We understand that the world wide web is a big, scary thing for most people, so each month we’ll try to take a word, acronym or phrase and explain to you in simple, ‘non-techie’ terms what it all means. This is DBG’s Digital Definition of the Month!
Quite simply, a denial of service (DoS) attack is an attempt to get a website or other similar service to crash, thereby preventing legitimate users from accessing it. These types of attacks are of concern for businesses as they can result in loss of service, money, and reputation.
One way that this is done is through flooding a web server with false requests for information, overwhelming the system and ultimately crashing it. We’ll borrow the explanation from CNET:
In a typical connection, the user sends a message asking the server to authenticate it. The server returns the authentication approval to the user. The user acknowledges this approval and then is allowed onto the server.
In a denial of service attack, the user sends several authentication requests to the server, filling it up. All requests have false return addresses, so the server can’t find the user when it tries to send the authentication approval. The server waits, sometimes more than a minute, before closing the connection. When it does close the connection, the attacker sends a new batch of forged requests, and the process begins again–tying up the service indefinitely.
These types of attacks are of concern for businesses as they can result in loss of service, money, and reputation.
Denial of Service attacks happen for varied reasons. Some reasons may include:
- Extortion: Businesses may be targeted in an attempt for the hackers receive payment, similar to a ransom in a kidnapping situation.
- High Profile: Hackers may target a high-profile organisation, group or individual such as a political party.
- Grudge: A disgruntled customer, employee, or competitor wanting to sabotage a business.
- Bad Luck: A website may have a similar name to that of a well-known / high-profile target.
- No Reason: Unfortunately sometimes there is no particular reason!
Many larger organisations – such as banks or government applications – have safeguards in place to protect themselves from these attacks. These safeguards may include security technologies, extra server and connectivity power.