Denial of Service (DoS) Attack – Akhil Bhartiya Cyber Suraksha Sangathan (Regd.)

⚠️ DENIAL OF SERVICE (DoS) ATTACK — OVERVIEW

A Denial of Service (DoS) attack is a malicious attempt to disrupt the normal functioning of a targeted server, network, website or online service by overwhelming it with a flood of illegitimate traffic or requests — making it unavailable to genuine users. Unlike data theft, the goal of a DoS attack is not to steal information but to shut down access, cause financial losses, disrupt business operations or damage reputation. Government websites, banking portals, hospitals, e-commerce platforms and critical infrastructure are frequent targets. DoS attacks are a serious cyber crime in India, punishable under the Information Technology Act 2000 and Bharatiya Nyaya Sanhita 2023 with severe imprisonment and fines.

⚙️ HOW A DENIAL OF SERVICE ATTACK WORKS

😈

Attacker Identifies Target

→

💣

Sends Massive Fake Requests

→

🖥️

Server Gets Overloaded

→

🚫

Service Becomes Unavailable

→

😱

Legitimate Users Cannot Access

In a DoS attack, the attacker uses a single system to bombard the target server or network with an enormous volume of requests — far exceeding its capacity to handle. This exhausts the server's resources (bandwidth, memory, CPU) causing it to slow down drastically or crash completely. Real users are denied access to the service during the attack. A Distributed Denial of Service (DDoS) attack is more powerful — the attacker controls thousands of infected computers (a botnet) simultaneously to launch the attack from multiple locations, making it nearly impossible to block.

⚠️ How DoS Attacks Are Carried Out

Flooding a server with millions of fake connection requests per second
Sending oversized data packets to crash network infrastructure
Exploiting software vulnerabilities to crash the target system
Using botnets (thousands of infected computers) for DDoS attacks
DNS amplification — sending small queries that generate massive responses
SYN Flood — sending fake TCP handshake requests to exhaust server ports
HTTP Flood — overwhelming web servers with GET or POST requests
Slowloris — holding many connections open simultaneously to exhaust server resources

✅ How to Protect Against DoS Attacks

Use a Web Application Firewall (WAF) to filter malicious traffic
Implement rate limiting — restrict number of requests per IP address
Use DDoS protection services (Cloudflare, AWS Shield, Akamai)
Enable traffic anomaly detection and real-time monitoring systems
Use Content Delivery Networks (CDN) to distribute traffic load globally
Keep all server software, OS and network firmware updated and patched
Configure routers and firewalls to reject malformed or suspicious packets
Have a cyber incident response plan — know who to call and what to do

🔍 Types of Denial of Service Attacks

🌊

Volume-Based Attack (Flood Attack)

The attacker sends an enormous volume of traffic — UDP floods, ICMP floods or other spoofed packet floods — to saturate the target's internet bandwidth. The sheer volume of traffic makes the server unreachable for legitimate users. Measured in bits per second (bps).

🤝

SYN Flood Attack

The attacker sends a rapid succession of TCP SYN (synchronise) requests to a target's server — but never completes the three-way handshake. This leaves the server with many half-open connections, consuming all available ports until no new legitimate connections can be established.

🐌

Slowloris Attack

The attacker opens many connections to the target web server simultaneously and keeps them open as long as possible by sending partial HTTP requests. This exhausts the server's connection pool, preventing real users from connecting — without generating massive traffic volumes.

🌐

HTTP Flood Attack

The attacker sends a large number of seemingly legitimate HTTP GET or POST requests to a web server simultaneously. Because the requests appear valid, they are harder to filter. The server's processing resources are exhausted trying to respond to all requests, causing slowdown or crash.

📡

DNS Amplification Attack

The attacker sends small DNS query requests to open DNS resolvers — with the source IP spoofed to the victim's address. The DNS servers respond with much larger responses directed at the victim, amplifying the attack traffic several times and overwhelming the target's bandwidth.

💥

Ping of Death / Packet Fragmentation Attack

The attacker sends malformed or oversized network packets (larger than the maximum allowed size) to the target system. When the system tries to reassemble these oversized packets, it crashes or becomes unstable — causing denial of service to all users.

🤖

Distributed Denial of Service (DDoS)

The most powerful form — the attacker controls thousands of compromised devices (a botnet) spread worldwide and directs them all to simultaneously attack the target. The distributed nature makes it extremely difficult to block since traffic comes from thousands of different IP addresses.

🔋

Application Layer Attack (Layer 7)

These attacks target specific application functions — such as login pages, search forms or database queries — with requests designed to consume maximum server resources per request. They are low in volume but highly effective, as each request triggers complex backend operations.

📊 DoS vs DDoS — KEY DIFFERENCES

Feature	DoS Denial of Service	DDoS Distributed DoS
Source of Attack	Single computer / single IP address	Thousands of computers / multiple IPs (botnet)
Attack Volume	Limited by attacker's own bandwidth	Extremely high — amplified by botnet size
Difficulty to Block	Easier — block one IP address	Very difficult — traffic from thousands of sources
Target Scale	Small to medium websites and servers	Large enterprises, banks, government portals
Detection	Relatively easier to detect and trace	Hard to detect — resembles normal high traffic
Recovery Time	Shorter — once source is blocked, service resumes	Longer — attack can continue from new IPs
Common Targets	Small businesses, individual servers	Banks, hospitals, e-commerce, government portals

💥 IMPACT OF A DoS / DDoS ATTACK

💸

Financial Loss

Every hour of downtime can cost lakhs to crores in lost revenue, especially for e-commerce, banking and trading platforms.

