Let's take a look at botnets. Botnets is a very commonly used term that stands
for robotically controlled networks, or botnets for short.
The idea of botnets is that a botnet allowed a whole
series of remotely or robotically controlled devices to be
engineered to attack a victim.
For example, we could take a botnet at the top, we have the botnet herder.
The botnet herder, or the owner of the botnet, has several devices they
use for command and control, the second tier in our diagram. Then those
command and control devices control a number of infected machines. We're
showing you here servers or desktops,
but in many cases those infected machines could be a digital video recorder,
a smart TV, an IP camera,
anything that can be engineered and controlled by another
system to do what that other system wants.
So let's say, for example, a person goes to the owner of a botnet and says,
I would like to arrange a distributed
denial‑of‑service attack against this victim.
They can rent the botnet for a time period.
The owner of the botnet will tell all of the command and control machines to
tell the machines that they control to now flood that victim,
for example, with say, for example, a SYN flood type of attack.
And because that attack can come from literally hundreds of thousands up
to millions of machines. That overwhelms the pipeline going to the
victim, and the victim now is under a denial of service. But since it
comes from distributed locations, it can be kind of sometimes hard to
actually stop that attack as well.
Another type of attack was to send a request, and we see from the left‑hand
side machine here, to a DNS server, who is pluralsight.com.
When I send that request to a DNS server,
it comes back with all of the information I would need
to route traffic to pluralsight.com.
The result of that is that the amount of information that comes
back is far more than the size of the request.
The request was a simple one‑line sentence, but I get about, in many
cases, at least 15‑30 times the amount of traffic back when it replies
to that request, and that's good, we need that. We can also do this to
something like network time protocol.
What time is it?
And the Network Time Protocol will reply back with the exact time at that
time. But that also is much larger than the simple request.
So what happens if I then send a request to, say, a DNS or NTP
server, but I say my name is victim. And so that server now sends
the response to the request to the victim.
Now the poor victim is overwhelmed because I have not just sent a
simple request to the victim, but I send a flood of traffic that has
been, we call it amplified, or made a lot larger so it can conduct
that attack against the victim.