Denial of service, DDoS and social engineering attacks

What is a denial-of-service attack?

A denial-of-service (DoS) attack tries to shut down a machine or network so its intended users (staff, customers, members) can't use it. It works either by flooding the target with more traffic than it can handle, or by sending specially crafted data that makes it crash. Either way, legitimate users lose the service they expect.

Flooding and crashing attacks

• SYN flood: the attacker starts huge numbers of TCP connections but never completes the handshake, until the server has no room left for real users.
• ICMP flood: overwhelms the target with ping traffic. The smurf variant sends pings to a network's broadcast address with the victim's address forged as the source, so every host replies to the victim and amplifies the attack.
• Ping of death: an old attack that sent oversized, malformed ICMP packets to crash systems.
• Crash attacks: exploit software bugs such as buffer overflows, where sending more data than a program expects makes it fail.

Distributed denial of service (DDoS)

In a DDoS attack, many systems attack one target at once, from many locations, which makes it much harder to block. It usually works like this:

1. The attacker infects many devices (PCs, routers, cameras) with malware. The infected devices are called zombies or bots, and together they form a botnet.
2. Zombies keep scanning for and infecting more devices.
3. The attacker instructs handler (command) systems, which order the whole botnet to attack the target at the same time.

Social engineering

Social engineering uses psychological manipulation to trick people into making security mistakes or handing over sensitive information. Common forms:

• Phishing: fake emails or messages that lead to fake login pages or malware.
• Pretexting: inventing a believable story, such as pretending to be IT support.
• Baiting: leaving infected USB drives or offering free downloads.
• Tailgating: following an authorised person through a secure door.
• Shoulder surfing: watching someone type a password or PIN.

Defences and countermeasures

Countermeasures can be grouped as administrative (policies, training), technical (firewalls, IPS, encryption) and physical (locks, cameras, badges).

Real-world example: a sale-day flood and a fake helpdesk call

A small online ticket seller opened sales for a popular festival. Within minutes its website became unreachable: a botnet was sending far more requests than the server could handle, and genuine buyers could not get through. Because the site already used a cloud DDoS protection service, the provider's network absorbed and filtered the junk traffic once rate limits and a challenge page were switched on, and sales resumed within half an hour.

The same week, a caller claiming to be from "IT support" phoned the seller's reception and asked for the shared mailbox password to "fix a sync problem". The receptionist followed the company rule of never giving passwords over the phone and called the real IT provider back on its known number. The provider confirmed it had not called, and the attempt was reported to all staff as a warning.