Their most public attack tool, 'LOIC' [1], uses HTTP requests to try and exhaust a target website's connection capacity. It's a simple attack and the tool is flawed [2]. They're not trying to deny service at layer 3, they're attacking the layer 7 web app. It's relatively easy to detect these requests and shrug them off.

1. http://en.wikipedia.org/wiki/LOIC 2. http://news.ycombinator.com/item?id=1988045