DDoS attacks and project Fénix

You have surely at some point been unable to reach a website, or heard that some websites were taken offline by a so-called DDoS attack. But what are DDoS attacks, who usually stands behind them, and why are they carried out?

The name itself reveals how such an attack manifests itself. It is an abbreviation of the English phrase "Denial of Service", i.e. denial of service. When a server is attacked in this way, the website stops responding, that is, it stops providing its services. The first "D" in the name stands for "Distributed", which means that the attack is carried out by a large number of users at the same time.

When a group of perpetrators decides to attack a server, they agree to visit the given website at the same moment. However, poorly secured computers belonging to unsuspecting users can also be used for DDoS attacks. Such computers are often infected in advance, usually with a so-called "backdoor". It is malware that an ordinary user can hardly recognise. If you suspect an infection, pay attention to symptoms such as reduced processor performance, worse internet access or problematic behaviour of applications. However, the only one hundred per cent reliable step is always to consult an IT professional. The basic requirement for security remains a secured computer and an up-to-date antivirus.

It is worth noting that, especially this year, DDoS attacks launched by large botnets made up of vulnerable IoT (Internet of Things) devices have become a trend. Connecting a camera with default settings to your home network is like going into the woods with bears smeared in honey.

Overwhelming the server with the attacker's requests

Servers are sized for the expected load. During DDoS attacks, communication fails and the server cannot process not only the attacker's requests but also those of customers. Depending on the configuration, some servers stop displaying pages with content not only for the duration of the attack, but some of their elements remain non-functional even after it has ended.

DDoS and DoS attacks are specific in particular because they are not a criminal offence or anything illegal. Attackers do not commit any crime by visiting a website. No data is stolen or misused in the process; the attackers simply "just" overload the server beyond its limits. DDoS attacks are often the work of various activists who want to express their disapproval of the operators of the websites or of their content. But they can also be, for example, a form of competitive rivalry. Abroad, there have even been cases where a DDoS attack was in fact a kind of guerrilla advertisement for an anti-DoS product. However, news servers or even banks also become targets of DDoS attacks. Sometimes a ransom is demanded to stop the attack, usually in the cryptocurrency bitcoin, to preserve anonymity.

How do you tell that your server has been the target of a DDoS attack? The first and main sign is a server crash, or a significant slowdown. The Windows and Linux operating systems have a tool called Netstat, which can help you find out whether you have fallen victim to an attack. Just open the command prompt and type "netstat-an". A DDoS attack can be recognised by the list of IP addresses connected to adjacent ports. Monitoring traffic is also important, because during a DDoS attack it rises abnormally.

Cloud services

How can you defend against DDoS attacks? In the IT world, unfortunately, very little is one hundred per cent. Prevention is very important. The most modern routers can automatically recognise abnormal behaviour, such as an unusually high number of requests, and block access from the given address. Some server owners try to prevent DDoS attacks by blocking access from certain countries in advance, for example China or Russia. Strengthening server performance is also a sensible step, that is, sizing it for two to three times the normal traffic. This measure pays off even for e-shops, which tend to be busy before Christmas, or for news servers. A partial solution may also be to use cloud services.

If an attack is already under way, you need the cooperation of your internet provider. The provider carries out the steps needed to redirect traffic and strengthen server capacity. If the attack is launched from abroad, foreign lines are disconnected. Of course, efforts are also made to identify the source and block it directly. It is also possible to take the more demanding elements of the website offline and inform visitors that it is unavailable.

In the Czech Republic, the Fénix project was created in 2013 as a response to massive DoS attacks on major Czech media outlets. It is run by the association NIX.CZ – a neutral hardware platform for interconnecting networks on the internet. As the name of the project suggests, its goal is to help the victims of DoS attacks rise from the ashes, that is, to keep internet services available to the entities taking part in this activity. Technically it is very complicated, but in simple terms, participating networks are interconnected under predefined conditions so that, in the event of a massive overload of the network, the source of the attack can be disconnected in a coordinated way and the functioning of the "inner internet" ensured, so that most of the traffic is maintained.

You could say it is a kind of elite club, but in the best sense of the word. Members must meet a range of administrative and technical requirements, and the whole project rests on mutual trust and enthusiasm for a common cause. By joining the Fénix project, operators not only take an important preventive step, but are also guaranteed that, in the event of an attack, they will not be left to deal with the whole problem alone.