The government's Computer Incident Response Team issued an unusual public alert on Saturday, 20 August 2022: distributed denial-of-service attacks had recently been observed against Bangladeshi targets, and every organisation running critical information infrastructure, banks, utilities, telecoms and government systems, should check its defences. The notice, signed by project director Tarique M Barkatullah, listed the attack types seen: TCP SYN, PUSH and RST floods, TCP window-size floods, UDP floods and IP fragment floods.
What a DDoS actually is
A denial-of-service attack does not steal anything. It jams the door. An attacker controls a "botnet", thousands of hacked computers, routers and cheap security cameras around the world, and orders them all to send traffic to one server at once. The floods CIRT named are different ways of doing that: a SYN flood opens millions of half-finished connections until the server has no memory for real ones; a UDP flood simply drowns the line; a fragment flood sends broken packets the server wastes effort reassembling. The site slows, then stops. When the attack ends, it comes back, but for a bank or a payment gateway, an hour offline is real money and real panic.
Why August 2022
CIRT did not name the attackers. The alert came during a month of tit-for-tat attacks between hacktivist groups in Bangladesh and India, in which self-declared "cyber armies" on both sides claimed to have taken down government and corporate sites across the border, and in the shadow of the Ukraine war, where DDoS became a daily weapon. Botnet capacity is cheap to rent; a teenager can hire an hour of floods for a few dollars.
What CIRT asked for
Follow the Digital Security Guideline for critical information infrastructure; install or update anti-DDoS hardware and software; and set proper protection thresholds, the traffic levels at which filtering kicks in. In practice that means having capacity upstream, at the internet gateway or a cloud scrubbing service, because by the time the flood reaches your own server it is too late.
If you run a small site
- Put it behind a content-delivery network with DDoS protection; Cloudflare's free tier absorbs most amateur floods.
- Keep the origin server's real IP address hidden; if attackers find it, the CDN cannot help.
- Rate-limit login and search pages, the cheapest targets for an attacker.
- Have your hosting provider's emergency contact written down somewhere that is not on the server.
DDoS is the least sophisticated attack there is, and still the most common. The defence is not clever either; it is preparation.
