Since having a website on the Internet has become the reality of almost all companies and many people, among the many issues related to security, one of those that can cause the most damage is DDoS attacks.
If you don’t know what it is, if your site may suffer one, or what to do to reduce the chances of this happening, in this content we will clarify these and other common doubts.
Shall we go to work?
What is DDoS attack?
A DDoS attack is a cyber threat that aims to make a service – or website, or application – incapable of working properly, using different tactics to overload it.
Think of your online store as a restaurant. It is located on a small street, with only one entrance door, a fixed number of tables and waiters, which determines the service capacity. On a normal day, this capacity is sufficient and customers are properly served, entering and leaving satisfied with it.
Now, imagine that, suddenly, thousands of people go to your address and try to get through the door at the same time and when they manage to get in, they are screaming and occupying all the waiters. Regular customers can’t get in, no one is served, anyway the service becomes chaotic.
A DDoS attack is exactly that, but with your website.
DDoS is the acronym for Distributed Denial of Service, which in Portuguese means a type of distributed denial of service attack, that is, it is a digital threat in which an immense volume of requests is made to the target of the attack, by several devices connected and distributed through the Web.
When the attack is successful, your site slows down or goes down completely. Real visitors can’t access, you lose sales, your reputation is damaged and, depending on the case, the loss can be huge.
What is the difference between DoS and DDoS attack?
The full understanding of what a DDoS attack is, involves knowing another type that has been quite common in the past, DoS attacks.
The acronyms are similar and the primary concept is the same, that is, a DoS (Denial of Service) attack also has the goal of denial of service. But in this type, a single source (a computer, a cell phone, a server) tries to take down a website. It’s as if a single person made many requests to your restaurant.
In practical terms, to be successful it is necessary that the attacker’s computational capacity is higher than the target’s response power or that, if added to legitimate requests, it exceeds its response limit.
Similarly, here is the difference:
- DoS – an annoying person calls your store non-stop, occupying the only attendant. However, if there is more than one service channel, more than one attendant, or the person is blocked, the attack becomes inefficient;
- DDoS – thousands of people – many of them without even knowing that they are participating – access all the service channels of your store at the same time, occupying all the attendants, who cannot pay attention to legitimate customers.
Why is it important to know this?
In the past, DoS attacks were more common, but today they are rare. Criminals prefer DDoS because it is much more powerful and difficult to contain, using many devices at the same time and scattered (distributed) by the worldwide computer network.
The use of this technique makes the containment of the attack much more difficult or at least more laborious and manages to leave the target inaccessible for longer.
And here comes the alert that few website owners know. As in a DDoS attack criminals need many devices, the most common is to “kidnap” thousands of computers (or hosting accounts, or servers, or cell phones, or routers, etc.) that exist on the Web.
Yes, if your “simple and harmless” institutional site is vulnerable, you can become one of these “soldiers” without you knowing.
In practice, it is reasonably unlikely that your site will be the main target of a major DDoS attack, but it can, yes, be used as a weapon to take down other sites, without you even suspecting
How does a DDoS attack work?
Many believe that behind an attack of this type there is always a skilled hacker (actually a cracker), sitting in a dark room full of screens and powerful computers. Reality is usually much simpler – and scarier – than it seems.
- Army recruitment – the criminal needs to “recruit” as many devices as possible connected to the Internet (computers, cell phones, routers, security cameras, servers) and perhaps, website hosting accounts like yours. These infected devices begin to receive orders silently, without the owners knowing. Each of them becomes a “zombie”, an involuntary soldier;
- Zombies become a network – the set of all these zombie devices forms what experts call a botnet (robot network). This computer network can have from hundreds to millions of devices. The bigger, the more powerful and efficient the attack;
- The attack is fired – at a specific time, the criminal sends a command to all the zombies at the same time. Depending on the command, uninterruptedly and simultaneously, thousands or millions of devices begin to bombard the target site with requests. The site, which was made to receive dozens or hundreds of visitors at a time, simply can’t stand it. It’s slow until it stops working.
A real and famous case
In 2016, a DDoS attack brought down several major sites such as Netflix, Twitter and Spotify and the most curious and scary thing is that most of the zombie army was not composed of computers or powerful servers, but of various Internet of Things (IoT) enabled devices, including cameras, residential gateways and baby monitors, which were infected with Mirai malware, which was designed for brute force attacks on IoT devices, allowing it to be controlled remotely.
This real case shows that any device connected to the Internet can be used if it is vulnerable, including your website’s hosting account!
How does the criminal act?
Another myth that needs to be overthrown is that the cracker does not need to invade the devices one by one.
The process is usually automated. Programs that scan the Web for specific vulnerabilities are usually used, such as devices with weak passwords (such as “admin” and “123456”) or with known security flaws that have not been fixed.
When he finds one, he silently installs a program that turns that device into a zombie.
In the case of hosting accounts, the invasion usually happens by:
- Weak password of the control panel or CMS used (cPanel, WordPress admin, FTP);
- Outdated plugins or themes;
- Files with wrong permissions that allow uploading malicious code;
- Code with failures that allow code or SQL injection;
- Presence of malware on the administrator’s computer, which allows access to the systems he accesses.
In summary, a DDoS attack is not as selective as you think. Any open door will be used by criminals and your site, no matter how small, can be hacked and become a zombie without you noticing.
The good news is that simple security measures prevent the vast majority of these invasions. That’s what we’ll talk about later.
