When I was in middle school, if you or a group of your friends forgot to study for an important test (or just more time was needed), you pulled the fire alarm just before the class, thus delaying the inevitable for one more day, in the hopes that one day would actually make a difference (which it usually did not). When I was in High School, the preferred method of reprieve was to claim to spot a funnel cloud. (My hometown and most schools were destroyed by a tornado a few years earlier). In college, calling in a bomb threat was such a common ruse that the University just decided to ignore them when they coincided with midterms or final exams.

Now, it’s been a long time since I was in school (and don’t ask how long), but evidently the equivalent to pulling the fire alarm today is to pay a "booter" to “DDoS” your school’s network so that they are bogged down and delay any testing until it’s resolved. DDoS stands for Distributed Denial of Service. The best way to think of it is like a flash mob, where a group of seemingly random, unconnected people gradual infiltrate a location and at a preset day/time suddenly do something in unison, usually sing or dance. The same thing happens with a DDoS: A group of seemingly random, unconnected computer clients gradually infiltrate a network location and a preset day/time suddenly dance all over your service. The key to a great DDoS is the same as the key to a great flashmob. The more clients/participants the better, and the more randomly distributed the clients/participants, the more likely the network/audience will be caught off guard.

If you are old enough to remember dialing a phone number to buy tickets from Ticketmaster for a popular concert, the concept is similar. When there are more network clients requesting a service than there are ports available, then almost everyone gets a busy signal. In the case of DDoS, the service can be anything that can clog the pipe, such as Layer 2 Multicast or flood all ports requests, Layer 3 acknowledge requests or IP lookups, or Domain Name System lookups, etc. Hackers have shown great ingenuity in finding new ways to clog Internet pipes. And as they have, network architects have updated protocols to prevent easily succumbing to blockages. That is why attacks are distributed. If a single client is slowing down traffic by making lots of needless requests on a port, then the network can revoke permissions to that client or simply shut down that port. I wish the same thing happened in the checkout line at my grocery store when there’s someone in front of me paying in pennies!

The key to successful DDoS is the same as in Star Wars: The Clone Wars; the greater the number of battle droids or clones at your disposal, the more difficult the defense. If you have to shut off all IP addresses and ports to stop the attack, then business is halted, the same impact as the DDoS itself. The cure is worse than the disease. While it’s true that hackers have banded together into armies of computers, the greatest multiplier comes from Trojans that lie dormant in most consumers’ computers until called into action.

DDoS attacks are very hard to defend against, especially if a network is caught napping. The best defense against DDoS is a good offense: Launch your own attack and look for weaknesses. A whole industry has popped up to support the network equivalent of self-flagellation. “Network stressors” are available that simulate DDoS, and a “booter” is someone you hire to DDoS your own network and make suggestions on improvements. Of course, the same stressors that allows you to DDoS yourself can be used to DDoS someone else. The aforementioned college exam delay tactic is probably the least harmful use of network stressors. On the other end of the spectrum are extortionists that threaten DDoS during the most important network time of a business unless protection money is paid. While it would seem obvious to not give in to this type of extortion, when a business is approaching Black Friday sales, and they plan to book more online sales in one day than the previous quarter combined, most of the time they will pay up and consider the cost as simply a business expense. Hence the rise of the flash mobster: “Pay up or I’ll have my flash mob dance all over your network at the worst possible moment.”