💥 Distributed DoS Attacks and Botnets 9.2.3

Distributed DoS (DDoS) Attack

An attack launched simultaneously by multiple hosts to consume network bandwidth or cause resource exhaustion on a target.

SYN Flood Attack

A DDoS attack that exploits the TCP three-way handshake by spoofing the client's IP and withholding the final ACK packet to fill the server's pending connection queue.

TCP Three-Way Handshake exploited in SYN Flood

SYN (Client) $\rightarrow$ SYN/ACK (Server) $\rightarrow$ ACK (Client). The ACK is withheld.

Distributed Reflection DoS (DRDoS) / Amplification Attack

The adversary spoofs the victim's IP and uses multiple servers (reflectors) to direct their responses (amplified traffic) to the victim server.

Common protocols abused for Amplification Attacks

DNS (Domain Name System) and NTP (Network Time Protocol).

Advantage of DNS Amplification

The small initial request is amplified because the large response includes a lot of information, overwhelming the victim's bandwidth.

Botnet

A group of compromised hosts (zombies) used to launch DDoS and DRDoS attacks under centralized control.

Handler / Herder

A compromised machine that a threat actor uses to compromise and manage hundreds or thousands of zombie hosts.

Command and Control (C2 or C&C) Network

The network established between the handlers and the bots used to trigger simultaneous attacks.

IoT Botnet

A botnet composed of compromised Internet-enabled devices such as SOHO routers, webcams, or smart TVs.