Types of DDoS attack
Understanding the types of attack helps you know not only how your site can fall, but mainly how it can be used to take down others, without you noticing.
Regardless of the technical aspects of the attack, they all have something in common, the use of the TCP/IP protocol family to make the target unable to provide any service.
Here are some of the most common types:
- Resource consumption – when the criminal forces the server to consume 100% of the available resources, such as exhausting all RAM memory, or accumulating many processes (PHP, MySQL, Exim, etc.);
- Bandwidth consumption – which is caused by sending a higher data volume than what the network or server link can transmit (bandwidth) and thus the physical medium used by the data that enters or leaves the server, is congested;
- Flood of data – is a variation of the type above, which is not enough to congest the link, but is superior to the server’s ability to receive and process information;
There is also another tactic, which unlike the three types above that work by overload, generating a lot of traffic or many tasks on the server. In the next type explores a flaw:
- Exploitation of a vulnerability – also known as exploit, in this type a system failure – which can be some application that runs on the server or even the operating system – works as a vector for the attack, which usually aims to make the target unavailable, or gain control of the target, either to make it zombie or for other actions.
Among all the types listed, this is the one that most threatens small sites, remembering the invasions by vulnerabilities present in outdated CMSs. Here, your site is not only taken down, but hijacked to attack others
Why are DDoS attacks made?
There are many reasons for someone to want to leave a website or a server inaccessible, but the main motivations are:
- Protest – activist groups, such as Anonymous, use DDoS attacks to attract attention. A well-known example was the attack on Amazon, PayPal and Visa for harming the Wikileaks website;
- Competition – a company can hire an attack to bring down a competitor’s website. On the Deep Web, it is possible to order a DDoS attack for about $100;
- Financial (extortion) – the criminal knocks down the site and demands payment (usually in cryptocurrencies, such as Bitcoin) to stop the attack. More common against websites of large companies;
- Status and vanity – in the hacker environment recognition is achieved, among other means, for the impact resulting from their actions and thus making a famous site inaccessible, gives notoriety to the author of the attack;
- Security (controversial) – some attackers claim to be only exposing weaknesses of target systems, such as an “alert”. The motivation is questionable, but it exists;
- Zombie recruitment – this is the most relevant reason for many website owners. Here, the criminal has nothing against your site. He just wants any vulnerable site to increase his digital army. If his hosting account is unprotected, it can be hacked and used to attack third parties.
How to avoid a DDoS attack?
Now that you know how it works and why this type of attack happens, you probably want to know if you can avoid it, either not to serve as an instrument against third parties, or because a zombie account can also make your site slow, inaccessible, as well as all the others who share the same server.
The good news is that the vast majority of invasions that turn small sites into zombies can be avoided with simple and accessible measures. You don’t need to be a security expert.
Let’s go straight to what works.
1. Use strong and unique passwords
It seems basic, but it is the main reason for invasion of hosting accounts. Never use passwords like “admin123”, “password” or your company name. Prefer long passwords, with uppercase letters, lowercase letters, numbers and symbols. And never repeat the same password in different services.
Practical tip: use a password manager, which creates and keeps strong passwords for you.
2. Keep everything updated
CMS (WordPress, Joomla, etc.), plugins, themes and the PHP version must always be in the latest version. Most invasions exploits flaws that have already been fixed, but on sites that have not been updated.
If you use WordPress, we recommend reading the posts “The 5 best security plugins for WordPress“, “Is WordPress safe? How to improve your safety?” and “Two-factor authentication plugins (2FA) for WordPress“
3. Attention to file permissions
Files and folders on your website should never have “777” permission (fully open).
Always set up restricted permissions. Folders like “755” and files like “644”.
Many control panels (cPanel, DirectAdmin) allow you to adjust this with a few clicks.
4. Protect your computer (the administrator)
If your personal computer has malware, the criminal can capture your control panel or FTP password when you access the site.
Keep your own system clean, using antivirus, avoiding pirated programs and be wary of strange attachments. We recommend reading the post “Is the Internet safe? 15 tips to use the Internet safely”
5. Block unnecessary access
Configure your server’s firewall to allow access to the control panel and FTP only from your IP address (if it is fixed). Many invasions come from login attempts from suspicious countries or networks.
6. Use two-factor authentication in cPanel
Two-factor authentication, also known as TFA or 2FA (Two-way Factor Authentication), is an important security tool that allows you to configure a second verification option during user login, ensuring even more protection for the private environment.
7. Monitor the behavior of your website
Be aware of suspicious indicators. Did your website slow down for no apparent reason? Did files appear that you don’t recognize? Was there access outside of normal hours? Many hosting services offer access logs and, therefore, it is important to review them regularly.
8. Consider a web application firewall (WAF)
If your budget allows, a WAF is an extra layer that filters malicious traffic before it reaches your server. Many hostings already offer basic or paid versions.
What if your site is already being used as a zombie?
Some warning signs:
- You receive complaints that your site is attacking others (yes, it can happen);
- Your hosting provider suspends your account “for suspicious activity”;
- Your log files show abnormal outgoing traffic;
- The resource consumption (CPU, memory) of your plan is high without a real increase in visitors.
If you are suspicious, ask your hosting support for help immediately. They can scan your website and remove malicious code.
Conclusion
Keeping your website safe is not only a matter of individual protection, but of collective responsibility on the network. By adopting simple practices, such as strong passwords and constant updates, you prevent your business from suffering interruptions and prevent your hosting from being used as a weapon in attacks on third parties. Digital security is a continuous process; start yours today!