What is
a DDoS attack?
Can't play sound? The illustrated version is right below.
Read the transcript
The full narration of the video.
You open a website. It just spins and spins, and never loads. Is it broken? Let's picture the website as a little noodle shop, and rule out the guesses one by one. Guess one: the shop is broken. But the kitchen lights are on, and noodles are ready to go. Not that.
Guess two: too many customers, like a ticket rush. But this time, not one person in line orders anything. They walk up, ask "what noodles do you have?", then get right back in line. Again, and again. The waiter is busy answering them. People who actually want noodles can't get in. A website gets jammed the same way. Every time you open a page, you're asking the counter a question. Too many questions, and it can't answer them all.
So why not just throw the troublemakers out? If it's one person, easy: spot them, ban them. The trouble is, there are millions of these fake customers. They come from everywhere, and look exactly like real ones. But who could summon millions of helpers at once? Hold that thought. This mischief is called distributed denial of service, or DDoS. Distributed means they come from all over. Denial of service means real customers get shut out.
It happens every day. One company that blocks these attacks for websites stopped over forty-seven million of them in 2025. That's more than one a second. In the first half of this year, the most targeted country was China. The biggest one lasted just thirty-five seconds. The data pouring in, every single second, was about a thousand HD movies. So how does a site hold up? Build a huge plaza in front of the door. Everyone enters the plaza first; real customers go in, the ones going in circles get walked out. It works well, but it's not magic. A big enough wave can fill the plaza too.
Now back to that question: where do millions of helpers come from? The answer: many aren't people at all. They're TV boxes, cameras and routers in ordinary homes, secretly loaded with a remote-control program. The record attack is thought to have used one to four million devices, mostly Android TV boxes. Some came with the program already inside. Their owners kept watching TV and never knew. So here's one small thing to try tonight: check whether your home camera and router still use their factory passwords. If they do, change them. And skip no-name boxes that promise every movie for free.
When you're done, come back and tell us: how many connected devices does your home have?
The page that keeps spinning
Is it broken?
Or just too busy?
Picture the website as a little noodle shop. Every time you open a page, you walk up to the counter and ask, "What noodles do you have?" Let's rule out the guesses one by one.
How a page normally reaches your phone: How a webpage is made
Nobody in line
orders anything
The shop isn't broken: the kitchen lights are on and noodles are ready. It's not a ticket-rush crowd of too many real customers either.
These people ask "What noodles do you have?" and get right back in line, again and again. The waiter is busy answering them, and people who actually want noodles can't get in.
Can't kick them out:
millions, all alike
One troublemaker is easy: spot them, ban them. But these fake customers number in the millions, come from everywhere, and look exactly like real ones. You can't tell whom to throw out.
That's called
"distributed denial of service": DDoS.
from everywhere
get shut out
It happens every day
blocked in 2025
attack lasted
of data per second
That company blocks these attacks for websites. By its count, the most targeted country in the first half of this year was China.
Build a big plaza
out front
Everyone enters the plaza first. Real customers go into the shop; the ones going in circles get walked out. That's what attack-blocking companies do.
It works well, but it's not magic: a big enough wave can fill the plaza too.
Millions of helpers:
your boxes at home
Many "fake customers" aren't people at all. They're TV boxes, cameras and routers in ordinary homes, secretly loaded with a remote-control program.
The record attack is thought to have used 1 to 4 million devices, mostly Android TV boxes. Some came with the program already inside. Their owners kept watching TV and never knew.
A famous attack in 2016 ran on cameras and video recorders still using their factory passwords, and many big websites went down with it.
It jammed the service that looks up websites' "street addresses": What is DNS
One small thing tonight
your own box.
how many connected devices does your home have?
Quick check
What makes a DDoS attack so hard to stop?
One troublemaker you can ban; millions from everywhere, looking exactly like real customers, leave you no way to tell whom to throw out.