How a DDoS Botnet Works

Offering a massive, distributed base of internet-connected devices, a botnet is ideally suited for launching a distributed denial of service attack. In fact, DDoS attacks virtually always leverage a DDoS botnet. By sending a high volume of bogus traffic from each zombie device, the botnet can quickly overload the target network. As the web server struggles to handle the surge of requests, its processor cycles, network interfaces, and memory used for communications processing become exhausted, causing connections from normal traffic to be slowed down or even excluded.

In a volumetric DDoS attack, the DDoS botnet uses brute-force techniques to flood the target with data packets to consume bandwidth and resources. Increasingly, hackers seek to multiply the impact of a volumetric DDoS attack by leveraging the amplification factors of common protocols and services used across the internet. With this reflected amplification approach, the attacker sends multiple requests to these services spoofing the victim’s IP address, tricking servers into replying with large amplified responses. This tactic has resulted in record-breaking volumetric attacks, including a November 2021 DDoS attack on Microsoft that reached a throughput of 3.47 terabits per second. Volumetric DDoS attacks are often used as cover for other types of exploits, disabling the victim’s security infrastructure to make monitoring difficult or impossible.

A protocol DDoS attack relies on the weaknesses and complexity of internet communications protocols to compromise the target network. For example, Border Gateway Protocol (BGP) is used by network operators to announce to other networks how their address space in configured. By sending a fraudulent BGP update, a hacker can reroute network traffic to overwhelm and deplete targeted resources such as routers and firewalls. In 2018, hackers used BGP hijacking in conjunction with a DDoS botnet to redirect traffic intended for the MyEtherWallet, a service that managed Ethereum cryptocurrency accounts, to Russian servers to facilitate theft from cryptocurrency wallets.

The Rise of the IoT Botnet

The Internet of Things has been a boon for bot herders as a breeding ground for a denial of service attack. IoT devices are notorious for serious security issues, from weak or default passwords and lackluster security configurations, to open access to management systems and admin controls. Security patches are often neglected, especially in the case of consumer devices designed promising hands-free ownership. The networks through which they connect to the internet, such as home wifi systems, are typically unmonitored. These vulnerabilities make it all too easy for hackers to recruit these devices into an IoT botnet while remaining undetected for the long term.

Beginning in late 2016, a series of record-setting DDoS attacks were launched that researchers ultimately attributed to the Mirai IoT botnet. These included DDoS botnet attacks on the KrebsOnSecurity cybersecurity blog and Dyn DNS (Domain Name Service), and reached the then-unprecedented traffic level of one terabit per second. Designed to scan the internet for unsecured devices, Mirai would first attempt to log in using common default passwords before resorting to brute-force guessing. The subsequent public release of Mirai source code helped make the malware one of the most common mechanisms to recruit an IoT botnet. In the years since, Mirai variants have continue to proliferate, registering thousands of IoT botnet DDoS attacks against victims across professional, financial, and information services sectors.

Botnets and the Log4j Vulnerability

As one of the most prominent features of the cybersecurity landscape, it’s no surprise that botnets have played an important part in the Log4j vulnerability, the most serious security issue of recent years. Publicly disclosed in December 2021, the Log4j exploit is a flaw in the widely used Log4j open-source software package that can allow threat actors to mount remote code execution (RCE) attacks on the Apache Log4j Java logging library. Once the vulnerability was announced, hackers immediately put it to use. While some of these attacks were political in nature, Log4j also proved highly popular as a mechanism to perform large-scale scanning for vulnerable sites to create crypto mining and DDoS platforms.

Within weeks, Mirai IoT botnets were using the Log4j vulnerability to recruit devices including IP cameras, smart TVs, network switches, and routers. Since then, two additional botnets, Elknot (also known as the BillGates trojan) and the Gafgyt (BASHLITE), have also been detected using the Log4j exploit as a denial of service attack platform. While updated versions of Log4j have been available to close the Log4j vulnerability since shortly after its disclosure, the implementation of these patches across the industry remains an all-too-slow work in progress.

How A10 Networks Mitigates DDoS Attacks Caused by Botnets

The A10 Networks Thunder® Threat Protection System (TPS®) delivers an intelligent DDoS protection solution that mitigates a vast variety of DDoS attacks. With the IoT-based DDoS attacks growing, our DDoS protection solution ensures continued availability of services in demanding times.

A10 Networks’ security researchers are at the forefront of DDoS weapons intelligence, including the definitive annual DDoS Threat Report. A10 delivers a comprehensive and converged system to enable organizations to achieve full-spectrum DDoS protection.