Search for a command to run...
Discover how modern cyber-attacks on networks are evolving & learn essential strategies to protect against them, with a focus on Distributed Denial of Service (DDoS) attacks
Driving SD-WAN Adoption in South Africa
No comments yet. Be the first to comment.
Enhancing Security and Compliance with ManageEngine ADAudit Plus
Why Pings Aren't Enough & NMS is Essential
What is SD-WAN (Software Defined Wide Area Networking)? | The Mechanics of this Groundbreaking New Network Technology
Embracing First Principles & the Scientific Method
Ever Wondered | "Is My Internet Really 99.9% Reliable?" 🤔
Cyber-attacks targeting networks are becoming increasingly sophisticated, and businesses must understand how these attacks function to defend their infrastructure effectively. This article focuses on several common cyber-attacks, particularly Distributed Denial of Service (DDoS) attacks that overwhelm a target with excessive traffic, causing disruption or outages.
DNS Amplification is the most common type and is covered in this article below:
This article focuses on the other types of attacks.
Attackers send fragmented UDP packets to the target network. Since these fragments are incomplete, the target system struggles to reassemble them, consuming resources.
Overwhelms routers and firewalls.
Can disrupt legitimate network traffic.
Configure firewalls to drop malformed or fragmented packets.
Use DDoS mitigation tools to identify and block abnormal UDP traffic.
Attackers exploit the TCP handshake process by sending a massive number of SYN (synchronise) requests to the target. The server allocates resources for each request but never receives an ACK (acknowledge) response, leaving the connections half-open and exhausting resources.
Use SYN cookies to authenticate connection requests.
Implement rate-limiting on SYN requests.
A large volume of DNS queries is sent to a target DNS server. Unlike amplification attacks, the goal is not to use reflection but to overwhelm the server with requests, exhausting its resources.
Use DNS rate limiting.
Deploy redundant DNS servers in different locations.
A high volume of UDP packets is sent to random ports on the target server. The server spends resources checking for applications listening on these ports and sending ICMP "Destination Unreachable" replies.
Block unnecessary UDP traffic.
Use DDoS mitigation services to identify and drop illegitimate UDP packets.
Attackers exploit the Network Time Protocol (NTP) to send small requests with a spoofed source IP address (the victim’s address). NTP servers respond with a large amount of data, amplifying the attack.
Disable unused NTP functions, such as the monlist command.
Ensure NTP servers are patched and configured securely.
The Mirai botnet, consisting of compromised IoT devices, floods the target with UDP packets. These packets often target gaming services, VoIP, and other UDP-dependent services.
Secure IoT devices with strong passwords and firmware updates.
Use network monitoring to detect unusual traffic spikes.
Attackers send a large volume of GRE (Generic Routing Encapsulation) packets to overwhelm the target. GRE is often used in VPNs and network tunnelling, making these attacks particularly disruptive to businesses relying on such infrastructure.
Filter GRE traffic at the network edge.
Use GRE-aware DDoS protection solutions.
The Mirai botnet sends large volumes of TCP traffic, including SYN, ACK, or random flag combinations, to overwhelm the target’s resources.
Deploy rate-limiting and connection tracking mechanisms.
Monitor for unusual traffic patterns.
Floods the target with TCP ACK packets, forcing the server to process these acknowledgments and consuming resources.
Implement deep packet inspection (DPI) to identify illegitimate ACK packets.
Use adaptive rate-limiting on TCP connections.
Attackers send a high volume of generic TCP packets without completing the handshake or maintaining a valid session. This overwhelms the server’s capacity to handle legitimate traffic.
Use TCP rate limiting and connection timeouts.
Deploy DDoS protection that identifies abnormal TCP behaviour.
Attackers exploit misconfigured Memcached servers, sending spoofed requests to generate amplified responses to the target.
Secure Memcached servers by restricting access to trusted IPs.
Disable UDP support if not needed.
Exploits the Simple Service Discovery Protocol (SSDP) used by Universal Plug and Play (UPnP) devices. Attackers send spoofed requests to open devices, which respond with amplified traffic to the target.
Disable UPnP on devices if not needed.
Use firewalls to restrict SSDP traffic.
Attackers send TCP packets with unusual flag combinations (e.g., SYN/FIN, NULL). The target server struggles to interpret these packets, consuming CPU and memory resources.
Configure firewalls to drop abnormal TCP flag combinations.
Use intrusion detection systems (IDS) to identify and mitigate such attacks.
Understanding the mechanisms of these attacks is crucial for building effective defences. While no single solution can prevent all attacks, a combination of strategies—including proper network configuration, security best practices, and specialised DDoS protection—can significantly reduce the risk and impact of such threats.
For businesses, partnering with a reliable DDoS mitigation provider and staying updated on emerging attack vectors is essential for maintaining robust network security.