The Threat of Distributed Denial of Service (or DDoS) to Your Business

[smartads]
On August 6, 2009, millions of Twitter and Facebook users saw their accounts come to a sudden standstill. Most of them couldn’t log in or send messages. Facebook users couldn’t upload pictures or notes, and Twitter fanatics experienced delays in posting updates or couldn’t access their accounts at all.

Hackers took down the websites with an old-fashioned hacking tool called distributed denial of service (or DDoS). DDoS is a hacking method used to crash large and popular websites. The technique is very low-tech but unfortunately very harmful, too.

How It Works

A DDoS compromises multiple systems by attacking a single target and causing a flood of incoming messages and requests for data to the victim’s website. The deluge of requests and messages essentially forces the victim’s system to shut down, thus denying service to legitimate users.

It’s like calling in to a radio show to win concert tickets. The reason you always get a busy signal is that the telephone system can handle only a limited number of incoming calls at a time. If incoming calls were that frequent all the time, the telephone company would expand their allocation and provide much more capacity to fill demand. Victim websites, however, cannot instantly expand their capacity to accommodate the scale of such an attack.

The hacker begins by exploiting the weakness of a computer system and making it the DDoS “master system,” which could be anybody’s computer around the world. This “master system” communicates with other exploited computers, called “zombies,” as the hacker plans their attack of a single website.

The intruder then loads a “crack” tool that can be transferred online to a thousand computer “zombies” with just a single command. The controlled computers then send a deluge of requests and packets to their target website, causing it to freeze or malfunction for legitimate users. This attack victimizes not only the targeted website but also the website’s users and the owner of the master computer. The attack doesn’t last very long, and damage can be averted quickly once the deluge subsides.

DDoS is so alarming because thousands of computers around the world are used for it. A zombie computer often shows no sign of warning or infection and could show merely a hint of an attack. Hackers look for computers with low security levels and infect them in advance; when the time comes for the attack, they rouse their zombies from slumber.

What to Do

There is no quick fix, but there are ways to identify whether your computer has been turned into a zombie. Check for unusual behavior in your computer. Is it running noticeably slower? Do the lights flicker erratically on your modem? Has your Internet connection suddenly gotten slow?

Also, keep your computer’s security software up to date and free of trojans and malware. If your computer is taken over, contact your ISP immediately. You will need to identify what the hacker planted in your system to be able to reverse the damage.

You could also increase your system’s limits, which would improve its chances of surviving a flood of demand.

If you run a web service, you could increase the number of connections or even add more servers, which would act as a buffer to ensure the system does not reach its operational limit.

Identifying the Attacker

There is no surefire way to curb a random array of attacks coming from computers in different corners of the world. Owners of victimized websites can only trace the traffic back to its source, and that is a tedious and complicated effort, because ISPs claim they can hardly ever identify the master computer.

DDoS attacks have created a few messes on the Internet over the years. Software was developed in 1998 to help, but the method of attack really caught people’s attention in 2000, when high-profile websites such as Yahoo!, Amazon, eBay, and CNN were brought down in a single week by a Canadian teenager.

DDoS attacks are especially popular cyber-warfare tools, as seen two years ago when several Georgian websites were frozen in its dispute with Russia. And in the post-election conflict in Iran last year, DDoS attackers took down websites owned by President Mahmoud Ahmadinejad. DDoS may be old-school technology, but it continues to pose a threat to the Internet community, business and personal computers everywhere.