DDoS Attack

One hacker can't type on tens of thousands of keyboards. Instead, the hacker secretly plants malware on poorly protected devices, like everyday people's PCs and smartphones, and even Internet of Things (IoT) devices such as home routers and smart TVs.

Devices infected this way, which obey the hacker's remote commands, are called 'zombie PCs.' A huge network of them, linked like a spiderweb, is called a 'botnet.' The owners have no idea their device has been infected and is being used for a crime. They keep using the internet as usual.

When the hacker sends an attack command from a control server, hundreds of thousands of zombie devices scattered around the world start pouring traffic at one target server all at once. It's like one boss sending a crowd of fake customers rushing at a single restaurant door at the same moment.

These days, more poorly secured gadgets like smart light bulbs and home cameras are online, so botnets have grown far larger than they used to be. That makes them powerful enough to shake even a major portal site within just a few minutes.

Many people think of DDoS as a theft-style hack that quietly steals personal information or bank passwords. But the real goal isn't theft. It's much closer to causing an 'artificial traffic jam' that paralyzes the road.

Every web server has physical limits on bandwidth (the width of the road that data travels on) and on how much computing power it has to handle requests at the same time. When fake requests far beyond that limit pour in, the server gets overloaded and freezes completely.

Once the server system is paralyzed, even legitimate users are shut out completely. That's why online store checkouts stop working, or a big portal site won't load at all.

Even without stealing any information, hackers often use DDoS to shut down a company's normal business for hours and cause huge financial losses. They also use it as a threat to demand money, which is known as extortion.

A simple DoS (Denial-of-Service) attack comes from just one attacker, so it's relatively easy to stop. You find the attacking Internet Protocol (IP) address and block it. (Some attacks do fake the sender address, though.) A DDoS, on the other hand, is 'Distributed,' just as the name says. It hits from tens of thousands of different addresses around the world at the same time.

In particular, attacks that imitate website requests look almost identical to normal requests from regular users clicking a button. There are also 'amplification attacks,' which trick legitimate servers into firing huge responses back at the victim. So it's very tricky to pick out and block only the malicious traffic, because you can't easily tell which ones are real customers and which are attack signals.

To fend this off, big services use a 'content delivery network (CDN),' which spreads traffic across servers all over the world. Instead of one big road, it builds lots of detour routes and spreads the incoming load out widely.

They also deploy specialized cleaning facilities (scrubbing centers) and smart firewalls. These filter fake requests in real time, like a strainer, so only real users' traffic reaches the server.