same time during an exam period in order to look at their grades. That's how it was for me back in college. It gets even more problematic if all students want to upload their code at the same time at the end of an online exam and this leads to a crash. Groups like Anonymous have already successfully carried out attacks with programs such as the Low Orbit Ion Cannon in the past, such as on the GEMA in 2012. However, the defense against DDoS attacks is particularly difficult. The problem is that the target computer must first receive and analyze the data, which can be too late, as the actual attack has already taken place. In addition, it is difficult to identify the hackers, as in most cases they disguise their identity by falsified IP addresses. For this reason, it is essential to take preventive measures to prevent DDoS programs such as Stacheldraht or TFN2K from being integrated into networks and causing damage. Now, of course, you can rightly ask yourself why DDoS attacks are carried out at all. Well, in my video on the different types of hackers, I have already characterized some types of hackers. It is not surprising that the attacks are carried out for the following reasons. Hacktivism. This means politically motivated hacks. An example of this would be defacement, i.e. the manipulation of websites to spread their own political messages. In the context of DDoS attacks, a hacktivist attack would be attacking servers on which the websites are hosted by a certain party, for example. Vandalism. Some hackers just want to see the world burn and attack their targets for the sake of destruction. Scriptkitties would also fall into this category, who then even celebrate their apparent hacker successes afterwards. Industry sabotage. An attempt is made to put a competitor at risk, or at least to slow him down. Oppression. A DDoS attack can be particularly threatening for small and medium-sized companies. In particular, the threat of a denial-of-service attack can lead to a reaction of fear and the oppressor may use ransom money for the servers they consider to be virtual hostages. But who can be affected by a DDoS attack? Well, in theory, everyone. For example, computers from private individuals in the context of online gaming, especially P2P games. Phones are also possible targets of attack. These can be blocked by simultaneous calls from many numbers. If, for example, the phone number of a large YouTuber is leaked, it may be that he is exposed to massive calls of hopeful fans, with family members, for example, who have a legitimate interest in a call, not being able to get through. Here you should definitely turn to the provider and ask for a positive listing, where you put numbers that can be passed through. All others should then be blocked. DDoS and DDoS attacks are also driven to clouds, routers and servers. If, for example, an online banking service or a shopping portal is hiding behind a server, you can cause a million damage by laying a lame, even if only for a few minutes. The critical thing about this type of attack is that it can be carried out so easily and without much technical know-how. At the same time, however, prevention is very, very difficult. By the way, you often don't even know why you are being attacked. DDoS or DDoS attacks can come out of nowhere and disappear there again. If you are in a company with political brilliance, you could reduce a coordinated attack to hacktivists, but that doesn't necessarily have to be the reason. It can also be script kiddies who just want to try out their newly acquired hacking skills. That's a stupid idea on so many levels. Just let it be, okay? Don't do DDoS attacks. If you now think it would be cool to expose the server of your school or university or your Minecraft account to a DDoS attack, then let it be said that this is a criminal act in Germany. Beforehand, I would like to emphasize that I am not a lawyer and that I do not provide legal advice here. You may be liable for computer sabotage according to paragraph 303b of the Criminal Code. Also paragraph 317 of the Criminal Code, i.e. the interference of telecommunications systems, can play a role here. So don't carry out denial-of-service attacks and don't take part in anonymous actions or the like that are aimed at a DDoS or DDoS attack. This makes you punishable with a simple push of a button. So again, don't carry out DDoS or DDoS attacks. But how can you protect yourself against DDoS or DDoS attacks? Well, you could provide more resources for processing requests or use an in-the-cloud DDoS protection provider such as Cloudflare. By the way, that's not advertising. If you are throttling, i.e. performing a conscious throttling or ignoring certain requests, legitimate users may also be locked out, which is why this procedure may not be recommended. Are you a bot-captures or small tasks that you have to solve can also contribute to slowing down the attackers. However, this can also get on users' nerves over time and should therefore be used in a dosed manner. If you notice that numerous requests are coming from a certain IP address, you can simply block them. With DDoS attacks, the measure may not be effective because the attack comes from many different directions. In addition, the attacker could simply spoof his IP address. As a private person, this sometimes helps to re-color your router, because then you get a new IP address from your internet service provider. This trick has certainly been tried by one or the other gamer among you in online games, when he was DDoSed by a P2P gaming partner. Have you ever been a victim of a DDoS or DDoS attack? Feel free to write it in the comments below. Vielen Dank fürs Zusehen und bis zum nächsten Video.