Distributed denial of service (DDoS) attack

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does the 'distributed' part of a DDoS attack mean?

A The requests come from many different computers at once

B The requests come from one computer sending data very fast

2. Which group of computers is used to carry out a DDoS attack?

A A firewall of computers protecting the server

B A botnet of computers infected with malware

3. Who controls the bots in a botnet?

A The attacker, usually without the owners knowing

B The owners of the computers, who choose to join in

4. Why is a DDoS attack harder to block than a DoS attack from one computer?

A The traffic comes from many different addresses, so one address cannot just be blocked

B The traffic is encrypted, so the server cannot read the requests

5. What happens to the target server during a DDoS attack?

A It is sent a virus that deletes all the files stored on it

B It is flooded with requests and cannot respond to real users

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1botnet		AA DDoS does not steal data. It floods the server with requests so it cannot respond to real users, and the website goes offline.
2DDoS attack		BMany infected computers flood one server with requests at the same time so it cannot respond to real users
3Why a DDoS is harder to block than a DoS: the requests come from thousands of different IP addresses, not one		Csources = 50000 # many IP addresses
4An attacker's aim in a DDoS: take a website offline, or demand payment or cause damage		DA group of computers infected with malware that an attacker controls remotely and uses to send requests to a target
5A DDoS attack uses one computer to send requests to a server		Eaim = 'website offline / demand payment'
6A DDoS attack steals the files stored on the server		FA DDoS uses many computers (a botnet) at the same time, not one. One computer sending requests is a simple DoS attack.

Definitions

DDoS attack

Fill in the Blanks

Complete each line of code by filling in the missing parts.

A ______ is a group of infected computers

DDoS = Distributed ______ of Service

Blocking one IP stops a DoS but not a ____

Bots are computers infected with _______

Aim: take a site _______ or demand payment

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A botnet ← 5000

B capacity ← 1000

C requests ← botnet * 2

D IF requests < capacity THEN

E server ← "offline"

F ENDIF

Question 2

A attacker.infect(computers)

B botnet ← infected_computers

C server.send(requests, botnet)

D server.status ← "overloaded"

Question 3

A bots ← 10000

B total ← bots + 50

C OUTPUT total

Question 4

A sources ← 20000

B blocked ← 1

C remaining ← sources + blocked

D OUTPUT remaining

Question 5

A attack ← "DDoS"

B aim ← "steal stored data"

C OUTPUT aim

Answer Key

Distributed denial of service (DDoS) attack

Section A: Quick Questions

A — The requests come from many different computers at once

B — A botnet of computers infected with malware

A — The attacker, usually without the owners knowing

A — The traffic comes from many different addresses, so one address cannot just be blocked

B — It is flooded with requests and cannot respond to real users

Section B: Match the Pairs

botnet → A group of computers infected with malware that an attacker controls remotely and uses to send requests to a target

DDoS attack → Many infected computers flood one server with requests at the same time so it cannot respond to real users

Why a DDoS is harder to block than a DoS: the requests come from thousands of different IP addresses, not one → sources = 50000 # many IP addresses

An attacker's aim in a DDoS: take a website offline, or demand payment or cause damage → aim = 'website offline / demand payment'

A DDoS attack uses one computer to send requests to a server → A DDoS uses many computers (a botnet) at the same time, not one. One computer sending requests is a simple DoS attack.

A DDoS attack steals the files stored on the server → A DDoS does not steal data. It floods the server with requests so it cannot respond to real users, and the website goes offline.

Section C: Definitions

DDoS attack — A botnet of infected computers floods one server with requests at the same time, so it cannot respond to real users and the website goes offline.

Section D: Fill in the Blanks

A botnet is a group of infected computers

DDoS = Distributed Denial of Service

Blocking one IP stops a DoS but not a DDoS

Bots are computers infected with malware

Aim: take a site offline or demand payment

Section E: Spot the Error

D — The server only goes offline when the botnet's requests are greater than its capacity. The test should be IF requests > capacity THEN.

C — In a DDoS attack the botnet sends the requests to the target server, not the other way round. It should be botnet.send(requests, server).

B — Each bot sends many requests, so the total is the number of bots multiplied by the requests per bot. It should be total ← bots * 50.

C — Blocking one source removes it from the attack, so you subtract it. Many sources remain, which is why a DDoS is hard to block. It should be sources - blocked.

B — The aim of a DDoS attack is to take a website offline, or to demand payment or cause damage. It does not steal data. The aim should be something like "take site offline".