DENIAL-OF-SERVICE (DOS) ATTACKS: HOW ATTACKERS OVERWHELM SYSTEMS AND FORCE OUTAGES

"Sometimes, the goal isn't to steal—it's to destroy." 

Availability is the quiet backbone of the internet. You can have strong passwords, encrypted databases, and perfect access controls—yet still lose customers, trust, and revenue if your website or service becomes unreachable. That’s why Denial-of-Service (DoS) attacks remain one of the most disruptive threats organisations face today. 

Imagine it's Black Friday. Your traffic spikes. But instead of the satisfying cha-ching of the payment gateway, your screen goes white. Then, the phone rings. It’s not a sale—it’s a customer complaining they can't load the page. You check your server logs and see a wall of red. You aren't just "popular." You are under attack. 

It wasn't a technical glitch. It was a Distributed Denial of Service (DDoS) attack—a digital siege designed not to steal data, but to make it impossible for legitimate users to access services. 

Denial-of-Service attacks are the blunt instruments of the cybercrime world. They don't require sophistication, just volume. And in an era where uptime equals revenue, a successful DDoS attack can cripple a business, extort millions, or silence political dissent. 

In this article, we’ll break down how DoS attacks work, why they succeed, the tools attackers use, and—most importantly—how organisations can defend against them. 

 

Denial-of-Service (Dos) Attacks: How Attackers Overwhelm Systems and Force Outages

What Is a DoS Attack?

 

Definition

A Denial-of-Service (DoS) attack is a deliberate cyber attack designed to make a system, network, server, or online service unavailable to its intended users. It is achieved by overwhelming the target with an excessive volume of requests, malformed packets, or exploitative traffic meant to exhaust its resources. 

Unlike most cyber attacks that focus on stealing data or gaining unauthorised access, a DoS attack has one primary objective: disruption.

 

The goal: Availability disruption, not data theft

In cybersecurity, we operate around three core principles known as the CIA Triad — Confidentiality, Integrity, and Availability. DoS attacks specifically target availability. The attacker doesn't necessarily want your passwords or credit card numbers. They want to ensure that no one can use your service — at least not for as long as the attack lasts. 

It could be motivated by financial extortion ("pay us or stay offline"), competitive sabotage, political activism (hacktivism), or simply chaos for chaos's sake.

 

DoS vs. DDoS vs. DRDoS: Know the difference

These terms are often used interchangeably, but they represent different scales and methods of attack. Understanding the distinction is crucial for network security engineers when crafting a defense. 

DoS (Denial of Service): The classic one-to-one attack. A single machine (the attacker) sends a massive amount of traffic to a single target. Because it's just one source, modern firewalls can usually block the offending IP address quickly. It is largely obsolete in large-scale attacks but still used for targeted, low-volume application-layer attacks. 

DDoS (Distributed Denial of Service): The modern monster. Instead of a single computer, the attack originates from multiple sources simultaneously — often from thousands or millions of compromised devices. Because traffic comes from thousands or millions of IP addresses worldwide, simple IP blocking or filtering is futile. 

DRDoS (Distributed Reflection Denial of Service): The stealth amplifier and a more sophisticated variant. Here, the attacker doesn't send traffic from their botnet to the victim. Instead, they send a request to a third-party's unsecured server (such as a misconfigured DNS or NTP server), and the return address is spoofed to make it seem the request came from the victim's IP. The third-party server then "reflects" a much larger reply to the victim. The attacker stays hidden, and the amplification effect can be massive.

 

 

Types of DoS/DDoS Attacks: The Three Pillars of Disruption

To effectively defend against these threats, you must categorise them. Most modern DDoS campaigns mix two or three of these types simultaneously to confuse defenses.

 

1. Volumetric Attacks (Flooding Bandwidth)

These are the most common types. The goal is to consume all available bandwidth between the target and the internet, making it inaccessible. Examples include: 

UDP Floods – Sending massive amounts of User Datagram Protocol packets to random ports on the target.

ICMP (Ping) Floods – Overwhelming the target with ping requests.

DNS Amplification – Exploiting open DNS resolvers to send amplified traffic to the victim. 

Volumetric attacks are often measured in Gbps (Gigabits per second) or Tbps (Terabits per second). In recent years, we've seen record-breaking volumetric attacks exceeding 2.5 Tbps. When this hits a company with a 10 Gbps pipe, the result is immediate, total network saturation. Legitimate packets can't squeeze through the congested highway.

 

2. Protocol Attacks (Exploiting Network Layer Weaknesses)

These attacks exploit weaknesses in network protocols (Layers 3 and 4 of the OSI model) to consume server resources or the network equipment, such as firewalls and load balancers. Examples include: 

SYN Floods – Exploiting the TCP three-way handshake by sending SYN requests but never completing the connection, leaving the server waiting with half-open connections until resources are exhausted.

Ping of Death – Sending malformed or oversized packets that crash the target system.

