There are many types of cyber attacks used by malicious actors to try and incapacitate a business for one reason or another. Ransomware, for example, involves the attacker taking, encrypting, and holding private company data for ransom, which results in the victimized company being unable to access their essential information until it is recovered. Another example that many of us are less aware of is a DDoS, or distributed denial of service, attack. This particular cyber attack involves the attacker using numerous Internet-connected devices to flood their targeted victim’s website with superfluous traffic. This grouping of devices, known as a botnet, ends up overwhelming the website’s servers, causing legitimate traffic to be blocked from accessing the site.
This type of attack is often used by hacktivists (hacker activists) to take down the websites of businesses which they disagree with. It is also used as a way to perpetrate the previously mentioned cyber attack, ransomware, where the malicious actors inform their victim that if they would like for the fake traffic to stop overloading their site, the company’s gotta pay up. Additionally, companies will sometimes have these attacks targeted at their competitors in order to drive business to the perpetrating company’s website while the victim’s site is down. This is among the major motivators behind the service known as DDoS-for-hire. As you may infer from the name, this is the term attributed to a company or individual hiring a hacker or hacking group to target a business with a DDoS attack.
Last month, the U.S. Department of Justice seized nearly 50 Internet domains responsible for perpetrating DDoS-for-Hire services. Six suspects have been charged in this seizure following the discovery that their sites allowed anyone to easily conduct their over DDoS service. As opposed to hiring the hackers to do it for them, users of these websites had the ability to conduct their own DDoS attacks with the help of the developers who created the platform, what is known as a “booter”. The sites taken down were not just tied to booter platforms but also those known as “stressers” - stresser platforms are essentially the same thing as the booter platforms only these claim to have legitimate uses for those companies who wish to test the strength of their own servers (sending the fake traffic there on purpose at a designated time to determine how well the company could stand up against a real attack).
Regardless of whether or not the attack is coming from a passionate hacktivist or a hired hacker, DDoS is something no business wants to find themselves on the receiving end of.
Image by DCStudio for Freepik.