Dissecting DDOS Attacks

The talk opens by framing denial-of-service as an attempt to exhaust bandwidth, connections or application resources. It separates single-source attacks, distributed floods and amplification, and explains why small attacks can still take a server offline while large ones drive up cloud costs. The speaker, who works on incident response and web application firewall deployments, then covers who launches these attacks: nation-state actors, ransomware crews probing for weak VPNs, and disgruntled staff or competitors renting botnet time from dark-web services.

Using several anonymized case studies, the talk walks through attack timelines and the telemetry behind them. Rate-limiting rules and managed challenges stopped one flood within minutes, while a repeat attack exposed gaps in default configuration. A ransom-driven campaign of millions of requests was mostly blocked by provider rules, yet the attackers kept changing tactics. In a smokescreen case, a large flood masked credential stuffing against login and password-reset APIs, and that activity only surfaced once the default page traffic was filtered out. Analysis relied on country, network block, user agent and JA3/JA4 TLS fingerprints to separate hostile traffic from legitimate traffic.

The closing advice is practical: deploy a WAF with logging, prevent origin bypass, tune rate and geo rules, reduce exposed services, and move VPN load off the firewall. The speaker also urged teams to run tabletop exercises, write continuity plans, and put cost estimates in front of executives and boards so that risk decisions are made deliberately rather than left to insurance.