Smurf Attacks – Broadcasting ICMP requests with a spoofed victim IP to amplify responses.

 

3. Application-Layer Attacks (Targeting Specific Web Apps)

Also called Layer 7 attacks, these are the most sophisticated. They mimic legitimate user behaviour, making them incredibly difficult to detect. Instead of flooding bandwidth, they target specific application resources. Examples include: 

HTTP Floods – Sending seemingly legitimate HTTP GET or POST requests at scale to exhaust web server resources.

Slowloris – Opening many connections to a web server and sending partial HTTP requests, keeping those connections open indefinitely to prevent new users from connecting.

DNS Query Floods – Targeting DNS servers with a flood of lookup requests. 

It is particularly dangerous because the traffic volume is low, making it harder to detect with traffic filtering that only looks at bandwidth spikes.

 

 

How DoS Attacks Happen

Understanding the mechanics behind DoS attacks reveals why they are so effective.

 

Traffic flooding

The most straightforward method - send more traffic than the target can handle. The attacker pushes more packets than the network interface card (NIC) or switch port can handle. When the pipe is full, legitimate users can't get through.

 

Resource exhaustion

It targets the server hardware and OS. By forcing the machine to track millions of fake connections or spawn endless CPU cycles on encryption, the attacker drives CPU usage and memory consumption to 100%, causing the system to freeze or crash.

 

Application abuse

Attackers identify specific resource-heavy operations within web applications — such as database queries or search functions — and hammer them with repeated requests, grinding the application to a halt without necessarily generating huge traffic volumes.

 

 

Why DoS Attacks Succeed

Despite advancements in cybersecurity, DoS attacks continue to succeed. Here’s why: 

Limited Bandwidth: Most small and medium businesses don't have enough bandwidth to absorb massive traffic spikes. A $50 DDoS-for-hire service (booter/stresser) can easily generate more traffic than a small business can absorb. 

Weak Infrastructure: On-premise firewalls and routers have state tables just like servers. Ageing servers, unpatched systems, and outdated hardware are prime targets. They can be crashed by a protocol attack long before the traffic even reaches the web server. 

Poor Traffic Filtering: Basic firewalls cannot distinguish between a legitimate user trying to log in and a bot trying to log in 100 times a second. Without proper filtering in place, malicious traffic reaches the server unchecked. 

No Mitigation Strategy: Many organisations operate under the assumption, "It won't happen to us." They lack an incident response plan for DDoS scenarios, leading to panic and longer downtime while they scramble for solutions.

 

 

The Botnet Army: How Devices Become Attack Nodes

One of the most alarming enablers of modern DDoS attacks is the botnet. A botnet is a network of compromised devices controlled by an attacker (often called a botmaster or C2 — Command and Control operator). 

Any internet-connected device can be recruited into a botnet: home routers, security cameras, smart TVs, computers, smartphones, and especially IoT (Internet of Things) devices, which are notoriously insecure because they are rarely updated or patched. 

The attacker infects these devices with malware, often without the device owner's knowledge. Once infected, the device becomes a "zombie" — silently waiting for commands. When the attacker gives the signal, all these compromised devices simultaneously direct traffic toward the target. The owner of the smart camera has no idea their device is participating in a global cybercrime. 

The infamous Mirai botnet (discussed later) demonstrated how devastating IoT-based botnets can be, taking down major internet services across the US in 2016 using hundreds of thousands of compromised cameras and routers. 

 

Denial-of-Service (Dos) Attacks: How Attackers Overwhelm Systems and Force Outages

Basic Exploits Attackers Use 

Flooding requests

Attackers send repeated requests or packets to:

·         Consume bandwidth

·         Create queues and congestion

·         Overwhelm network devices

 

Consuming memory or CPU

Some requests force costly work:

·         Intensive computations

·         Large responses

·         Many simultaneous connections that must be tracked

 

Exploiting service limitations

Every system has finite limits:

·         Maximum concurrent connections

·         Rate limits (or lack of them)

·         Database query capacity

·         Cache miss penalties 

Attackers probe for the limit that breaks first.

 

 

Who Is at Risk?

No one is immune, but certain targets are especially vulnerable: 

E-commerce Sites: Direct financial impact. Every minute of downtime is a lost transaction. Competitors or disgruntled customers might even pay for a booter to knock you offline during a sale. 

Government Services: Targets for political hacktivism. Taking down a tax portal or voting information site creates public distrust and chaos. 

Media Platforms: Silencing journalism or disrupting streaming services (as seen with major gaming network outages). 

Gaming Servers: A rampant issue where players DDoS a server to win a competitive match or simply to grief the community. 

Small Business Websites: Typically have fewer defenses and limited recovery capabilities, making them easy prey for opportunistic attackers or extortionists.

 

 

Impact of a DoS Attack

The impact of a successful DoS attack extends far beyond temporary inconvenience: 

Website Downtime: Services become completely unreachable to legitimate users. 

