Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

What is a denial of service (DoS) attack?

In one sentence: A denial of service attack tries to overload a website, network or system so that real customers and staff cannot use it.

What it is

The NCSC describes a denial of service (DoS) attack as an attempt to overload a website or network, with the aim of degrading its performance or making it completely inaccessible. A successful attack means part or all of a system is not available, and it costs time and money to analyse, defend and recover.

A distributed denial of service (DDoS) attack comes from many sources at once. The NCSC says these are usually more effective because they generate more traffic, and harder to filter because attacker traffic is mixed in with legitimate traffic.

How it works

  1. The attacker picks a target resource. The NCSC says different attacks aim at different parts of a system, such as network bandwidth or a server’s processor.
  2. They generate more demand than the target can handle. That may be raw traffic from many machines, or a smaller number of requests that are expensive to answer.
  3. Amplification makes it cheaper. In a 2018 attack described by GitHub, attackers abused memcached servers left open to the internet, with spoofed addresses, so that responses were sent at the victim. GitHub reported an amplification factor of up to 51,000.
  4. Botnets supply the machines. CISA explained that the Mirai malware scanned the internet for devices, including routers, cameras and video recorders, and tried a short list of 62 common default usernames and passwords.
  5. A flaw can also be the trigger. Cisco reported an attack variant that made unpatched ASA and FTD devices reload unexpectedly.

Who it affects and how badly

Anyone whose business depends on something being reachable.

  • Sole trader to 10 staff: an online shop or booking page that is down at a busy time.
  • 10 to 50 staff: retail and hospitality sites, and SaaS start-ups whose customers cannot log in, with refunds and complaints to follow.
  • 50 to 250 staff: councils, schools and MSPs. The NCSC says Russian-aligned hacktivists have made frequent DDoS attempts against UK local government, motivated by ideology rather than money.
  • Regulated businesses: fintech, insurance and telecoms carry the extra cost of customers who cannot reach their service at all.

Real examples

  • GitHub, 28 February 2018. GitHub reported that the site was unavailable from 17:21 to 17:26 UTC and intermittently unavailable until 17:30 UTC. The attack peaked at 1.35 Tbps. Its monitoring spotted an odd ratio of incoming to outgoing traffic, and it moved traffic to a mitigation provider. It said the confidentiality and integrity of data were never at risk.
  • Mirai botnet, September 2016. CISA reports that the KrebsOnSecurity site was hit by an attack above 620 Gbps created by a botnet of Internet of Things devices.

How to detect it

  • Watch for a sudden jump in traffic, slow pages or time-outs, especially from many unrelated addresses.
  • Compare incoming against outgoing traffic. GitHub’s alert fired on that ratio.
  • Ask your internet provider what alerts and protections they offer on your account (NCSC).
  • Keep monitoring running so you can see an attack begin and judge your response while it is underway (NCSC).

How to fix or prevent it

  1. Follow the NCSC’s four practices: understand your service, understand your defences, create a response plan, and test your response.
  2. Know where you or a supplier are responsible for each weak point (NCSC).
  3. Use upstream help: your internet provider’s mitigations, a third-party DDoS mitigation service, and a content delivery network for web services (NCSC).
  4. Build so the service can scale quickly (NCSC).
  5. Plan to degrade gracefully, keep administrator access during an attack, and have a fall-back for essential services (NCSC).
  6. Change default passwords on routers, cameras and other devices, and install their security updates (CISA).

Related terms

Frequently asked questions

What is the difference between DoS and DDoS?
DoS comes from one source. DDoS comes from many sources at once, which the NCSC says is usually more effective and harder to filter.

Does a DoS attack steal data?
Not necessarily. The NCSC notes the impact on business can be significant even with no effect on confidentiality or integrity.

What should a small business do first?
Ask your internet provider and hosting provider what protection they offer, then write a short response plan, as the NCSC advises.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan.