DDoS attack (Distributed Denial of Service)

On October 21, 2016, the Mirai botnet, built from IP cameras and DVRs still running factory passwords, flooded Dyn's DNS servers and knocked Twitter, Netflix and GitHub offline for hours for part of the internet, mostly in North America. It is the textbook distributed denial of service: a service is drowned in traffic from a large number of compromised machines, and the sheer number of sources makes filtering far harder than with a single-source attack. Volumetric attacks fill the bandwidth, often through amplification, with a UDP protocol such as DNS, NTP or memcached answering a spoofed request with a much larger packet; that is how GitHub absorbed 1.35 Tbps on February 28, 2018. Application-layer attacks exhaust server processing with expensive HTTP requests. State-exhaustion attacks fill the session tables of firewalls and load balancers. On the insurance side, cyber business interruption generally responds once downtime runs past the policy's waiting period, and quantifying the outage and the lost revenue often takes both a technical expert and a forensic accountant. DDoS is also a pressure tool: in triple extortion, it is stacked on top of encryption and the leak threat to push the victim to pay. Booter services have made it commonplace: an attack can be ordered for a few dozen euros, and it sometimes serves as a diversion during an intrusion. The size of the loss turns on how long the service is down and on the traffic filtering the insured had in place.