Lost Revenue: For e-commerce and SaaS businesses, every minute of downtime translates directly into financial loss — sometimes tens of thousands of dollars per hour. 

Interrupted Services: If the attack saturates the corporate network, it can prevent employees from accessing cloud tools, email, or VOIP phones, grinding internal operations to a halt. 

Reputational Damage: Trust is fragile. Customers lose trust in a brand that can't guarantee availability, often switching to competitors. 

Operational Costs: Responding to the attack drains IT resources. Overtime for SOC Analysts, emergency consulting fees, and potential overage charges from cloud providers add up fast.

 

 

The Attacker's Toolkit

Modern attackers don't need advanced skills to launch devastating DoS attacks. Here's what they use:

 

Mirai Botnet

The most infamous malware of the decade. Mirai scans the internet for IoT devices with default credentials, infects them, and turns them into DDoS nodes. The source code for Mirai was leaked online, meaning hundreds of variants exist today, powering the largest volumetric attacks in history.

 

LOIC (Low Orbit Ion Cannon)

An open-source network stress testing tool repurposed by "hacktivists." It's a simple, GUI-based tool for flooding TCP/UDP packets. It is not anonymised, making it easy for law enforcement to trace users.

 

HOIC (High Orbit Ion Cannon)

An upgraded successor to LOIC with higher attack output. It can target multiple URLs at once and includes "booster" scripts to randomise HTTP headers, making it slightly harder to filter.

 

DDoS-for-Hire Services (Booters/Stressers)

Perhaps the most alarming development. Marketed falsely as "network stress testers" to test your own security, they operate on a subscription model. For as little as $19.99 a month, anyone can launch a crippling attack on a gaming rival or a small business website. No technical skills required.

 

 

Prevention and Mitigation Strategies

Defending against DoS and DDoS attacks requires a layered, proactive approach:

 

DDoS mitigation services

Platforms like Cloudflare, AWS Shield, and Akamai Kona Site Defender specialise in detecting and absorbing DDoS traffic before it reaches your infrastructure. These services operate at a massive scale, capable of handling hundreds of terabits of attack traffic.

 

Traffic filtering

Implement IP reputation filtering, geo-blocking, and deep packet inspection to identify and drop malicious traffic early in the pipeline.

 

Rate limiting

Configure your servers and APIs to limit the number of requests a single IP address can make within a given time frame — effectively choking off floods from individual sources.

 

CDN and load balancing

A Content Delivery Network (CDN) distributes traffic across multiple geographic nodes, preventing any single server from being overwhelmed. Load balancers intelligently distribute incoming requests across server clusters.

 

Auto-scaling infrastructure

Cloud-based auto-scaling allows your infrastructure to dynamically expand capacity during traffic spikes — buying time to identify and filter attack traffic without going offline.

 

Anycast network distribution

Anycast routing spreads incoming traffic across multiple distributed data centres. Instead of overwhelming a single server, attack traffic is diluted across the entire network, significantly reducing its impact.

 

Robust incident response plan

Have a documented DDoS response playbook ready before an attack occurs. Know who to call, which services to activate, and how to communicate with customers during an outage. Preparedness dramatically reduces recovery time.

 

 

Who Defends Against This?

Defending against DoS attacks is a team effort. The professionals on the front lines include: 

Network Security Engineers: Design the network topology with redundancy. Implement traffic filtering rules, configure firewalls, and manage network-level defenses. They tune BGP routing and Anycast configurations. 

SOC Analysts (Security Operations Centre): These are the frontline soldiers. Monitor traffic patterns in real time, identify anomalies (e.g., a sudden spike in UDP traffic on port 53), and trigger incident response when an attack is detected. 

Infrastructure Architects: Design resilient, scalable systems with built-in redundancy  — ensuring the server environment is elastic and can scale horizontally under pressure, separating the database layer from the web layer to reduce the attack surface.

 

 

Final Takeaway

In the classic CIA Triad of cybersecurity—Confidentiality, Integrity, and Availability—availability is often the forgotten sibling. Everyone panics about data theft, but an unreachable business is just as dead as a breached one. 

DoS and DDoS attacks are a permanent fixture of the internet landscape. If anything, they are growing more frequent, more sophisticated, and more accessible to bad actors of all skill levels. The rise of IoT botnets, DDoS-for-hire platforms, and multi-vector attacks means that every organisation — regardless of size — must treat availability as a strategic priority. 

The good news? With the right combination of technology, planning, and skilled professionals, DoS attacks can be detected early, absorbed effectively, and recovered from quickly. The organisations that survive and thrive are those that prepare before the flood comes, not after. 

At Raphaam Digital, we're committed to keeping you informed about the evolving cybersecurity landscape. Because in today's digital world, staying online isn't just a convenience — it's a competitive advantage and a security imperative. 

Stay vigilant. Stay available. Stay tuned for more cybersecurity updates from Raphaam Digital.