Denial-of-Service Attacks in AWS

Customers can call the coffee shop to place their orders. After answering each call, a cashier takes the order and gives it to the barista.

However, suppose a prankster calls in multiple times to place orders but needs to pick their drinks. This causes the cashier to be unavailable to take other customers' calls. The coffee shop can attempt to stop the false requests by blocking the phone number that the prankster is using.

In this scenario, the prankster's actions resemble a denial-of-service attack.

Denial-of-service attacks:

A Denial-of-Service (DoS) attack is a malicious attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. DoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other networked resources such as IoT devices.

There are several types of DoS attacks, including but not limited to:

TCP SYN Flood Attack: This involves sending a succession of SYN requests to a target's system to consume enough server resources to make the system unresponsive to legitimate traffic.

Ping of Death: The attacker sends malicious pings to a computer, exploiting the maximum packet size of an IP packet (65,535 bytes) and causing the system to crash or become unstable.

Teardrop Attack: This involves sending fragmented packets to the targeted machine, which cannot reassemble these fragments due to a bug in the TCP/IP fragmentation reassembly process, causing a crash.

Botnets: Attackers use a network of 'zombie' computers to flood the target with traffic. Each computer sends a small amount of traffic, but the collective effect can be overwhelming.

HTTP Flood: This is a type of volumetric attack where an attacker exploits seemingly legitimate HTTP GET or POST requests to attack a web server or application.

DNS Flood: The attacker floods a particular domain's DNS servers to disrupt DNS resolution for that domain.

NTP Amplification: This is a reflection-based volumetric DDoS attack in which an attacker exploits a Network Time Protocol (NTP) server functionality to overwhelm a targeted network or server with an amplified amount of traffic.

Smurf Attack: The perpetrator sends Internet Control Message Protocol (ICMP) echo request packets to IP broadcast addresses, all having a spoofed source IP address of a victim, which then responds to each ICMP response, amplifying the traffic.

Distributed denial-of-service attacks:

A Distributed Denial-of-Service (DDoS) attack is a malicious attempt to disrupt the regular traffic of a targeted server, service, or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. DDoS attacks are an evolution of the basic Denial of Service (DoS) attacks but are more potent because they originate from multiple sources, making them harder to stop.

Critical aspects of DDoS attacks include:

1. Multiple Compromised Systems: In DDoS attacks, the traffic comes from numerous sources, potentially hundreds or even thousands. These can include compromised computers (forming a botnet), IoT devices, or other networked resources.
2. Magnitude and Scale: Due to the multiple sources, DDoS attacks can generate enormous traffic, far exceeding what a single source could produce in a simple DoS attack.
3. Methods and Vectors: Common methods include SYN floods, ICMP floods, UDP floods, HTTP GET/POST floods, and amplification attacks like NTP or DNS amplification. These methods aim to saturate the bandwidth of the victim's network or overwhelm the target's system resources.
4. Motivation: Motivations for DDoS attacks can vary, including extortion, political activism (hacktivism), vandalism, or as a smokescreen for other malicious activities.
5. Challenges in Mitigation: Mitigating DDoS attacks is challenging because it's difficult to differentiate between legitimate traffic and attack traffic. It often requires anti-DDoS technology, robust network architecture, and responsive planning.
6. Impact: The impact of DDoS attacks can be substantial, including downtime, loss of customer trust, financial loss, and damage to the reputation of the targeted organization.

AWS Shield:

AWS Shield is a service that protects applications against DDoS attacks. AWS Shield provides two levels of protection: Standard and Advanced.

Expand each of the following two categories to learn more about AWS Shield.

AWS Shield Standard:

AWS Shield Standard automatically protects all AWS customers at no cost. It protects your AWS resources from the most common, frequently occurring DDoS attacks.

As network traffic enters your applications, AWS Shield Standard uses various analysis techniques to detect and automatically mitigate malicious traffic in real time.

AWS Shield Advanced:

AWS Shield Advanced is a paid service that provides detailed attack diagnostics and the ability to detect and mitigate sophisticated DDoS attacks.

It also integrates with services such as Amazon CloudFront, Amazon Route 53, and Elastic Load Balancing. Additionally, you can incorporate AWS Shield with AWS WAF by writing custom rules to mitigate complex DDoS attacks.