A DDoS attack, short for distributed denial-of-service attack, is one of the bluntest tools in a hacker's kit. It doesn't steal your data or crack your passwords. It simply floods a server, website, or network with so much fake traffic that the system buckles under the load and stops working for everyone else. The target isn't breached. It's buried.
Australian businesses, government agencies, and universities have all been hit. In 2022, Optus suffered a service disruption partly attributable to a volumetric attack. In 2023, the Australian Parliament's online systems were temporarily knocked offline. DDoS isn't an exotic threat. It's common, cheap to execute, and getting harder to stop.
How a DDoS attack is built
The "distributed" part is what makes DDoS so effective. A single computer sending millions of requests is easy to block: one IP address, one rule. But a DDoS attack uses thousands or millions of compromised machines, spread across dozens of countries, all firing at the same target simultaneously.
Those compromised machines are called a botnet. Attackers build botnets by silently infecting ordinary devices, home routers, office laptops, internet-connected cameras, smart TVs, with malware. The owners usually have no idea their device is involved. The attacker then issues a command and the entire botnet pivots to overwhelm a single target.
Botnets are also available for hire on criminal forums for as little as a few hundred dollars an hour. That price point means a disgruntled customer, a competitor, or a teenager with a grievance can launch an attack that takes down a mid-sized business. The barrier to entry is low. The damage is not.
The three main types
DDoS attacks target different layers of a network, which shapes how they're defended against.
- Volumetric attacks flood the network pipe itself with raw traffic, measured in gigabits per second. The goal is to saturate the target's bandwidth so nothing else can get through.
- Protocol attacks exploit weaknesses in network communication rules, such as sending half-open TCP connection requests (a SYN flood) until the server runs out of connection slots.
- Application-layer attacks target the web server or application directly, sending requests that look legitimate but require heavy processing, such as repeated complex database queries.
Application-layer attacks are the hardest to detect. The traffic volume may look normal. Only the pattern gives it away.
Why DDoS is different from other attacks
Understanding DDoS alongside other attack types helps clarify what it is and isn't. A SQL injection attack tries to extract or corrupt data inside a database. A DDoS attack doesn't care about your database at all. It's not trying to get in. It's trying to shut the door on everyone else.
Similarly, a man-in-the-middle attack intercepts communications between two parties, quietly reading or altering what passes between them. A DDoS attack is the opposite of subtle. It's a sledgehammer, not a scalpel. The goals are disruption, extortion, or distraction.
That last one matters. Security teams have documented cases where a DDoS attack was used as cover for a quieter intrusion happening in parallel. While defenders scramble to restore availability, a second attacker slips through a door left unmonitored during the chaos.
What motivates a DDoS attack
Motivation varies widely. Criminal groups use DDoS as a ransom tool: pay up or the attack continues. Hacktivist collectives target organisations for political reasons. Nation-state actors hit critical infrastructure to destabilise rivals. And competitors, in more brazen cases, use DDoS to knock rivals offline during peak trading periods.
Gaming and streaming services are frequent targets because downtime is immediately visible and publicly embarrassing. Financial services attract attackers for the ransom value. Healthcare systems have been targeted during periods of peak demand, which is where DDoS crosses from inconvenient to genuinely dangerous.
How organisations defend against DDoS
No single tool stops DDoS completely, but layered defences make attacks far less effective.
Traffic scrubbing services sit upstream of the target and filter out malicious requests before they reach the server. Providers like Cloudflare operate global networks specifically designed to absorb and analyse huge traffic volumes, routing clean requests through while discarding attack traffic. Content delivery networks (CDNs) also help by distributing load across many servers globally so no single point collapses.
Rate limiting restricts how many requests a single IP can make in a given window. Anycast diffusion spreads attack traffic across a wide network so no single node takes the full hit. And a firewall at the network perimeter provides a baseline layer of filtering, though a firewall alone won't stop a large volumetric attack.
Response planning matters as much as technology. Organisations that rehearse their incident response, designate clear roles, and maintain relationships with upstream providers before an attack hits recover faster than those who work it out under fire.
What individuals can do
Most individuals aren't the direct target of a DDoS attack, but they can be unwilling participants. A device infected with botnet malware contributes to attacks on others without the owner's knowledge.
Keeping device firmware updated, changing default router passwords, and avoiding suspicious downloads reduces the chance of a device being recruited. Home routers are a particular weak point. Manufacturers ship them with default credentials that many users never change, making them easy picks for botnet builders.
DDoS is a reminder that cybersecurity isn't just about protecting your own data. An unpatched device on a home network can become a weapon against a hospital, a bank, or a government service on the other side of the world. The internet is shared infrastructure. How each node is maintained affects everyone on it.