📉

Reputation Damage

Customers lose trust in organisations that suffer repeated outages, leading to permanent loss of business and brand value.

🏥

Critical Service Disruption

Attacks on hospital systems, emergency services or government portals can endanger lives and disrupt essential public services.

📊

Data Exposure Risk

DoS attacks are often used as a distraction while attackers simultaneously attempt data theft or system infiltration on the compromised network.

⚖️

Legal Liability

Organisations that fail to protect customer data or services during an attack may face regulatory penalties and civil lawsuits from affected users.

🔌

Infrastructure Damage

Prolonged high-volume attacks can permanently damage servers, routers and network hardware — requiring costly replacement and restoration.

🚨 If Your System or Website is Under DoS Attack — What To Do

Immediately contact your Internet Service Provider (ISP) — request upstream traffic filtering
Enable your DDoS protection service or activate emergency firewall rules immediately
Block the attacking IP address or IP range at the router or firewall level
Activate your incident response plan — inform IT team, management and stakeholders
Contact your web hosting provider or CDN service for emergency mitigation support
Document all attack logs — timestamps, traffic volumes, source IPs — as evidence
Report the attack to CERT-In (Indian Computer Emergency Response Team) at incident@cert-in.org.in or +91-11-24368572
File a complaint at cybercrime.gov.in with all technical evidence collected
File FIR at the nearest Cyber Crime Cell — bring server logs, traffic analysis reports and ISP records
After the attack, conduct a full security audit to identify and patch the vulnerabilities exploited

📰 MAJOR DoS / DDoS ATTACK INCIDENTS — INDIA

2022 — Indian Government Portals

Pro-Pakistan Hackers DDoS Attack on Indian Websites

Following geopolitical tensions, a group called "Team Pakistan" launched coordinated DDoS attacks on multiple Indian government websites including the Indian Army portal, Ministry of External Affairs and several state government sites. The attacks caused temporary outages lasting several hours, with traffic volumes in the range of hundreds of gigabits per second.

2020 — Indian Banks DDoS Attacks

Multiple Banking Portals Targeted During Lockdown

During the COVID-19 lockdown period when digital banking usage was at an all-time high, several Indian private and public sector bank websites were targeted by DDoS attacks, causing disruption to net banking services. The timing was deliberate — attackers exploited the increased dependency on online banking to maximise impact and panic.

2021 — Indian Power Grid Attack

Mumbai Power Outage Linked to Cyber Attack

A massive power outage in Mumbai in October 2020 was linked to a coordinated cyber attack on India's power distribution infrastructure. Investigators found evidence of malware and potential DDoS-style disruption in the control systems of the power grid operator, raising serious concerns about attacks on critical national infrastructure.

2024 — BSNL Infrastructure Attack

Telecom Infrastructure Targeted by DDoS

BSNL's network infrastructure faced repeated DDoS-style disruptions affecting internet connectivity for lakhs of users across multiple states. Cybersecurity agencies traced the attacks to foreign-origin botnets and issued emergency advisories to Indian ISPs and telecom operators to strengthen their DDoS mitigation systems and traffic filtering capabilities.

⚖️ APPLICABLE LAWS

IT Act Sec 43 IT Act Sec 66 IT Act Sec 66F IT Act Sec 70 BNS Sec 111 BNS Sec 351 NCIIPC Guidelines

IT Act Section 43: Whoever without permission denies or causes the denial of access to any computer resource to any authorised person shall be liable to pay damages by way of compensation — up to ₹1 crore. This is the primary civil remedy for DoS attack victims including businesses and individuals whose access to services is disrupted.

IT Act Section 66: If the denial of service is done dishonestly or fraudulently, it is a criminal offence punishable with imprisonment up to 3 years or fine up to ₹5 lakh or both. Covers intentional DoS attacks on servers, networks and websites.

IT Act Section 66F — Cyber Terrorism: If a DoS or DDoS attack is carried out with intent to threaten the unity, integrity, security or sovereignty of India — or to strike terror by denying access to critical infrastructure — the offender shall be punished with imprisonment which may extend to life imprisonment. This is the most serious provision applicable to large-scale infrastructure attacks.

IT Act Section 70 — Protected Systems: If the DoS attack targets a computer resource notified as a "protected system" (government servers, defence networks, power grids, banking systems) the offender faces imprisonment up to 10 years and fine. Unauthorised access or disruption of protected systems is an aggravated offence.

BNS Section 111 — Organised Cyber Crime: Coordinated DDoS attacks carried out by groups or criminal syndicates using botnets fall under organised crime provisions — punishable with 5 years to life imprisonment and heavy fines depending on the scale and damage caused.

NCIIPC Guidelines: The National Critical Information Infrastructure Protection Centre (NCIIPC) issues mandatory security guidelines for operators of Critical Information Infrastructure (CII) — including energy, banking, telecom, transport and government IT. Failure to implement adequate DoS protection for CII can result in regulatory action.

📝 Report This Crime

📝 Report DoS Attack to ABCSS

Akhil Bhartiya Cyber Suraksha Sangathan (Regd.)

Regd. with Registrar of Society of NCT Delhi-Regd. No-287

Cyber Criminals se Suraksha, Digital India ki Raksha

अखिल भारतीय साइबर सुरक्षा संगठन (पंजी)

भारत की पहली साइबर क्राइम इन्वेस्टीगेशन एन जी ओ

ऑनलाइन रहें सतर्क, साइबर अपराध से रहें सुरक्षित

Cyber Links

Important Links