Cyber Security and Digital Currency: Question 3
Syllabus 5.3
A national exam board runs an online portal where students upload coursework before a submission deadline. On the morning of the deadline, the portal receives an extremely high volume of requests within a few minutes, sent from tens of thousands of different IP addresses at almost the same moment. The web server cannot process the requests quickly enough, and genuine students are unable to load the submission page for over an hour.
(a) Name the cyber security threat being described. [1]
(b) State two aims an attacker might have for carrying out this attack against the exam portal. [2]
(c) Explain how an attacker is able to generate such a large volume of requests from tens of thousands of different IP addresses, rather than from their own single device. [2]
(d) State two technical solutions the exam board could put in place to help prevent this type of attack from succeeding. [2]
Show worked solution Hide worked solution
Worked solution
Part (a): Naming the threat
A huge volume of requests arriving in a short time, from a very large number of different devices at once, aimed at making a server unable to respond to genuine users, is the defining pattern of a distributed denial of service (DDoS) attack.
Part (b): Aims of the attack
Possible aims include making the exam portal unavailable so genuine students cannot load the page, preventing or delaying submissions before the deadline (which could disadvantage or disqualify students), damaging the exam board’s reputation for reliability, or distracting IT staff while another, quieter attack is carried out elsewhere.
Part (c): How the volume of requests is generated
A single attacker’s own computer cannot realistically generate tens of thousands of simultaneous requests from different IP addresses. Instead, the attacker will already have infected a large number of devices belonging to other people, for example through malware hidden in downloads or attachments, without those owners noticing. Once infected, these devices can be instructed together, from one point of control, to send requests to the same target at the same time, so the flood of traffic genuinely comes from tens of thousands of separate devices, even though only one attacker set it in motion.
Part (d): Technical solutions
- A firewall can be configured to monitor incoming traffic and block requests that show patterns typical of an attack, such as an unusually high rate of requests from a single or suspicious source.
- A proxy server placed between the internet and the exam board’s web server can filter or share out incoming requests before they reach the server directly, reducing the load that hits it at once.
- A specialist traffic-filtering/anti-DDoS service can spread the surge of traffic across many servers or absorb it, so the exam board’s own server is not overwhelmed.
Final answers
- (a) Distributed denial of service (DDoS) attack
- (b) Any two of: make the portal unavailable; prevent/delay submissions; damage reputation; distract IT staff
- (c) Many previously infected devices are controlled together and instructed to send requests simultaneously, not one device acting alone
- (d) Any two of: firewall; proxy server; specialist anti-DDoS/traffic-filtering service