The Anti-virus Times

Tuesday, November 21, 2017

A DDoS attack can’t happen on its own. It needs someone to order it and someone to execute it. The executor starts the attack, monitors it, corrects the list of attacked hosts, reports back to the customer on the work done, and so on.

Let's consider an attack that utilizes a botnet, i.e., a network of infected computers—this is the easiest method. During such an attack, the executors send a command to the botnet they manage, and all the computers start submitting requests to the attacked server. Each workstation has a network address. In other words, the attacked server knows the addresses of the hosts that are submitting requests to it. After analysing the report files on the machines in a botnet, one can find the PC that issued the attack command.

At first, this all seems straightforward... But why then do we know so little about criminal cases involving the accomplices of DDoS attacks?

First, a botnet itself can sometimes have issues.

Thus, a botnet has no single point of control. Commands are sent from one computer to another. It's difficult to unravel the tangle since the computers can be located worldwide.

The second problem is the reports that tell you what addresses were used to contact the botnet’s host. The log looks something like this:

Just in case you don’t know, all the applications in this example are legal.

These reports are usually not protected, and hackers can delete them. So, any traces they’ve left behind will be erased—unless, of course, you back up your computer regularly!

Finally, the third problem. A hacker can carry out an attack not from their own computer, but remotely—from a compromised one. One that is quite possibly located in a different country, and the criminal involved can also clean up the logs.