May 28, 2020 10:56 AM
(This post was last modified: May 28, 2020 11:40 AM by blacksmith.)
To start it off, I’ll give you a brief introduction to my WIP attack method: Dynamic attack (yes, I know, I couldn’t be bothered to choose a name). The attack collects data from all bots during an attack (mainly failure rates) and makes decisions based on the collected data.
You can use machine learning or the standard DDoS protection approach (reversed). This might not work for CF, but for (nearly?) every other ordinary DDoS protection: Determine the soft-, adjusted-, and hard threshold. Based on said thresholds, you can decide how much power you need and various other unknown variables, such as delay and duration. However, you realize that your botnet is so fucking big that you exceed your C&C server’s 10Gbps connection, even though your bots only send an 8-bit-integer over the line. Yeah, that happened, now what? Here’s where my untested, took-me-a-few-minutes-to-figure-out theory to mitigate a DDoS attack from your own botnet to your botnet’s C&C server (oh the irony) into play.
Just hear me out:
Got it? Well, all you need to do is to look at the picture below:
![[Image: Theory.png]](https://i.ibb.co/kQbqyCr/Theory.png)
That’s a TON of magic. jk. I don’t know what to say at this point as the image explains everything. You can make a few design decision that will (heavily) impact your botnet:
“Woah.. hold on there! How tf is this supposed to impact my botnet?”, you may ask. I prepared a few answers for you.
You can use machine learning or the standard DDoS protection approach (reversed). This might not work for CF, but for (nearly?) every other ordinary DDoS protection: Determine the soft-, adjusted-, and hard threshold. Based on said thresholds, you can decide how much power you need and various other unknown variables, such as delay and duration. However, you realize that your botnet is so fucking big that you exceed your C&C server’s 10Gbps connection, even though your bots only send an 8-bit-integer over the line. Yeah, that happened, now what? Here’s where my untested, took-me-a-few-minutes-to-figure-out theory to mitigate a DDoS attack from your own botnet to your botnet’s C&C server (oh the irony) into play.
Just hear me out:
- Archiver = Bot
Got it? Well, all you need to do is to look at the picture below:
That’s a TON of magic. jk. I don’t know what to say at this point as the image explains everything. You can make a few design decision that will (heavily) impact your botnet:
- How many nodes do you want to expose?
- Do you want to encrypt the relayed data?
- Do you want to use compression?
“Woah.. hold on there! How tf is this supposed to impact my botnet?”, you may ask. I prepared a few answers for you.
- How many nodes do you want to expose? P2P botnet fate, might an okay tradeoff though.
- Do you want to encrypt the relayed data? OK, fine, we could sign the data. I didn’t figure out another option yet.
- Do you want to use compression? No encryption possible (or rather no a notable difference, correct me on that one if I’m wrong here).
